Repository navigation
feat(zeta): alert if spore's tailnet-only ports reach the internet - #749
Merged
Merged
Conversation
Gatus probes each port spore's own services listen on through its public address every 5 minutes and alerts if one accepts a connection. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds an
exposuregroup to Gatus on zeta: one TCP endpoint per port that spore's own services listen on but that should only be reachable over the tailnet (node-exporter 9100, nginx-exporter 9113, alloy 12345, glances 61208, homepage 8082, pocket-id 1411, oauth2-proxy 4180). Each check connects tozx.dev(spore's public A record) every 5 minutes, expects[CONNECTED] == false, and alerts in #alerts after the usual 3 failures.zeta reaches spore's public address over the internet rather than the tailnet, so these connections go through spore's firewall like any outside client's. The daily port scan (#748) covers all ports; these catch a regression on the most likely ones within about 15 minutes. alloy is the most realistic case, since it already binds
0.0.0.0:12345.Checked in Gatus 5.37.0's source: TCP endpoints only set
Connectedand record no error on a failed connect, so a dropped or refused port evaluates cleanly tofalse. A dropped port takes the client timeout (10s) per check, which is fine at a 5-minute interval.The diff looks large because alejandra re-indented
endpointsaround the new++;git diff -wshows the real change, about 30 lines.To verify:
exposuregroup on status.zx.dev shows all seven as healthy🤖 Generated with Claude Code