taler-docs

Documentation for GNU Taler components, APIs and protocols
Log | Files | Refs | README | LICENSE

taler-monitoring-infrastructure.rst (4622B)

      1 ..
      2   This file is part of GNU TALER.
      3 
      4   Copyright (C) 2014-2023 Taler Systems SA
      5 
      6   TALER is free software; you can redistribute it and/or modify it under the
      7   terms of the GNU Affero General Public License as published by the Free Software
      8   Foundation; either version 3.0, or (at your option) any later version.
      9 
     10   TALER is distributed in the hope that it will be useful, but WITHOUT ANY
     11   WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
     12   A PARTICULAR PURPOSE.  See the GNU Affero General Public License for more details.
     13 
     14   You should have received a copy of the GNU Affero General Public License along with
     15   TALER; see the file COPYING.  If not, see <http://www.gnu.org/licenses/>
     16 
     17   @author Javier Sepulveda
     18 
     19 .. _taler-merchant-monitoring:
     20 .. _taler-monitoring:
     21 
     22 GNU Taler monitoring
     23 ####################
     24 
     25 Sentol is the central monitoring server for host metrics, journals and service
     26 health. The Ansible setup and operational documentation live in the
     27 ``monitoring/`` directory of ``tsys-infra.git``, starting with
     28 ``monitoring/README.md``. Refer there for deployment, configuration, client
     29 enrollment and maintenance.
     30 
     31 Architecture
     32 ============
     33 
     34 The stack runs as native systemd services on Sentol and the monitored hosts:
     35 
     36 * **Metrics:** Prometheus scrapes Node Exporter and Fluent Bit metrics through
     37   each host's nginx proxy using mutually authenticated TLS (mTLS).
     38 * **Logs:** Fluent Bit forwards system journals through Sentol's mTLS nginx
     39   receiver to VictoriaLogs. The receiver derives the host identity from the
     40   client certificate.
     41 * **Service checks:** Blackbox Exporter probes HTTP(S) availability and TLS
     42   certificates; JSON Exporter reads build and protocol versions from service
     43   ``/config`` endpoints.
     44 * **Dashboards and alerts:** Perses displays Prometheus metrics. Prometheus
     45   evaluates alert rules and sends alerts to Alertmanager for email delivery.
     46 
     47 .. only:: html
     48 
     49    .. mermaid::
     50       :config: {"layout": "elk"}
     51       :caption: Monitoring architecture; arrows show requests or log and alert delivery.
     52       :alt: Prometheus scrapes host metrics over mTLS and service health through exporters. Fluent Bit sends journals over mTLS to VictoriaLogs. Perses provides dashboards, Alertmanager sends email, and nginx provides authenticated web access.
     53 
     54       flowchart TB
     55           subgraph host["Monitored host"]
     56               proxy["nginx metrics proxy"]
     57               node["Node Exporter"]
     58               journal["System journal"]
     59               fluent["Fluent Bit"]
     60               proxy --> node
     61               proxy -->|"collector metrics"| fluent
     62               journal --> fluent
     63           end
     64           subgraph sentol["Sentol"]
     65               prom["Prometheus"]
     66               ingest["nginx log receiver"]
     67               logs["VictoriaLogs"]
     68               probes["Blackbox and JSON exporters"]
     69               perses["Perses"]
     70               alert["Alertmanager"]
     71               web["nginx web access"]
     72               prom -->|"scrape"| probes
     73               perses -->|"query"| prom
     74               prom -->|"alerts"| alert
     75               ingest --> logs
     76               web --> perses
     77               web --> prom
     78               web --> alert
     79               web --> logs
     80           end
     81           prom -->|"pull / mTLS"| proxy
     82           fluent -->|"push / mTLS"| ingest
     83           probes -->|"HTTP(S) and /config"| endpoints["Public services"]
     84           browser["Operator browser"] -->|"HTTPS / password"| web
     85           alert --> smtp["SMTP relay"]
     86           kuma["Uptime Kuma"] -->|"independent checks"| endpoints
     87 
     88 Sentol also monitors itself. Collector and server backends listen on loopback;
     89 nginx exposes the authenticated interfaces. One private monitoring CA secures
     90 metrics and log transport. Metrics and logs are stored centrally on Sentol.
     91 
     92 Hosts are either managed directly by ``tsys-infra.git`` or enrolled as external
     93 clients. ``ansible-taler-exchange`` uses the latter model: it configures exchange
     94 hosts from bundles exported by Sentol.
     95 
     96 :doc:`uptime-kuma` provides independent availability monitoring, including
     97 exchange key and fee checks. Its checks and notifications are configured
     98 separately from Sentol.
     99 
    100 Web interfaces
    101 ==============
    102 
    103 The interfaces share password authentication over HTTPS. Public Perses access
    104 is read-only.
    105 
    106 * `Perses <https://monitoring.taler.net/>`_: dashboards and monitoring overview.
    107 * `Prometheus <https://monitoring.taler.net/prometheus/>`_: metrics, targets and rules.
    108 * `Alertmanager <https://monitoring.taler.net/alertmanager/>`_: alerts and silences.
    109 * `VictoriaLogs <https://monitoring.taler.net/logs/>`_: journal search.