---
# Address the node exporter binds to; empty = all addresses. For hosts without host_firewall: the NetBird
# address keeps the port off the LAN, and the mesh ACL decides who reaches it.
host_exporters_listen_address: ""

# Adds prometheus-smartctl-exporter (trixie-backports) next to the node exporter
# on hosts with physical disks.
host_exporters_smart: false

# Adds ipmitool and prometheus-ipmi-exporter (port 9290) on hosts with a BMC reachable through /dev/ipmi0.
host_exporters_ipmi: false
host_exporters_ipmi_collectors:
  - ipmi
  - bmc
  - sel
  - chassis
# The tools run as root and parse the FreeIPMI configuration file named by --config-file. The exporter
# writes that file itself (a named pipe in its /tmp, empty for in-band local mode), so a compromised
# exporter could set options such as sdr-cache-directory and make root write anywhere. The wrappers
# therefore replace the path with this static root-owned file, and sudoers admits only that path.
host_exporters_ipmi_freeipmi_conf: /etc/ipmi-exporter/freeipmi.conf

# FreeIPMI tool behind each collector and the fixed arguments the exporter (1.10) passes before
# --config-file. sudo admits exactly these, so a compromised exporter cannot run chassis control or
# clear the SEL. A different exporter version needs matching arguments (ipmi_up stays 0 until then).
# dcmi is not listed: the S1200RP BMC has no power monitoring.
host_exporters_ipmi_tools:
  ipmi:
    tool: ipmimonitoring
    args: --quiet-cache --ignore-unrecognized-events --comma-separated-output --no-header-output --sdr-cache-recreate --output-event-bitmask --output-sensor-state
  bmc:
    tool: bmc-info
    args: ""
  sel:
    tool: ipmi-sel
    args: --info
  chassis:
    tool: ipmi-chassis
    args: --get-chassis-status