feat(monitoring): add Portal-1 and Vultr dashboards

- scrape Portal-1 node metrics over Tailscale - add a hardened Vultr billing and bandwidth exporter - provision host health and infrastructure cost dashboards
2026-08-27 17:49:56 -04:00
parent d95b8b99ce
commit bdf67e96f0
7 changed files with 2005 additions and 0 deletions
@@ -0,0 +1,33 @@
+# Monitoring
+
+## Vultr API metrics
+
+The `vultr-exporter` service reads its API token from:
+
+```text
+/zfs/storage/secrets/services/vultr-exporter
+```
+
+Create the file on Jeeves as root with the following contents:
+
+```text
+API_KEY=<Vultr API token>
+```
+
+The token needs read access to the Vultr Account and Billing APIs. Unrelated
+resource collectors are disabled in the packaged exporter.
+
+Restrict the file to root and ensure the public egress IP used by Jeeves is
+allowed for the token in the Vultr API settings:
+
+```console
+sudo chown root:root /zfs/storage/secrets/services/vultr-exporter
+sudo chmod 600 /zfs/storage/secrets/services/vultr-exporter
+```
+
+The exporter listens on `127.0.0.1:9188`; it is scraped by the local
+`prometheus-main` service every five minutes and is not exposed through the
+host firewall.
+
+Portal-1 exposes its node exporter only through `tailscale0` on port `9100`.
+Jeeves reaches it using the Portal-1 Tailscale hostname.