Добавлен сбор телеметрии на ВМ2

VM2_services/codebase/services/deployment/RUNBOOK.md

@@ -34,8 +34,11 @@ The full step-by-step procedure with gates and copy-paste commands is in
    expose unauthenticated `PING` only for health and a password-protected
    `safety` user limited to required `han:safety:*` keys/commands. The password
    in `MESSAGE_SAFETY_REDIS_URL` must match. Start from
-   `redis/redis-safety.acl.template`, replace
-   `REPLACE_WITH_LONG_RANDOM_PASSWORD`, and never commit the password.
+   `redis/redis-safety.acl.template`, replace both placeholders, and add the
+   `exporter` user limited to `PING`/`INFO`. Its ACL password must exactly match
+   the separate `REDIS_EXPORTER_PASSWORD` secret. That secret is a JSON password
+   map, `{"redis://redis-safety:6379":"<THE_SAME_PASSWORD>"}`, not a raw password
+   string. Never commit either password.
 8. Provision distinct runtime and migration DB credentials.
    `MESSAGE_SAFETY_CONFIG_ADMIN_DATABASE_URL` may migrate/activate policy while
    `MESSAGE_SAFETY_DATABASE_URL` cannot; `BITRIX_SYNC_MIGRATION_DATABASE_URL`
@@ -76,13 +79,15 @@ Compose first:
    [`arch-10-deployment.md`](../../../../architectory/arch-10-deployment.md) §6.
 3. **Images** — build and push `han-message-safety`, `han-bitrix-sync`; record
    immutable digests for every `*_IMAGE` in `.env.example` (nginx, redis, clamav,
-   otel-collector).
+   otel-collector, Redis exporter and nginx exporter).
 4. **Selectel Secrets Manager** — populate all remote names from
    `deployment/secrets/config.example.json` (DSNs, tokens, S3 read-only keys,
-   `REDIS_SAFETY_ACL`, internal TLS PEM for `8443`). Dedicated VM2 IAM principal
-   with read-only access to those names only.
+   `REDIS_SAFETY_ACL`, `REDIS_EXPORTER_PASSWORD`, internal TLS PEM for `8443`).
+   Dedicated VM2 IAM principal with read-only access to those names only.
 5. **S3 quarantine bucket** and SigNoz OTLP endpoint — non-secret values in
-   `.env`.
+   `.env`. Current self-hosted SigNoz accepts private plaintext OTLP without
+   authentication; do not provision a fake auth secret or mandatory non-empty
+   header.
 6. **Internal TLS** — internal-CA certificate with SAN = VM2 private DNS; PEM
    stored in Secrets Manager, not in the release tree.
 
@@ -136,6 +141,11 @@ Copy `.env.example` → `.env`, install loader config as
 password with `systemd-creds`, edit nginx allow-lists. Details:
 [`RUNBOOK.ru.md`](RUNBOOK.ru.md) §4.
 
+The local Collector receives logs directly over OTLP (no `filelog`), scrapes
+only itself plus the Redis/nginx exporters, and collects host metrics through
+read-only `/hostfs`. Exporters and nginx `stub_status` use internal networks and
+`expose` only; they have no host-published ports.
+
 ## 5. PostgreSQL CA and initial public TLS
 
 Install managed PostgreSQL CA under `/etc/han/ca`, issue Let's Encrypt cert for