feat(logging): fan out grafana-alloy to remaining hosts + delete promtail (step 2) #122
Labels
No labels
bug
enhancement
in-progress
needs-info
needs-triage
p0
ready-for-agent
ready-for-human
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
Cloonar/nixos#122
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Step 2 of #118 (promtail→alloy migration). Do after the nas canary (step 1) is verified in Grafana.
Agent Brief
Category: enhancement
Summary: Once the nas canary proves the alloy config, switch the remaining four hosts (fw, mail, web-arm, amzebs-01) from
utils/modules/promtailtoutils/modules/alloy, and delete the now-unused promtail module.Background / why: Completes the fleet migration started in step 1. The shared alloy module already exists and is verified on nas; the config is host-agnostic (it just reads the local journal), so the remaining hosts switch by swapping the import.
Tasks:
hosts/{fw,mail,web-arm,amzebs-01}/configuration.nix: replace the./utils/modules/promtailimport with./utils/modules/alloy.utils/modules/promtail(default.nix+secrets.yaml).utils/modules/promtail/...creation rule from.sops.yaml.Acceptance:
Note: fw and web-arm may still be on 25.11 with the temporary docker_29 pin — that's independent of this change. If their 26.05 bumps land first, even better. Part of #118.
Triage → ready-for-agent
Step-2 fan-out is unblocked; prerequisites verified:
main, so a shared-module change passes the pre-commit dry-build on fw/web-arm.alloy-envsecret already decrypts on all four targets..sops.yaml'sutils/modules/alloyrule mirrors promtail's recipient set exactly (web-arm, ldap-server-arm = mail, fw, nas, amzebs-01) — no secret rewiring needed.services.alloyis present on 25.11. All four targets (fw, mail, web-arm, amzebs-01) are still on 25.11, but the module exists there, so the swap holds now and survives each host's later 26.05 bump.afk/122claim — free to pick up.Verify nuance (not caught by eval/build)
The four targets run grafana-alloy 1.12.2 (25.11); the nas canary proved 1.16.0 (26.05).
config.alloyuses only GA-stable components (loki.source.journal,loki.processstages,loki.write,discovery.relabel,sys.env), so the version gap is low-risk — butconfig.alloyis shipped as a staticenvironment.etcfile, so neither the pre-commit eval nor the build parses it. Post-deploy verification must include at least one 25.11 host (e.g. mail or amzebs-01) in Grafana/Loki, not lean on the nas/1.16.0 precedent alone. Each host re-verifies alloy again at its 26.05 bump (#106/#108/#110/#112).Reminder from the brief
When deleting
utils/modules/promtail(default.nix + secrets.yaml), also remove its now-orphan creation rule from.sops.yaml(theutils/modules/promtail/...block) — keep theutils/modules/alloyrule.