Add a host_exporters role for the node and smartctl exporters and a host_firewall scrapers rule that opens exporter ports on wt0 to named source addresses

2026-10-23 20:44:59 +00:00
parent 381e1b285c
commit a64d082c0c
4 changed files with 90 additions and 0 deletions
@@ -16,6 +16,12 @@ firewall:
  admin:
    v4: {}
    v6: {}
+  # Metrics scrapers: on wt0 only these source addresses reach the listed tcp
+  # ports (the vpn zone applies to every peer). Rendered only when both are set.
+  scrapers:
+    tcp: {}
+    v4: {}
+    v6: {}
  # Interface names (nft wildcards allowed) whose traffic is trusted.
  internal_ifaces: {}
  # Guest bridges (Proxmox vmbr*): DHCP, router solicitations and the public