Admin/han-app
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Добавлен сбор телеметрии на ВМ2

Browse Source
This commit is contained in:
mi
2026-08-26 15:12:51 +03:00
parent 728b9826a3
commit f989097484
32 changed files with 2029 additions and 134 deletions
Download Patch File Download Diff File Expand all files Collapse all files
VM2_services/codebase/services/deployment/preflight.sh
+53 -2
View File
@@ -59,7 +59,7 @@ if [ -f "$ENV_FILE" ]; then
true|false) ;;
*) fail "OTEL_REMOTE_TLS_INSECURE must be exactly true or false" ;;
esac
for image_key in MESSAGE_SAFETY_IMAGE BITRIX_SYNC_IMAGE NGINX_IMAGE REDIS_IMAGE CLAMAV_IMAGE OTEL_COLLECTOR_IMAGE; do
for image_key in MESSAGE_SAFETY_IMAGE BITRIX_SYNC_IMAGE NGINX_IMAGE REDIS_IMAGE CLAMAV_IMAGE OTEL_COLLECTOR_IMAGE REDIS_EXPORTER_IMAGE NGINX_EXPORTER_IMAGE; do
image=$(/usr/bin/awk -F= -v key="$image_key" '$1 == key {print substr($0, index($0, "=") + 1)}' "$ENV_FILE")
echo "$image" | /usr/bin/grep -Eq '@sha256:[0-9a-f]{64}$' ||
fail "$image_key must be pinned by sha256 digest"
@@ -70,6 +70,25 @@ if [ -f "$ENV_FILE" ]; then
esac
fi
collector_config="$ROOT/observability/otel-collector.yaml"
[ -f "$collector_config" ] || fail "OpenTelemetry Collector config is missing"
if [ -f "$collector_config" ]; then
/usr/bin/grep -Fq 'service.namespace, value: han-chat' "$collector_config" ||
fail "Collector must enforce service.namespace=han-chat"
/usr/bin/grep -Fq 'receivers: [otlp, prometheus, hostmetrics]' "$collector_config" ||
fail "Collector metrics pipeline is incomplete"
/usr/bin/grep -Fq 'receivers: [otlp]' "$collector_config" ||
fail "Collector direct OTLP logs pipeline is missing"
! /usr/bin/grep -Fq 'filelog' "$collector_config" ||
fail "Collector filelog receiver is forbidden for direct OTLP logging"
/usr/bin/grep -Fq 'redis-exporter:9121' "$collector_config" ||
fail "Collector Redis exporter scrape target is missing"
/usr/bin/grep -Fq 'nginx-exporter:9113' "$collector_config" ||
fail "Collector nginx exporter scrape target is missing"
/usr/bin/grep -Fq 'tail_sampling:' "$collector_config" ||
fail "Collector tail sampling is missing"
fi
bitrix_allowlist="$ROOT/nginx/allowlists/bitrix-webhook-allowlist.conf"
private_allowlist="$ROOT/nginx/allowlists/private-caller-allowlist.conf"
for allowlist in "$bitrix_allowlist" "$private_allowlist"; do
@@ -106,7 +125,8 @@ BITRIX_SYNC_CRM_REST_WEBHOOK_URL
BITRIX_SYNC_CONTACT_RECEIVER_TOKEN
BITRIX_SYNC_ALERT_RECEIVER_TOKEN
BITRIX_SYNC_SERVICE_TOKEN
REDIS_SAFETY_ACL'
REDIS_SAFETY_ACL
REDIS_EXPORTER_PASSWORD'
if [ -f "$MANIFEST" ]; then
old_ifs=$IFS
@@ -123,6 +143,37 @@ if [ -f "$MANIFEST" ]; then
done
IFS=$old_ifs
redis_acl=$(/usr/bin/awk -F= \
'$1 == "REDIS_SAFETY_ACL" {print substr($0, index($0, "=") + 1)}' \
"$MANIFEST")
redis_exporter_password_file=$(/usr/bin/awk -F= \
'$1 == "REDIS_EXPORTER_PASSWORD" {print substr($0, index($0, "=") + 1)}' \
"$MANIFEST")
if [ -f "$redis_acl" ] && [ -f "$redis_exporter_password_file" ]; then
/usr/bin/grep -Eq '^user exporter reset on >[^[:space:]]+ -@all \+ping \+info$' "$redis_acl" ||
fail "Redis ACL must contain the restricted exporter user"
if exporter_password=$(/usr/bin/python3 -c '
import json
import sys
target = "redis://redis-safety:6379"
with open(sys.argv[1], encoding="utf-8") as source:
values = json.load(source)
if set(values) != {target}:
raise SystemExit("password map must contain exactly redis://redis-safety:6379")
password = values[target]
if not isinstance(password, str) or not password or any(char.isspace() for char in password):
raise SystemExit("password must be a non-empty whitespace-free string")
print(password, end="")
' "$redis_exporter_password_file"); then
/usr/bin/grep -Fq -- ">$exporter_password " "$redis_acl" ||
fail "Redis exporter password map does not match REDIS_SAFETY_ACL"
unset exporter_password
else
fail "REDIS_EXPORTER_PASSWORD must be a valid redis_exporter JSON password map"
fi
fi
internal_cert=$(/usr/bin/awk -F= \
'$1 == "VM2_INTERNAL_TLS_CERTIFICATE" {print substr($0, index($0, "=") + 1)}' \
"$MANIFEST")