Add platform infrastructure configuration

2026-08-28 17:35:41 +09:00
parent fa76531e5b
commit 16c337bcc9
302 changed files with 83259 additions and 1 deletions
@@ -0,0 +1,22 @@
+# Blackbox exporter
+
+This component deploys the pinned Prometheus blackbox exporter as an internal
+`ClusterIP` service in the `observability` namespace. The `/probe` handler is
+reachable only from the Prometheus Pod; it has no Ingress, NodePort, host port,
+or service-account token.
+
+Only three fixed `Probe` groups are declared:
+
+- `platform-public-edge`: Gitea health and Keycloak discovery through Host Nginx
+- `platform-private-edge`: Grafana, pgAdmin, and AIStor Console must return 403
+- `platform-private-internal`: the same private services must return 200 through
+  their ClusterIP Services
+
+The internal Grafana and pgAdmin targets use the blackbox exporter's `hostname`
+parameter to set their required HTTP Host header. Target URLs and modules are
+declarative; arbitrary callers are not granted access to port 9115.
+
+The private-edge source boundary was proven separately and recorded as a
+root-only `platform-blackbox-source-v1` evidence file. Applying this component
+must remain gated on that evidence matching the active deny-only Nginx config.
+