konairius/homelab
10
0
Fork 0
Code Issues 11 Pull Requests 1 Packages Projects Releases 1 Wiki Activity

feat(monitoring): WAN-path probes for the NetBird edge, controller, relays #415

Merged
k.renner merged 3 commits from netbird-monitoring-probes into master 2026-07-26 07:29:35 +00:00
Conversation 5 Commits 3 Files Changed 4
+164 -6
3 Commits
Author SHA1 Message Date
claude-botandClaude Fable 5 2bd54ef378 review: escape dots in relay health instance regex
ci/woodpecker/pr/ci-scripts-test Pipeline was successful
Details
ci/woodpecker/pr/pr-review Pipeline was successful
Details 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-07-26 09:24:38 +02:00
claude-botandClaude Fable 5 e3bc00916d review: full per-member/family edge coverage; DNS is the member truth
ci/woodpecker/pr/ci-scripts-test Pipeline was successful
Details
ci/woodpecker/pr/pr-review Pipeline was successful
Details 
The review flagged the v6 target as 'proxy-2 per unifi_nat_hairpin.tf'.
The tf label keys are the swapped ones: DNS (dig) and the live hosts
(the v6-only member with the nameserver-less dhcpcd lease answers as
proxy-1.renner.uno = 2a03:…:28:f6e…; the dual-stack member answers as
proxy-2.renner.uno = 45.157.177.26 + 2a03:…:4b:c1e…) both agree with
the probe's original attribution, as does the netbird-proxy role's
'proxy-1 is v6-only' doc. Keep DNS attribution, document the tf
mislabel (tracked for a separate relabel — renaming those tf map keys
churns NAT rule resources, so it doesn't belong in this PR), and:

- add proxy-2's v6 address as a third target (previously its v6 path
  was unprobed; verified live from a pod, returns 200)
- pin job="blackbox-http" on NetbirdControllerUnreachable for
  consistency with the other rules

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-07-26 09:15:15 +02:00
claude-botandClaude Fable 5 8b1480f429 feat(monitoring): WAN-path probes for the NetBird edge, controller, relays
ci/woodpecker/pr/ci-scripts-test Pipeline was successful
Details
ci/woodpecker/pr/pr-review Pipeline was successful
Details 
Closes the vantage-point gap that let the 2026-07-24 controller outage
run ~20 h unnoticed: every existing probe of the public names resolves
in-cluster (CoreDNS/k8s_gateway) or gets hairpinned, so nothing measured
the actual WAN path.

- blackbox module http_2xx_wan_edge: probes the edge by proxy IP
  literal with SNI/Host pinned to home.renner.uno. The Server/Ingress
  VLANs are deliberately absent from the UniFi hairpin, so IP-literal
  probes from the in-cluster exporter genuinely leave via the WAN and
  come back through the netcup edge (verified live from a pod: v4
  returns 200; v6 currently fails against proxy-1 — real breakage,
  fixed separately by the resolv.conf PR).
- New probes: WAN edge per member/family (proxy-2 v4, proxy-1 v6),
  https://netbird.renner.uno (controller), relay :9000/health on both
  netcup members, tcp :33080 relay listeners.
- New PrometheusRule netbird-availability: controller unreachable
  (critical 10m), whole edge down from WAN (critical 5m), single edge
  member down (warning 15m), relay member down (warning 15m).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-07-26 08:57:01 +02:00