homelab-codex-ws/services/fleet-prometheus/prometheus.yml

# fleet-prometheus — fleet liveness source of truth.
#
# Deliberately SEPARATE from the home `prom` on PIHA (LAN-only). The `fleet`
# external label and the `fleet-` job naming make it unambiguous in every
# scraped series that this instance monitors the distributed fleet, not the
# home LAN. This file is SECRET-FREE by contract — never inline tokens here
# (the home prom embedding a plaintext HAOS token is the anti-pattern we avoid).

global:
  scrape_interval: 15s
  external_labels:
    fleet: "homelab-codex"

# alerting:
#   # Alertmanager wiring is added in a separate step (fleet liveness alerting).
#   alertmanagers: []

# Liveness rules. Path is relative to /etc/prometheus/ → /etc/prometheus/rules/*.yml,
# consistent with the ./rules:/etc/prometheus/rules:ro mount in docker-compose.yml.
rule_files:
  - "rules/*.yml"

scrape_configs:
  # Self-monitoring — Prometheus scrapes its own /metrics. Bridged container
  # listens on 0.0.0.0:9090, so localhost resolves inside the container.
  - job_name: "prometheus"
    static_configs:
      - targets: ["localhost:9090"]

  # Fleet node_exporters. One job, one static_configs entry per node, each
  # carrying exactly one label: node:<name>. No availability/schedule/tier
  # labels by design — "when to alert" (e.g. lustro/solaria are planned-off at
  # times) is decided LATER by the brain from metric history (anomaly
  # detection), never by static labels or time-based rules. Today's only goal
  # is collecting metrics.
  - job_name: "fleet-node"
    static_configs:
      # VPS-local node_exporter: network_mode: host on the host's :9100,
      # reached via the host-gateway alias declared in docker-compose.yml.
      - targets: ["host.docker.internal:9100"]
        labels:
          node: "vps"
      # Tailscale fleet targets — confirmed reachable from VPS (wget, 2026-06-26).
      - targets: ["100.108.208.3:9100"]
        labels:
          node: "piha"
      - targets: ["100.100.231.104:9100"]
        labels:
          node: "solaria"
      - targets: ["100.99.85.73:9100"]
        labels:
          node: "lustro"

  # Deliberately NOT scraped (visible decision, not an oversight):
  #   - saturn (100.121.168.72): laptop/workstation, not infra; often powered
  #     off → omitted.
  #   - chelsty (100.122.201.22) + chelsty-infra (100.98.91.98): node_exporter
  #     DOWN from VPS (LTE edge), 2026-06-26 — to be investigated separately
  #     (exporter not deployed vs ACL block). Not listed as dead targets, which
  #     would pollute future liveness signals.