claude-botandClaude Opus 5
b76a948e28
common.yml applied monitoring-agent (Alloy) to every inventory host, pointing at loki.srv.renner.uno:3100 and prometheus.srv.renner.uno:9090. Both moved into the cluster and neither name resolves any more, so nas-1, claude-ws, netbird and the proxies have been shipping logs and metrics nowhere. Repointing them was the obvious fix and the wrong one. The cluster endpoints are authenticated — loki.renner.uno returns 401 and prometheus.renner.uno sits behind an Authentik forward-auth gate — while monitoring-agent has no auth support at all. Making it work would mean per-host credentials, htpasswd entries in the cluster secret, and some answer for remote-write past the gate. Nobody reads those metrics: edge-1 is the host that matters, and edge-2 when it exists. edge hosts are unaffected. install-edge-host.yml is self-contained and deliberately never carried monitoring-agent; they ship via edge-log-shipper, which already does this correctly — authenticated push to the cluster ingress with a per-host credential. install-netbird-monitoring.yml goes too; applying monitoring-agent to netbird_server was its only content. Comments referring to the role are corrected in install-edge-host.yml, install-claude-workstation.yml, the claude-workstation role and its RUNBOOK. Three more described the old srv Loki as "firewalled off the IoT VLAN" — it is not firewalled, it is gone. The reason edge hosts use the authenticated ingress is unchanged, but the stated reason was no longer true. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>