# Observability

The server edition ships a pre-configured, **local-only** observability stack —
the same setup Arcline IT runs in production. It never talks to any external
service.

```
 node_exporter ──► Prometheus ──► Grafana (localhost:3000)
                     │  ▲
   journald ─────► promtail ──► Loki (localhost:3100)
```

| Component | Port | Role | Config source |
|-----------|------|------|---------------|
| node_exporter | `9100` | host metrics | Debian package (enabled by default) |
| Prometheus | `9090` | metric storage + alerting | `overlays/server/etc/prometheus/` |
| Grafana | `3000` | dashboards (auto-provisioned) | `overlays/server/etc/grafana/` |
| Loki | `3100` | log storage (14d retention) | `overlays/server/etc/loki/` |
| promtail | `9080` | ships journald + /var/log → Loki | `overlays/server/etc/promtail/` |

## What is pre-configured

- **Prometheus** scrapes itself + `node_exporter` and loads alerting rules
  (`arcline.rules.yml`): NodeDown, high load, disk > 85% / critical > 95%,
  service crash-looping.
- **Grafana** auto-provisions the Prometheus/Loki datasources and a starting
  Node Overview dashboard (`node-overview.json`) on first start.
- **Loki** is single-node filesystem storage with a 14-day retention, matching
  the journald retention.
- **promtail** ships the systemd journal and `/var/log` to the *local* Loki.

## Packaging note

Prometheus + node_exporter + alertmanager are in Debian main and install with
the edition packages. **Grafana** and **Loki** are not:

- Grafana is available via the official `apt.grafana.com` repo — add it by
  setting `ARCLINE_EXTRA_REPOS=1` during the build
  (`configure-system.sh` adds the repo + key).
- Loki ships as a static binary tarball; the packaging (a `.deb` in
  `toolchain/`) is follow-up work.

Until then, the Grafana/Loki configs ship dormant in the image, ready for when
the binaries are installed — the `overlays/server` configs are the contract.

## Access

- Grafana UI: `http://<host>:3000` (default admin credentials are set at
  first boot by the installer — never left at Grafana's defaults).
- Prometheus: `http://<host>:9090`.

Both are **not** exposed by the default-deny firewall; open ports deliberately
or access via ssh tunnel.