# kube-prometheus-stack — cluster Funk
# Ressources limitées pour compute-02/03 (8 GB RAM)

grafana:
  initChownData:
    enabled: false
  grafana.ini:
    database:
      type: postgres
      host: 192.168.10.1:5432
      name: grafana
      user: grafana
  envFromSecrets:
    - name: grafana-db-secret
  ingress:
    enabled: true
    ingressClassName: traefik
    hosts:
      - grafana.lab.local
  adminPassword: "funk-grafana"
  resources:
    requests:
      cpu: 100m
      memory: 256Mi
    limits:
      memory: 1Gi
  persistence:
    enabled: true
    storageClassName: nfs
    size: 2Gi

prometheus:
  ingress:
    enabled: true
    ingressClassName: traefik
    hosts:
      - prometheus.lab.local
    paths:
      - /
    pathType: Prefix

  prometheusSpec:
    retention: 15d
    retentionSize: "8GB"
    resources:
      requests:
        cpu: 200m
        memory: 512Mi
      limits:
        memory: 1Gi
    storageSpec:
      volumeClaimTemplate:
        spec:
          storageClassName: nfs
          accessModes: ["ReadWriteOnce"]
          resources:
            requests:
              storage: 20Gi

    # Scrape des nœuds hors cluster (storage-01, gpu-01)
    additionalScrapeConfigs:
      - job_name: storage-01
        static_configs:
          - targets: ['192.168.10.1:9100']
            labels:
              instance: storage-01
              role: gateway

      - job_name: gpu-01-node
        static_configs:
          - targets: ['192.168.10.20:9100']
            labels:
              instance: gpu-01
              role: gpu

      - job_name: llama-server-gpu
        static_configs:
          - targets: ['192.168.10.20:1234']
            labels:
              instance: gpu-01
              model: qwen3-8b
              type: gpu

      # --- Sondes réseau actives (blackbox_exporter) ---
      # Le relabeling envoie la cible réelle en ?target=… et fait pointer le
      # scrape vers le service blackbox. Cf. admin/infra/reseau.md.
      - job_name: blackbox-icmp
        metrics_path: /probe
        params:
          module: [icmp]
        static_configs:
          - targets:
              - 192.168.10.1     # storage-01 — passerelle / NAT / DNS
              - 192.168.10.11    # compute-01 (control-plane)
              - 192.168.10.12    # compute-02
              - 192.168.10.13    # compute-03
              - 192.168.10.20    # gpu-01
            labels:
              scope: lan
          - targets:
              - 1.1.1.1          # Cloudflare — joignabilité internet
              - 9.9.9.9          # Quad9 — joignabilité internet
            labels:
              scope: internet
        relabel_configs:
          - source_labels: [__address__]
            target_label: __param_target
          - source_labels: [__param_target]
            target_label: instance
          - target_label: __address__
            replacement: blackbox-exporter.monitoring.svc.cluster.local:9115

      - job_name: blackbox-http
        metrics_path: /probe
        params:
          module: [http_2xx]
        static_configs:
          - targets:
              - http://grafana.lab.local
              - http://prometheus.lab.local
              - http://alertmanager.lab.local
              - http://argocd.lab.local
              - http://openwebui.lab.local
              - http://n8n.lab.local
              - http://ghostfolio.lab.local
              - http://searxng.lab.local
              - http://stt.lab.local
            labels:
              scope: ingress
        relabel_configs:
          - source_labels: [__address__]
            target_label: __param_target
          - source_labels: [__param_target]
            target_label: instance
          - target_label: __address__
            replacement: blackbox-exporter.monitoring.svc.cluster.local:9115

      # DNS : module choisi par cible (label module → __param_module), serveur
      # interrogé = dnsmasq (192.168.10.1:53). dns_lab teste le wildcard
      # *.lab.local, dns_external teste le forwarding vers l'upstream.
      - job_name: blackbox-dns
        metrics_path: /probe
        static_configs:
          - targets: ['192.168.10.1:53']
            labels:
              module: dns_lab
              instance: 'dnsmasq:grafana.lab.local'
          - targets: ['192.168.10.1:53']
            labels:
              module: dns_external
              instance: 'dnsmasq:one.one.one.one'
        relabel_configs:
          - source_labels: [module]
            target_label: __param_module
          - source_labels: [__address__]
            target_label: __param_target
          - target_label: __address__
            replacement: blackbox-exporter.monitoring.svc.cluster.local:9115

alertmanager:
  ingress:
    enabled: true
    ingressClassName: traefik
    hosts:
      - alertmanager.lab.local
    paths:
      - /
    pathType: Prefix

  alertmanagerSpec:
    resources:
      requests:
        cpu: 50m
        memory: 64Mi
      limits:
        memory: 128Mi
  config:
    global:
      resolve_timeout: 5m
    route:
      group_by: ['alertname', 'instance']
      group_wait: 30s
      group_interval: 5m
      repeat_interval: 4h
      receiver: hermes-monitor
      routes:
        # Watchdog (heartbeat interne kube-prometheus-stack) — silencé
        - matchers:
            - alertname = "Watchdog"
          receiver: "null"
          repeat_interval: 24h
    receivers:
      - name: "null"
      - name: hermes-monitor
        webhook_configs:
          - url: 'http://192.168.10.1:9093/webhook'
            send_resolved: true
          - url: 'http://n8n.lab.local/webhook/alerts'
            send_resolved: true

prometheusOperator:
  resources:
    requests:
      cpu: 100m
      memory: 128Mi
    limits:
      memory: 256Mi

kube-state-metrics:
  resources:
    requests:
      cpu: 50m
      memory: 64Mi
    limits:
      memory: 128Mi

nodeExporter:
  resources:
    requests:
      cpu: 50m
      memory: 32Mi
    limits:
      memory: 64Mi

prometheus-node-exporter:
  extraArgs:
    - --collector.rapl

# Désactiver etcd/scheduler monitoring (Talos — non accessible)
kubeEtcd:
  enabled: false
kubeScheduler:
  enabled: false
kubeControllerManager:
  enabled: false
kubeProxy:
  enabled: false