# Blackbox exporter

This component deploys the pinned Prometheus blackbox exporter as an internal
`ClusterIP` service in the `observability` namespace. The `/probe` handler is
reachable only from the Prometheus Pod; it has no Ingress, NodePort, host port,
or service-account token.

Only three fixed `Probe` groups are declared:

- `platform-public-edge`: Gitea health and Keycloak discovery through Host Nginx
- `platform-private-edge`: Grafana, pgAdmin, and AIStor Console must return 403
- `platform-private-internal`: the same private services must return 200 through
  their ClusterIP Services

The internal Grafana and pgAdmin targets use the blackbox exporter's `hostname`
parameter to set their required HTTP Host header. Target URLs and modules are
declarative; arbitrary callers are not granted access to port 9115.

The private-edge source boundary was proven separately and recorded as a
root-only `platform-blackbox-source-v1` evidence file. Applying this component
must remain gated on that evidence matching the active deny-only Nginx config.