40 lines
1.7 KiB
YAML
40 lines
1.7 KiB
YAML
---
|
|
# Address the node exporter binds to; empty = all addresses. For hosts without host_firewall: the NetBird
|
|
# address keeps the port off the LAN, and the mesh ACL decides who reaches it.
|
|
host_exporters_listen_address: ""
|
|
|
|
# Adds prometheus-smartctl-exporter (trixie-backports) next to the node exporter
|
|
# on hosts with physical disks.
|
|
host_exporters_smart: false
|
|
|
|
# Adds ipmitool and prometheus-ipmi-exporter (port 9290) on hosts with a BMC reachable through /dev/ipmi0.
|
|
host_exporters_ipmi: false
|
|
host_exporters_ipmi_collectors:
|
|
- ipmi
|
|
- bmc
|
|
- sel
|
|
- chassis
|
|
# The tools run as root and parse the FreeIPMI configuration file named by --config-file. The exporter
|
|
# writes that file itself (a named pipe in its /tmp, empty for in-band local mode), so a compromised
|
|
# exporter could set options such as sdr-cache-directory and make root write anywhere. The wrappers
|
|
# therefore replace the path with this static root-owned file, and sudoers admits only that path.
|
|
host_exporters_ipmi_freeipmi_conf: /etc/ipmi-exporter/freeipmi.conf
|
|
|
|
# FreeIPMI tool behind each collector and the fixed arguments the exporter (1.10) passes before
|
|
# --config-file. sudo admits exactly these, so a compromised exporter cannot run chassis control or
|
|
# clear the SEL. A different exporter version needs matching arguments (ipmi_up stays 0 until then).
|
|
# dcmi is not listed: the S1200RP BMC has no power monitoring.
|
|
host_exporters_ipmi_tools:
|
|
ipmi:
|
|
tool: ipmimonitoring
|
|
args: --quiet-cache --ignore-unrecognized-events --comma-separated-output --no-header-output --sdr-cache-recreate --output-event-bitmask --output-sensor-state
|
|
bmc:
|
|
tool: bmc-info
|
|
args: ""
|
|
sel:
|
|
tool: ipmi-sel
|
|
args: --info
|
|
chassis:
|
|
tool: ipmi-chassis
|
|
args: --get-chassis-status
|