sovereign-ai-cookbook/recipes/renacer-observability.yaml at main · paiml/sovereign-ai-cookbook · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
# Recipe: renacer-observability — Syscall tracing + OTLP + Grafana stack
#
# Deploys a complete observability stack for forjar infrastructure:
#   1. renacer syscall tracer (package resource)
#   2. Jaeger all-in-one for distributed tracing (docker resource)
#   3. Grafana with Tempo datasource (docker resource)
#   4. Grafana provisioning config (file resource)
#   5. Firewall rules for all ports (network resources)
#
# Inputs:
#   otlp_endpoint (string) — OTLP gRPC endpoint for trace export
#   grafana_port (int, default: 3000) — Grafana web UI port
#   jaeger_port (int, default: 16686) — Jaeger web UI port
#   retention_days (int, default: 7) — trace retention period
#   user (string, default: renacer) — service account

recipe:
  name: renacer-observability
  version: "1.0"
  description: "Renacer observability stack — syscall tracing, Jaeger, Grafana"
  inputs:
    otlp_endpoint:
      type: string
      description: "OTLP gRPC endpoint (e.g., http://localhost:4317)"
      default: "http://localhost:4317"
    grafana_port:
      type: int
      default: 3000
      min: 1
      max: 65535
    jaeger_port:
      type: int
      default: 16686
      min: 1
      max: 65535
    retention_days:
      type: int
      default: 7
      min: 1
      max: 365
    user:
      type: string
      default: renacer

resources:
  obs-user:
    type: user
    name: "{{inputs.user}}"
    shell: /usr/sbin/nologin
    home: /opt/renacer
    system_user: true
    depends_on: []
    tags: [setup, users]

  obs-data-dir:
    type: file
    state: directory
    path: /opt/renacer
    owner: "{{inputs.user}}"
    mode: "0755"
    depends_on: [obs-user]
    tags: [setup, dirs]

  obs-grafana-data:
    type: file
    state: directory
    path: /opt/renacer/grafana
    owner: "472"
    group: "472"
    mode: "0755"
    depends_on: [obs-data-dir]
    tags: [setup, dirs]

  renacer-pkg:
    type: package
    provider: cargo
    packages: [renacer]
    depends_on: []
    tags: [packages]

  jaeger:
    type: docker
    name: forjar-jaeger
    image: jaegertracing/all-in-one:1.54
    state: running
    ports:
      - "{{inputs.jaeger_port}}:16686"
      - "4317:4317"
      - "4318:4318"
    environment:
      - "COLLECTOR_OTLP_ENABLED=true"
      - "SPAN_STORAGE_TYPE=badger"
      - "BADGER_EPHEMERAL=false"
      - "BADGER_DIRECTORY_VALUE=/badger/data"
      - "BADGER_DIRECTORY_KEY=/badger/key"
    volumes:
      - "/opt/renacer/jaeger:/badger"
    restart: unless-stopped
    depends_on: [obs-data-dir]
    tags: [services, docker]

  grafana-provisioning:
    type: file
    path: /opt/renacer/grafana/provisioning/datasources/tempo.yaml
    content: |
      apiVersion: 1
      datasources:
        - name: Jaeger
          type: jaeger
          access: proxy
          url: http://forjar-jaeger:16686
          isDefault: true
          editable: false
    owner: "472"
    mode: "0644"
    depends_on: [obs-grafana-data]
    tags: [config]

  grafana:
    type: docker
    name: forjar-grafana
    image: grafana/grafana:10.3.1
    state: running
    ports:
      - "{{inputs.grafana_port}}:3000"
    environment:
      - "GF_SECURITY_ADMIN_PASSWORD=forjar"
      - "GF_USERS_ALLOW_SIGN_UP=false"
    volumes:
      - "/opt/renacer/grafana:/var/lib/grafana"
      - "/opt/renacer/grafana/provisioning:/etc/grafana/provisioning"
    restart: unless-stopped
    depends_on: [grafana-provisioning, jaeger]
    tags: [services, docker]

  firewall-grafana:
    type: network
    port: "{{inputs.grafana_port}}"
    protocol: tcp
    action: allow
    depends_on: [grafana]
    tags: [network, firewall]

  firewall-jaeger:
    type: network
    port: "{{inputs.jaeger_port}}"
    protocol: tcp
    action: allow
    depends_on: [jaeger]
    tags: [network, firewall]

  firewall-otlp:
    type: network
    port: "4317"
    protocol: tcp
    action: allow
    depends_on: [jaeger]
    tags: [network, firewall]