diff --git a/PORTAINER.md b/PORTAINER.md index 34f2743..a9b71bf 100644 --- a/PORTAINER.md +++ b/PORTAINER.md @@ -131,6 +131,8 @@ Add these only if you need them: | `UNIFI_SITE` | `default` | you renamed your site | | `COVERAGE_SKIP_TAG` | `nobackup` | a Proxmox VE or XCP-ng tag that leaves a VM out of the last-backup check | | `COVERAGE_SKIP` | empty | VMs left out of the last-backup check by name, separated by commas; `*` matches any run of characters | +| `CERT_WATCH` | empty | more certificates for the Renewals tab, as `host` or `host:port` (443 unless given), separated by commas. Every https source, https up-check and UniFi console is watched already | +| `DOMAINS_WATCH` | empty | domains whose registration end goes on the Renewals tab, separated by commas. Looked up once a day over RDAP, which sends each name to its registry's server | | `PORT_SLEEPS` | empty | switch ports whose computer sleeps, as `mac/port` separated by commas: a drop to 100 Mb/s or lower there is expected. The slow-link alert's button writes it | | `TOOLS_SCAN_NETWORKS` | empty | narrows where the Tools tab's port scan may go, such as `192.168.1.0/24, 10.20.0.0/16`. Empty, any private address (10/8, 172.16/12, 192.168/16); a network outside those is left out, never added | | `UNIFI_OS` | `true` | `false` for a self-hosted standalone controller | @@ -481,7 +483,10 @@ Each UPS is a panel on the **Power and servers** tab. Alerts: on battery (`ups_on_battery`) and battery low or depleted (`ups_battery_low`) are bad; battery needs replacing (`ups_battery_replace`, from the UPS's own alarm) and 90% load or more (`ups_overload`) are warnings; ten minutes of runtime -or less is a warning and five or less is bad (`ups_runtime_low`). APC, +or less is a warning and five or less is bad (`ups_runtime_low`). On a paid +edition, a battery whose runtime at its load has fallen to 75% of its first +month's, is forecast under ten minutes within 90 days, or is dated over four +years old warns (`ups_battery_aging`). APC, Raritan and Eaton PDUs are read too, and sit on the same tab. #### Servers, over Redfish @@ -515,6 +520,29 @@ redundancy lost (`server_psu`), a drive not OK or predicting failure Thermal and Power resources are read; a BMC offering only ThermalSubsystem and PowerSubsystem says so on its panel. +#### Machines without a BMC, over Intel AMT + +Kind `amt` reads a machine with no BMC through Intel AMT (vPro mini PCs and +workstations, such as the Minisforum MS-01), over WS-Management on 16993 +(TLS) or 16992: the BIOS version, the chassis's and baseboard's maker, model +and serial, processors, memory modules, and AMT's own host name. Only +Enumerate and Pull are sent. It signs in with HTTP Digest; the account needs +network access and only the Hardware Asset and General Info realms. One slot +lists every machine sharing an account; `user=` is required, and `host=` +names the host each address is, in order, where AMT's host name isn't the +host's. The slot is read every 5 minutes unless it says `every=`: + +``` +SOURCE_7=amt https://10.0.0.98,https://10.0.0.99 name=minis user=collimo host=pve-01,pve-02 +SOURCE_7_SECRET= +``` + +Each machine is a panel on the **Power and servers** tab, and its BIOS feeds +cluster consistency, matched by serial and then by name; a placeholder +serial such as `Default string` is no serial. AMT's HostOSFQDN is never +read: only Windows' LMS keeps it current. AMT not answering is +`source_down`. + ### Inventory reports With a vCenter, Proxmox VE or XCP-ng slot, the Virtualization tab has an @@ -601,12 +629,17 @@ capacity), kept for two years in `capacity/` beside the archive, whatever the edition. On first start the inventory runs already held seed the disk and allocation history. The **Capacity** tab forecasts when each reaches its threshold, with a range, and raises `capacity_runway` when that is close. +Its **Network** section does the same for uplinks between switches and each +WAN, at their daily 95th percentile against their speed (a WAN's: +`CAPACITY_WAN`, else its best speedtest), and for switches' PoE budgets; +`link_saturation` and `poe_budget` are warnings. | Variable | Default | | |---|---|---| | `CAPACITY_THRESHOLDS` | `cpu=80,mem=80,disk=85,pool=85` | the share of usable capacity, in %, forecasts are for; also `alloc_cpu`, `alloc_mem` and `alloc_disk` against the ratios below (100 by default). `pool` is Ceph and other replicated storage, planned to nearfull | | `CAPACITY_RUNWAY` | `warn=90,bad=30` | days left at which a forecast warns, and is critical | | `CAPACITY_RATIOS` | `vcpu=4,vmem=1,disk=1.5` | allocation limits: vCPUs per core, VM memory per byte of host memory, provisioned disk per byte | +| `CAPACITY_ALLOC_ALERTS` | empty | the allocation forecasts that raise runway alerts: `alloc_cpu`, `alloc_mem`, `alloc_disk`. Empty, they are planning only and memory and CPU in use alert | | `CAPACITY_VM_SIZE` | `vcpu=4,mem=16,disk=100` | the VM "how many more fit" counts in, memory and disk in GB | | `CAPACITY_SUMMARY_TO` | empty | who gets the monthly capacity summary on the 1st, through the SMTP server alert email uses; its own list, not `SMTP_TO` | | `CAPACITY_SUMMARY_BY` | empty | a "Prepared by" name on the summary | @@ -614,6 +647,7 @@ threshold, with a range, and raises `capacity_runway` when that is close. | `CAPACITY_HOST` | empty | the host "What to buy" plans in, such as `cores=64,mem=1024` (memory in GB); empty: each cluster's largest | | `CAPACITY_DISK_TBW` | empty | each drive model's rated terabytes written, such as `CT1000P310SSD8=220; Samsung SSD 990 PRO 1TB=600`, for disk wear | | `CAPACITY_HA` | empty | hosts kept spare per cluster, such as `Prod=1,lab=0`: usable capacity is then the cluster less its largest hosts | +| `CAPACITY_WAN` | empty | each WAN's download/upload in Mb/s by its network group, such as `WAN=1000/40,WAN2=300/30`, for network capacity. Empty: its best speedtest of the last 30 days; with neither, the WAN is shown and not judged | What Proxmox VE cannot tell a read-only token is left out rather than asked for: a VM's IP addresses, partitions and guest OS need the QEMU guest agent diff --git a/docker-compose.yml b/docker-compose.yml index 5d65934..b26dbde 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -25,7 +25,7 @@ services: # host. # Each release writes its own version and registry in as the defaults, # so a blank stack runs it. - image: ${COLLIMO_IMAGE:-ghcr.io/collimohq/collimo}:${COLLIMO_VERSION:-0.2.0} + image: ${COLLIMO_IMAGE:-ghcr.io/collimohq/collimo}:${COLLIMO_VERSION:-0.3.0} # Ask the registry on every deploy. A fixed release costs one quick # request; qa moves, and this is how a redeploy picks it up. pull_policy: always @@ -112,6 +112,13 @@ services: # CHECKS=ping 192.168.1.20 name=printer; http https://nas.lab:5001 name=nas CHECKS: ${CHECKS:-} + # The Renewals tab watches every https source, https up-check and + # console's certificate already; CERT_WATCH adds host[:port] entries, + # commas between. DOMAINS_WATCH looks domains up over RDAP once a day, + # which sends each name to its registry: empty, none. + CERT_WATCH: ${CERT_WATCH:-} + DOMAINS_WATCH: ${DOMAINS_WATCH:-} + # The Tools tab's port scan reaches private addresses only; this can # narrow it to some of them, such as 192.168.1.0/24. TOOLS_SCAN_NETWORKS: ${TOOLS_SCAN_NETWORKS:-} @@ -229,6 +236,9 @@ services: CAPACITY_THRESHOLDS: ${CAPACITY_THRESHOLDS:-cpu=80,mem=80,disk=85,pool=85} CAPACITY_RUNWAY: ${CAPACITY_RUNWAY:-warn=90,bad=30} CAPACITY_RATIOS: ${CAPACITY_RATIOS:-vcpu=4,vmem=1,disk=1.5} + # Allocation forecasts that alert (alloc_cpu, alloc_mem, alloc_disk); + # empty, they are planning only and what is in use alerts. + CAPACITY_ALLOC_ALERTS: ${CAPACITY_ALLOC_ALERTS:-} CAPACITY_VM_SIZE: ${CAPACITY_VM_SIZE:-vcpu=4,mem=16,disk=100} CAPACITY_HA: ${CAPACITY_HA:-} # The monthly capacity summary: who gets it, whose name is on it, and @@ -239,6 +249,9 @@ services: CAPACITY_HOST: ${CAPACITY_HOST:-} # Rated endurance per drive model, for disk wear: CT1000P310SSD8=220 CAPACITY_DISK_TBW: ${CAPACITY_DISK_TBW:-} + # Each WAN's download/upload in Mb/s, for network capacity: + # WAN=1000/40. Empty: its best speedtest of the last 30 days. + CAPACITY_WAN: ${CAPACITY_WAN:-} # A copy of every inventory in PostgreSQL, for Grafana and Power BI # (paid). For the stack's own, add "postgres" to COMPOSE_PROFILES and # set INVENTORY_DB_PASSWORD; for one you run, set INVENTORY_DB_URL. The diff --git a/sbom/sbom-amd64.cdx.json b/sbom/sbom-amd64.cdx.json index 1e5e36a..a457b92 100644 --- a/sbom/sbom-amd64.cdx.json +++ b/sbom/sbom-amd64.cdx.json @@ -1,16 +1,16 @@ { "bomFormat": "CycloneDX", "specVersion": "1.5", - "serialNumber": "urn:uuid:3c1f447c-d0b9-4135-a01c-1b327c493b0c", + "serialNumber": "urn:uuid:c1dba5bd-7b23-4584-8aaa-bec278f15e0e", "version": 1, "metadata": { - "timestamp": "2026-11-03T15:46:04Z", + "timestamp": "2026-11-05T18:16:02Z", "component": { "type": "container", "bom-ref": "collimo-image", "name": "collimo", - "version": "0.2.0", - "purl": "pkg:oci/collimo@0.2.0?repository_url=ghcr.io/collimohq/collimo&arch=amd64", + "version": "0.3.0", + "purl": "pkg:oci/collimo@0.3.0?repository_url=ghcr.io/collimohq/collimo&arch=amd64", "properties": [{"name": "base-image", "value": "scratch"}] } }, @@ -19,9 +19,9 @@ "type": "application", "bom-ref": "collimo", "name": "collimo", - "version": "0.2.0", + "version": "0.3.0", "description": "The Collimo collector, a static linux/amd64 binary", - "purl": "pkg:generic/collimohq/collimo@0.2.0?arch=amd64" + "purl": "pkg:generic/collimohq/collimo@0.3.0?arch=amd64" }, { "type": "library", diff --git a/sbom/sbom-arm64.cdx.json b/sbom/sbom-arm64.cdx.json index bd56794..b287f26 100644 --- a/sbom/sbom-arm64.cdx.json +++ b/sbom/sbom-arm64.cdx.json @@ -1,16 +1,16 @@ { "bomFormat": "CycloneDX", "specVersion": "1.5", - "serialNumber": "urn:uuid:9d11f5a8-2e77-4736-9048-ece6648fa4ae", + "serialNumber": "urn:uuid:eb17b246-15ae-4dd2-8c11-45e46c2248c6", "version": 1, "metadata": { - "timestamp": "2026-11-03T15:46:04Z", + "timestamp": "2026-11-05T18:16:02Z", "component": { "type": "container", "bom-ref": "collimo-image", "name": "collimo", - "version": "0.2.0", - "purl": "pkg:oci/collimo@0.2.0?repository_url=ghcr.io/collimohq/collimo&arch=arm64", + "version": "0.3.0", + "purl": "pkg:oci/collimo@0.3.0?repository_url=ghcr.io/collimohq/collimo&arch=arm64", "properties": [{"name": "base-image", "value": "scratch"}] } }, @@ -19,9 +19,9 @@ "type": "application", "bom-ref": "collimo", "name": "collimo", - "version": "0.2.0", + "version": "0.3.0", "description": "The Collimo collector, a static linux/arm64 binary", - "purl": "pkg:generic/collimohq/collimo@0.2.0?arch=arm64" + "purl": "pkg:generic/collimohq/collimo@0.3.0?arch=arm64" }, { "type": "library", diff --git a/stack.env.example b/stack.env.example index a2076cd..dc9ba23 100644 --- a/stack.env.example +++ b/stack.env.example @@ -2,7 +2,7 @@ # variable, this file's and the rest, from what the stack is running with. # Required: the release to run, such as 0.9.0, or qa for the build under test. -COLLIMO_VERSION=0.2.0 +COLLIMO_VERSION=0.3.0 # false watches only hypervisors and storage, with no UniFi console at all, # and is what to set while trying this stack beside an existing one.