unkinben
084e454954
Why: the logging aggregator wrote every event through the generic catch-all shape. The Tier-1 survey (session 15) picked six high-value log sources that warrant structured parsing into logs.raw columns/fields for real querying. How: - Two-stage routing in aggregator.yaml: app_route peels off the six Tier-1 streams by subject / VM source tag (mutually exclusive, no double-insert), everything else falls through app_route._unmatched to the unchanged generic k8s/vm shape catch-all. - Six parse transforms emit the full logs.raw shape plus structured .fields (Map(String,String), no DDL change): authentik (JSON), traefik (JSON access), vault audit (JSON), nginx access+error (regex), haproxy httplog (regex), glauth (JSON). - Flip traefik-system access logs to format: json (companion change) so traefik_parse has structured input. - 15 new vector test cases (routing + field extraction) in aggregator-tests.yaml. VM apps (vault-file/nginx/haproxy/glauth) light up when the puppet-side vector rollout ships logs.vm.* with .file / .SYSLOG_IDENTIFIER tags per the documented convention. authentik and traefik are live now. Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
argocd-apps docs
Operational notes for the manifests in this repo.
| Doc | What it covers |
|---|---|
| cnpg-backups.md | How CNPG Postgres backups (WAL archiving + nightly base backups) to Ceph RGW are configured. |
| cnpg-restore.md | Restoring a CNPG cluster: full recovery, point-in-time recovery, cutover, and gotchas. |
| authentik-rancher-sso.md | Manual runtime step to point Rancher's OIDC auth at the canonical identity.unkin.net issuer and trust the internal CA. |
| gitea-migration.md | Staged cutover of the git.unkin.net forge from the Puppet VM to the gitea namespace. |