v0.7.0 — Observability

Seventh release of the infra repository: Observability - metrics, dashboards, alerting, and external availability monitoring.

Added

• docker/monitoring-agent/ - Node Exporter (host metrics) + cAdvisor (per-container metrics), deployed identically on every host role. Both bind to 127.0.0.1 only by default (neither has any authentication) - cross-host Prometheus scraping is a documented, source-IP-scoped manual opt-in, not scripted
• docker/observability/ - Prometheus, Alertmanager, Grafana, Uptime Kuma on the management host. Prometheus/Alertmanager stay internal-only (no meaningful auth of their own); Grafana/Uptime Kuma get a public URL through the new management proxy
• Prometheus joins monitoring_agent_net to scrape node-exporter/cadvisor by container name - their 127.0.0.1-published ports aren't reachable from inside another container, so same-host scraping goes over a shared Docker network instead
• Three default alert rules (host down, disk >85%, container missing) with a no-op Alertmanager receiver - wiring a real notification channel needs deployment-specific credentials that don't belong in this repo
• Grafana's Prometheus datasource is provisioned as code; dashboards are a documented two-click import (Node Exporter Full, cAdvisor) rather than vendored JSON
• docker/management-proxy/ - TLS termination and name-based vhost routing (jenkins.<domain>, grafana.<domain>, uptime.<domain>) for every public UI on the management host, replacing the single-vhost jenkins/nginx.conf. Domain names are injected via the official nginx image's envsubst templating, not hardcoded

Changed

• jenkins/docker-compose.yml: the nginx service moved out to docker/management-proxy/ - jenkins/ is Jenkins-only again, still not published on a host port itself
• scripts/harden-host.sh: role_ports() documents why the exporter ports are deliberately not in the default UFW allowlist

Notes

• None of this has been run against a live host yet - the AWS management host was still being provisioned while this was written, so the nginx-to-management-proxy migration had no live traffic to move

What's next

v0.8.0 - Platform Integration (multi-target deployment guidance for AWS/Google Cloud/Oracle Cloud/Homelab, documentation and examples only - infrastructure code stays cloud-agnostic).

Full changelog: CHANGELOG.md