From 8063db083bda57c64d4b976297047e158dea4f76 Mon Sep 17 00:00:00 2001 From: Garrett Allen <98648590+Gerrrt@users.noreply.github.com> Date: Mon, 31 Aug 2026 05:10:49 +0000 Subject: [PATCH] docs(roadmap): say what #91 still needs, now that the exporter exists MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The entry read "Add blackbox-exporter for uptime and TLS-expiry on internal services. Until it exists, expiry is something you find out about from a browser warning." The exporter has existed for a while: compose.yaml defines it, prometheus.yaml scrapes it and runs the blackbox job, and there are targets. But "add the exporter" was never the work. #91 named seven things to probe — Grafana, Prometheus, Alertmanager, Loki, the switch UI, the iLO, the pfSense UI — and none of them are probed. What is probed is the wiki, which the issue never mentioned; it was added later, after the wiki went unreachable and nothing noticed. So the entry was stale in the direction that flatters: it implied nothing had shipped, when what shipped was aimed elsewhere. The expiry half has nothing behind it. Both targets are plain HTTP, the TLS-capable http_2xx module is defined and referenced by nothing, and no rule under prometheus/rules/ reads probe_ssl_earliest_cert_expiry — grepped for ssl, cert, expiry and expir across all six rule files, no hits. Grafana is the only service in the estate terminating TLS and it is not a blackbox target, so there is not even a series to alert on. Nothing moves to Done. This file's own intro says whether a thing is started, blocked or done belongs on its issue, and that "two places holding the same checkbox is how a checkbox stops being true" — #91 is open, so a Done entry for half of it is the failure that warning describes. Co-Authored-By: Claude Opus 5 --- docs/roadmap.md | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/docs/roadmap.md b/docs/roadmap.md index 7546766..69dfabd 100644 --- a/docs/roadmap.md +++ b/docs/roadmap.md @@ -49,9 +49,16 @@ issues intact. Nothing was summarised away. - **[#90](https://github.com/Gerrrt/HomeLab/issues/90) Detect Suricata being dead.** A quiet IDS and a stopped one produce identical output, so no log rule can tell them apart. Needs a heartbeat the SNMP module does not expose. -- **[#91](https://github.com/Gerrrt/HomeLab/issues/91) Add blackbox-exporter** - for uptime and TLS-expiry on internal services. Until it exists, expiry is - something you find out about from a browser warning. +- **[#91](https://github.com/Gerrrt/HomeLab/issues/91) Probe the services this + was filed for, and probe TLS expiry.** blackbox-exporter is deployed and + scraped, but it probes one thing the issue never named — the wiki, added after + it went unreachable unnoticed — and none of the seven it did: Grafana, + Prometheus, Alertmanager, Loki, the switch UI, the iLO, the pfSense UI. The + expiry half has nothing behind it at all. Both targets are plain HTTP, the + TLS-capable `http_2xx` module is defined and used by nothing, and no rule reads + `probe_ssl_earliest_cert_expiry`. Grafana is the only service in the estate + terminating TLS and it is not probed, so expiry is still something you find out + about from a browser warning. - **[#114](https://github.com/Gerrrt/HomeLab/issues/114) Set memory limits on the six services.** Nothing in `compose.yaml` bounds a leak, so one container can take the host down — and the host has 8 GB soldered. It was blocked on