From 9bc97f196f153b7aa35e157421dbee59a90e3320 Mon Sep 17 00:00:00 2001 From: Vladimir Eremin Date: Sat, 11 Jul 2026 22:37:38 +0300 Subject: [PATCH] feat: scrape CrowdSec agent metrics through Alloy Add a prometheus.scrape for the CrowdSec agent's :6060 endpoint, forwarded to the existing remote_write. CrowdSec runs on the host, so nodes that run it bind the metrics endpoint on 0.0.0.0 (host firewall keeps it off the public interface) and Alloy reaches it via the docker gateway; nodes without CrowdSec report the target down. node/instance labels are stamped APEX_NODE_HOST like the other exporters. --- assets/alloy/config.alloy | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/assets/alloy/config.alloy b/assets/alloy/config.alloy index bbd0dde..56eb15c 100644 --- a/assets/alloy/config.alloy +++ b/assets/alloy/config.alloy @@ -68,6 +68,21 @@ prometheus.scrape "containers" { scrape_interval = "15s" } +// CrowdSec agent metrics. CrowdSec runs on the host (not a container) and exposes Prometheus +// metrics on :6060; nodes that run it bind that endpoint on 0.0.0.0 (the host firewall keeps it +// off the public interface) so Alloy can reach it via the docker gateway. Nodes that don't run +// CrowdSec simply report this target down. +prometheus.scrape "crowdsec" { + targets = [{ + __address__ = "host.docker.internal:6060", + instance = sys.env("APEX_NODE_HOST"), + node = sys.env("APEX_NODE_HOST"), + job = "crowdsec", + }] + forward_to = [prometheus.remote_write.default.receiver] + scrape_interval = "30s" +} + // Push metrics to the central Prometheus (needs --web.enable-remote-write-receiver). prometheus.remote_write "default" { endpoint {