mohsen_hassani/LedgerLine
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Document deploy.sh and where the observability platform lives

Browse Source 
phase-1: deploy via deploy.sh, correct the container count, and note
that stripped host ports leave no path for the Phase 5 scrape.
phase-2: explain why Grafana is not on the Ledgerline server and why
Cloudflare's proxy never forwards :3000 or the other platform ports.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Movses Aslanyan
2026-10-12 11:01:49 +03:30
co-authored by Claude Opus 5.5
parent 79a41bf869
commit 34a11da848
2 changed files with 34 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/roadmap/phase-2.md
+19
View File
@@ -63,6 +63,25 @@ than abstract.
`ansible-playbook playbooks/grafana-stack.yml`. Verify every endpoint from the
README's table answers: Grafana 3000, Prometheus 9090, Alertmanager 9093,
Loki 3100, Tempo 3200, Alloy UI 12345, OTLP 4317/4318.
**Where the platform lives — not on the Ledgerline server.** Grafana (3000)
and the rest come from the Ansible stack, not from Ledgerline's compose
files, so `ledgerline.vione.cloud:3000` will never show Grafana. Three
reasons it belongs on its own host:
- `czy` has 1 GB RAM and Ledgerline already fills it; the platform README
recommends 2 vCPU / 4 GB for the Grafana stack.
- Phase 1's rule is that only 22/80/443 are open on `czy`; the platform
publishes seven more ports.
- `ledgerline.vione.cloud` is behind Cloudflare's proxy, which only forwards
ports 80, 8080, 8880, 2052, 2082, 2086, 2095 (HTTP) and 443, 2053, 2083,
2087, 2096, 8443 (HTTPS). Port 3000 (and 3100, 3200, 4318, 9090, 12345)
never reaches the origin through a proxied hostname.
So reach the platform by the obs host's IP, an SSH tunnel, or a separate
**DNS-only** (grey-cloud) record. The platform's ports are published on all
interfaces with little or no auth — firewall them to your own IP plus
`czy`'s IP (which needs 4318 for OTLP). `<obs-host>` below means that host,
reached from `czy` over the internet.
Then open the Alloy UI and **read the component graph** — it shows you the exact
pipeline, including the fact that the OTLP receiver has only a traces output.
Seeing that in the UI before you get bitten by it is worth ten minutes.