Initial LisgloSIPS V2 implementation

infra/server-a/s06/nftables/node-exporter.nft

@@ -0,0 +1,7 @@
+table inet lisglosips_s06 {
+  chain input {
+    type filter hook input priority filter; policy accept;
+
+    tcp dport 9100 ip saddr != 100.90.90.91 drop
+  }
+}

infra/server-a/s06/node-exporter.env

@@ -0,0 +1,2 @@
+ARGS=--web.listen-address=100.90.90.90:9100 --collector.systemd --collector.processes
+

infra/server-a/s06/scripts/configure-node-exporter

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+STAGE=${STAGE:-/tmp/lisglosips-s06-stage}
+
+stamp=$(date +%Y%m%d%H%M%S)
+backup=/var/backups/lisglosips-s06/$stamp
+install -d -m 0700 "$backup"
+systemctl cat prometheus-node-exporter.service >"$backup/prometheus-node-exporter.service.before" 2>/dev/null || true
+systemctl cat lisglosips-node-exporter.service >"$backup/lisglosips-node-exporter.service.before" 2>/dev/null || true
+dpkg-query -W -f='${Package}\t${Version}\n' prometheus-node-exporter >"$backup/packages.before" 2>/dev/null || true
+
+apt-get update -qq
+DEBIAN_FRONTEND=noninteractive apt-get install -y prometheus-node-exporter=1.7.0-1ubuntu0.3
+
+install -d -o root -g root -m 0755 /etc/nftables.d
+install -o root -g root -m 0644 "$STAGE/nftables/node-exporter.nft" /etc/nftables.d/lisglosips-s06-exporter.nft
+install -o root -g root -m 0644 "$STAGE/systemd/lisglosips-exporter-firewall.service" /etc/systemd/system/lisglosips-exporter-firewall.service
+install -o root -g root -m 0644 "$STAGE/systemd/lisglosips-node-exporter.service" /etc/systemd/system/lisglosips-node-exporter.service
+install -o root -g root -m 0644 "$STAGE/node-exporter.env" /etc/default/lisglosips-node-exporter
+
+systemctl daemon-reload
+systemctl disable --now prometheus-node-exporter.service prometheus-node-exporter.socket 2>/dev/null || true
+systemctl kill prometheus-node-exporter.service 2>/dev/null || true
+pkill -f '^/usr/bin/prometheus-node-exporter$' 2>/dev/null || true
+systemctl mask prometheus-node-exporter.service 2>/dev/null || true
+systemctl disable --now openipmi.service 2>/dev/null || true
+systemctl mask openipmi.service 2>/dev/null || true
+systemctl reset-failed prometheus-node-exporter.service openipmi.service lisglosips-node-exporter.service 2>/dev/null || true
+systemctl enable --now lisglosips-exporter-firewall.service lisglosips-node-exporter.service
+
+systemctl is-active --quiet lisglosips-exporter-firewall.service
+systemctl is-active --quiet lisglosips-node-exporter.service
+curl -fsS http://100.90.90.90:9100/metrics >/dev/null
+
+echo "S06 A node exporter configured. Backup: $backup"

infra/server-a/s06/systemd/lisglosips-exporter-firewall.service

@@ -0,0 +1,13 @@
+[Unit]
+Description=LisgloSIPS exporter firewall
+Before=lisglosips-node-exporter.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=true
+ExecStartPre=-/usr/sbin/nft delete table inet lisglosips_s06
+ExecStart=/usr/sbin/nft -f /etc/nftables.d/lisglosips-s06-exporter.nft
+ExecStop=-/usr/sbin/nft delete table inet lisglosips_s06
+
+[Install]
+WantedBy=multi-user.target