GNU Taler monitoring

25.1. GNU Taler monitoring#

Sentol is the central monitoring server for host metrics, journals and service health. The Ansible setup and operational documentation live in the monitoring/ directory of tsys-infra.git, starting with monitoring/README.md. Refer there for deployment, configuration, client enrollment and maintenance.

25.1.1. Architecture#

The stack runs as native systemd services on Sentol and the monitored hosts:

  • Metrics: Prometheus scrapes Node Exporter and Fluent Bit metrics through each host’s nginx proxy using mutually authenticated TLS (mTLS).

  • Logs: Fluent Bit forwards system journals through Sentol’s mTLS nginx receiver to VictoriaLogs. The receiver derives the host identity from the client certificate.

  • Service checks: Blackbox Exporter probes HTTP(S) availability and TLS certificates; JSON Exporter reads build and protocol versions from service /config endpoints.

  • Dashboards and alerts: Perses displays Prometheus metrics. Prometheus evaluates alert rules and sends alerts to Alertmanager for email delivery.

        ---
config:
  layout: elk

---
flowchart TB
    subgraph host["Monitored host"]
        proxy["nginx metrics proxy"]
        node["Node Exporter"]
        journal["System journal"]
        fluent["Fluent Bit"]
        proxy --> node
        proxy -->|"collector metrics"| fluent
        journal --> fluent
    end
    subgraph sentol["Sentol"]
        prom["Prometheus"]
        ingest["nginx log receiver"]
        logs["VictoriaLogs"]
        probes["Blackbox and JSON exporters"]
        perses["Perses"]
        alert["Alertmanager"]
        web["nginx web access"]
        prom -->|"scrape"| probes
        perses -->|"query"| prom
        prom -->|"alerts"| alert
        ingest --> logs
        web --> perses
        web --> prom
        web --> alert
        web --> logs
    end
    prom -->|"pull / mTLS"| proxy
    fluent -->|"push / mTLS"| ingest
    probes -->|"HTTP(S) and /config"| endpoints["Public services"]
    browser["Operator browser"] -->|"HTTPS / password"| web
    alert --> smtp["SMTP relay"]
    kuma["Uptime Kuma"] -->|"independent checks"| endpoints

Monitoring architecture; arrows show requests or log and alert delivery.#

Sentol also monitors itself. Collector and server backends listen on loopback; nginx exposes the authenticated interfaces. One private monitoring CA secures metrics and log transport. Metrics and logs are stored centrally on Sentol.

Hosts are either managed directly by tsys-infra.git or enrolled as external clients. ansible-taler-exchange uses the latter model: it configures exchange hosts from bundles exported by Sentol.

Uptime Kuma provides independent availability monitoring, including exchange key and fee checks. Its checks and notifications are configured separately from Sentol.

25.1.2. Web interfaces#

The interfaces share password authentication over HTTPS. Public Perses access is read-only.