Project

General

Profile

Actions
Copy link

Support #430

open

OAM: Wire UNPoller metrics to Prometheus/Grafana (Cloudron)

Support #430: OAM: Wire UNPoller metrics to Prometheus/Grafana (Cloudron)

Added by Charles N about 19 hours ago. Updated about 3 hours ago.

Status:
New
Priority:
Normal
Assignee:
-
Target version:
Phase 4: Monitoring & Instrumentation
Start date:
08/12/2026
Due date:
% Done:

100%

Estimated time:

Description

Parent: #314

UNPoller is running on tsys-librenms (port 8084) and successfully polling the UniFi controller. Prometheus metrics are exported at http://tsys-librenms.knel.net:8084/metrics. Need to wire these into the Prometheus/Grafana stack hosted on Cloudron.

Scope

  • Configure Prometheus (Cloudron) to scrape UNPoller metrics endpoint
  • Build Grafana dashboard for UniFi infrastructure (UAPs, switches, clients)
  • Set up Grafana alerting for UniFi device offline / health issues
  • Document Prometheus/Grafana API credentials in ~/.creds/

Dependencies

  • Prometheus/Grafana API access (user to provide credentials)
  • UNPoller fully operational (DONE — confirmed polling UniFi v10.2.105)

Related

  • #337 (LibreNMS integration modules — UNPoller deployment)
  • #338 (alert transports — Pushover for Grafana alerts)

Updated by Charles N about 18 hours ago Actions
Copy link
 #1

[#430] ARCHITECTURE POLICY CAPTURED — user set two non-negotiable rules for inter-app connectivity (documented on Discourse #303):

  1. All inter-app connectivity via public DNS (no internal Docker network, no IP allowlists, zero trust target, API gateway coming)
  2. OIDC+2FA mandatory for interactive login; API keys (preferred) or tightly-scoped local un/pw accounts for service auth

CURRENT BLOCKER: Grafana→Prometheus datasource hits Cloudron OIDC proxy. Returns HTML login page instead of JSON. Need service auth method that satisfies the proxy without interactive OIDC.

Per the new rules, acceptable solutions:

  • Cloudron API token as Bearer auth in Grafana datasource
  • Local Prometheus account (basic auth, tightly scoped)
  • API gateway (future — not available yet)

Updated by Charles N about 17 hours ago Actions
Copy link
 #2

  • % Done changed from 0 to 100

[#430] COMPLETE — UNPoller → Prometheus → Grafana pipeline fully wired.

Data Flow (validated end-to-end):

  1. UNPoller (tsys-librenms:8084) → exporting: 2 UAPs, 118 metrics/30s ✓
  2. Prometheus (Cloudron) → scraping UNPoller (target UP) ✓
  3. Grafana (Cloudron) → querying Prometheus via basic auth (app password) ✓
  4. Dashboards imported into UniFi Poller folder ✓

Grafana dashboards:

  • Network Sites: /d/9WaGWZaZk/
  • UAP Insights: /d/g5wFWqxZk/
  • Client Insights: /d/jMfvAjxWz/

Components configured:

  • Prometheus scrape_configs: unpoller job, 30s interval, target tsys-librenms.knel.net:8084
  • Grafana datasource: Prometheus (uid efuwz003gunswc), basic auth via Cloudron app password
  • Grafana folder: UniFi Poller (uid efux1xefnaozke)

Architecture decisions captured:

  • Zero trust rules (public DNS, OIDC+2FA mandatory, API keys for service auth) → Discourse #303
  • Cloudron app password used for Grafana→Prometheus auth (proxy-compatible, no OIDC redirect)

Updated by Charles N about 17 hours ago Actions
Copy link
 #3

  • % Done changed from 100 to 80

[#430] REOPENED — dashboards imported but rendering blank. User UAT caught it (Client Insights dashboard has no data).

Rolling back done-ratio to 80%. Investigating.

Updated by Charles N about 16 hours ago Actions
Copy link
 #4

  • % Done changed from 80 to 100

[#430] UAT COMPLETE — user signed off.

Issue: unpoller user needed site administrator role to pull client data. After role change + UNPoller restart, client metrics flowing (288 exported, 240 in Prometheus).

Final state:

  • UNPoller → Prometheus → Grafana pipeline fully operational
  • 3 dashboards live with real data: Network Sites, UAP Insights, Client Insights
  • Client data confirmed: devices visible across TheNerdery + TheNerdery-5g SSIDs
  • Debug logging enabled (will disable in future cleanup)

Zero trust auth: Cloudron App Password for Grafana→Prometheus basic auth.

Updated by Charles N about 3 hours ago Actions
Copy link
 #5

  • Tracker changed from Bug to Support

Updated by Charles N about 3 hours ago Actions
Copy link
 #6

[#430] Parent umbrella: #314 (OAM Alerts and delivery thereof).

Updated by Charles N about 3 hours ago Actions
Copy link
 #7

  • Target version set to Phase 4: Monitoring & Instrumentation
Actions
Copy link

Also available in: PDF Atom