Skip to content

Commit 73d1514

Browse files
author
root
committed
feat: nginx prometheus exporter on ks1
1 parent 218719e commit 73d1514

File tree

5 files changed

+139
-4
lines changed

5 files changed

+139
-4
lines changed

‎confs/ks1/default/prometheus-nginx-exporter‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
# Set the command-line arguments to pass to the server.
2+
# Due to shell escaping, to pass backslashes for regexes, you need to double
3+
# them (\\d for \d). If running under systemd, you need to double them again
4+
# (\\\\d to mean \d), and escape newlines too.
5+
ARGS="-web.listen-address 127.0.0.1:9113"
6+
7+
# prometheus-nginx-exporter supports the following options:
8+
#
9+
# -nginx.plus
10+
# Start the exporter for NGINX Plus. By default, the exporter is started for
11+
# NGINX. The default value can be overwritten by NGINX_PLUS environment
12+
# variable.
13+
# -nginx.retries uint
14+
# A number of retries the exporter will make on start to connect to the
15+
# NGINX stub_status page/NGINX Plus API before exiting with an error. The
16+
# default value can be overwritten by NGINX_RETRIES environment variable.
17+
# -nginx.retry-interval value
18+
# An interval between retries to connect to the NGINX stub_status page/NGINX
19+
# Plus API on start. The default value can be overwritten by
20+
# NGINX_RETRY_INTERVAL environment variable. (default 5s).
21+
# -nginx.scrape-uri string
22+
# A URI or unix domain socket path for scraping NGINX or NGINX Plus metrics.
23+
# For NGINX, the stub_status page must be available through the URI. For
24+
# NGINX Plus -- the API. The default value can be overwritten by SCRAPE_URI
25+
# environment variable. (default "http://127.0.0.1:8080/stub_status").
26+
# -nginx.ssl-ca-cert string
27+
# Path to the PEM encoded CA certificate file used to validate the servers
28+
# SSL certificate. The default value can be overwritten by SSL_CA_CERT
29+
# environment variable.
30+
# -nginx.ssl-client-cert string
31+
# Path to the PEM encoded client certificate file to use when connecting to
32+
# the server. The default value can be overwritten by SSL_CLIENT_CERT
33+
# environment variable.
34+
# -nginx.ssl-client-key string
35+
# Path to the PEM encoded client certificate key file to use when connecting
36+
# to the server. The default value can be overwritten by SSL_CLIENT_KEY
37+
# environment variable.
38+
# -nginx.ssl-verify
39+
# Perform SSL certificate verification. The default value can be overwritten
40+
# by SSL_VERIFY environment variable. (default true).
41+
# -nginx.timeout value
42+
# A timeout for scraping metrics from NGINX or NGINX Plus. The default value
43+
# can be overwritten by TIMEOUT environment variable. (default 5s).
44+
# -prometheus.const-labels value
45+
# A comma separated list of constant labels that will be used in every
46+
# metric. Format is label1=value1,label2=value2... The default value can be
47+
# overwritten by CONST_LABELS environment variable.
48+
# -web.listen-address string
49+
# An address or unix domain socket path to listen on for web interface and
50+
# telemetry. The default value can be overwritten by LISTEN_ADDRESS
51+
# environment variable. (default ":9113").
52+
# -web.secured-metrics
53+
# Expose metrics using https. The default value can be overwritten by
54+
# SECURED_METRICS variable.
55+
# -web.ssl-server-cert string
56+
# Path to the PEM encoded certificate for the nginx-exporter metrics
57+
# server(when web.secured-metrics=true). The default value can be
58+
# overwritten by SSL_SERVER_CERT variable.
59+
# -web.ssl-server-key string
60+
# Path to the PEM encoded key for the nginx-exporter metrics server (when
61+
# web.secured-metrics=true). The default value can be overwritten by
62+
# SSL_SERVER_KEY variable.
63+
# -web.telemetry-path string
64+
# A path under which to expose metrics. The default value can be overwritten
65+
# by TELEMETRY_PATH environment variable. (default "/metrics").

‎confs/ks1/nginx/sites-available/images-off‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -106,8 +106,8 @@ server {
106106
}
107107

108108

109-
listen [::]:443 ssl ipv6only=on; # managed by Certbot
110-
listen 443 ssl; # managed by Certbot
109+
listen [::]:443 ssl http2 ipv6only=on; # managed by Certbot
110+
listen 443 ssl http2; # managed by Certbot
111111
ssl_certificate /etc/letsencrypt/live/images.openfoodfacts.org-0001/fullchain.pem; # managed by Certbot
112112
ssl_certificate_key /etc/letsencrypt/live/images.openfoodfacts.org-0001/privkey.pem; # managed by Certbot
113113
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
@@ -121,8 +121,8 @@ server {
121121
} # managed by Certbot
122122

123123

124-
listen 80 http2;
125-
listen [::]:80 http2;
124+
listen 80;
125+
listen [::]:80;
126126
server_name images.openfoodfacts.org;
127127
return 404; # managed by Certbot
128128

‎confs/ks1/nginx/sites-available/ks1‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
# map from service to exporter
2+
map $uri $exporter {
3+
# nginx metrics proxy
4+
"/images-ks1/nginx/metrics" 127.0.0.1:9113;
5+
}
6+
7+
#log_format debug_exporter "$time_local $scheme://$host:$server_port$request_uri $exporter";
8+
9+
# https server
10+
server {
11+
server_name ks1.openfoodfacts.org;
12+
13+
# SSL/TLS settings
14+
listen [::]:443 ssl; # managed by Certbot
15+
listen 443 ssl; # managed by Certbot
16+
ssl_certificate /etc/letsencrypt/live/ks1.openfoodfacts.org/fullchain.pem; # managed by Certbot
17+
ssl_certificate_key /etc/letsencrypt/live/ks1.openfoodfacts.org/privkey.pem; # managed by Certbot
18+
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
19+
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
20+
21+
# logs location, avoid access_log, no need
22+
#access_log /var/log/nginx/free-exporters.log debug_exporter;
23+
#access_log /var/log/nginx/free-exporters.log main;
24+
access_log off;
25+
error_log /var/log/nginx/ks1.errors.log;
26+
27+
# protect
28+
auth_basic "Exporter metrics";
29+
auth_basic_user_file "/etc/nginx/.htpasswd/ks1";
30+
31+
# url to join is defined thanks to exporter variable, itself based upon uri
32+
location / {
33+
34+
if ($exporter = "") {
35+
return 404;
36+
}
37+
proxy_pass http://$exporter/metrics;
38+
proxy_set_header X-Real-IP $remote_addr;
39+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
40+
proxy_set_header X-Forwarded-Proto https;
41+
proxy_set_header Host $host;
42+
client_max_body_size 512M;
43+
}
44+
}
45+
46+
47+
48+
49+
server {
50+
if ($host = ks1.openfoodfacts.org) {
51+
return 301 https://$host$request_uri;
52+
} # managed by Certbot
53+
54+
listen 80;
55+
listen [::]:80;
56+
server_name ks1.openfoodfacts.org;
57+
return 404; # managed by Certbot
58+
59+
location /.well-known {
60+
root /var/www/html;
61+
try_files $uri =404;
62+
}
63+
}

‎confs/ks1/nginx/sites-available/stub_status‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
# This enables prometheus exporter to get data from nginx
2+
server {
3+
listen 127.0.0.1:8080;
4+
stub_status on;
5+
}
6+

‎confs/ks1/sysctl.d/60-swapiness.conf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
vm.swappiness=10

0 commit comments

Comments
 (0)