jhodgkin
7df08cd16d
Extends monitoring to the two bare-metal boxes Proxmox can't see. Uses a dedicated ed25519 key with a forced authorized_keys command (see docs/ssh-collector-key-setup.md) so a leaked key can only ever run the fixed read-only stats script, never arbitrary commands. CPU is approximated from 1-min load average / core count (a true utilization % would need two /proc/stat samples). Closes #8. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
31 lines
1.1 KiB
Bash
31 lines
1.1 KiB
Bash
# Copy to .env and fill in. Never commit the real .env (see .gitignore).
|
|
|
|
# Proxmox API token — see docs in the "Provision read-only Proxmox API token" issue
|
|
# for how this was created (dedicated monitor@pve user, PVEAuditor role).
|
|
PROXMOX_TOKEN_ID=monitor@pve!dashboard
|
|
PROXMOX_TOKEN_SECRET=
|
|
|
|
# Session cookie signing key — generate with: openssl rand -hex 32
|
|
SESSION_SECRET=
|
|
|
|
# Seeded on first boot only; change the password after first login isn't
|
|
# implemented yet (see backlog), so pick a real one now.
|
|
ADMIN_USERNAME=admin
|
|
ADMIN_PASSWORD=
|
|
|
|
# local | oidc (oidc not implemented yet, see issue #12)
|
|
AUTH_MODE=local
|
|
|
|
# Set to true only once a TLS-terminating reverse proxy sits in front (see
|
|
# issue #13). Leave false for plain-HTTP LAN access, otherwise the session
|
|
# cookie won't be set at all.
|
|
COOKIE_SECURE=false
|
|
|
|
PORT=3000
|
|
POLL_INTERVAL_SECONDS=30
|
|
SNAPSHOT_RETENTION_HOURS=24
|
|
|
|
# Dedicated key for SshHostCollector (omv, ripper) — see docs/ssh-collector-key-setup.md.
|
|
# In docker-compose this is mounted from ./ssh/monitor_ed25519 (gitignored, not this path).
|
|
SSH_PRIVATE_KEY_PATH=./ssh/monitor_ed25519
|