gatus — estate service health

Tier-1 uptime/health status page (Gatus) at https://gatus.192.168.10.46.sslip.io. Config is managed in git (forgejo_admin/gatus).

Where it runs

Deployment gatus in namespace gatus (image pinned), config mounted from ConfigMap gatus-config, which is built from config/config.yaml in the repo (the single source of truth). Ingress gatus.192.168.10.46.sslip.io.

What it monitors (18 endpoints, grouped)

• identity: keycloak · secrets: infisical · cmdb: netbox · monitoring: librenms · core-network: dns1-resolver (DNS check)
• platform: forgejo, temporal, rancher
• observability: grafana, prometheus, alertmanager, backstage, qlever, qlever-ui
• pipeline: collector, mover, triplify, loader, forgejo-trigger

In-cluster targets use the service FQDN + health path (e.g. http://loader.pipelines.svc.cluster.local:8080/healthz); public services use their ingress (https://<svc>.192.168.10.46.sslip.io/..., client.insecure: true for the lab CA).

Add / change an endpoint

Edit config/config.yaml under endpoints:, commit, then redeploy:

  - name: <service>
    group: <group>
    url: "https://<service>.192.168.10.46.sslip.io/<health>"   # or in-cluster svc FQDN
    interval: 60s
    client: { insecure: true }             # lab-CA certs; use ignore-redirect for 3xx health
    conditions: ["[STATUS] == 200"]        # or [DNS_RCODE] == NOERROR for DNS

kubectl -n gatus create configmap gatus-config \
  --from-file=config.yaml=config/config.yaml --dry-run=client -o yaml | kubectl apply -f -
kubectl -n gatus rollout restart deploy/gatus

Notes

• A service must have a reachable HTTP/DNS/TCP health endpoint to be checked (Gatus doesn't do PromQL). Headless workloads need a Service first — e.g. the collector got a /healthz + Service so it could be added here.
• DaemonSets checked via a ClusterIP Service (e.g. mover-podlogs) are an "at least one up" check; per-node detail lives in Prometheus/Grafana.
• Gatus doesn't monitor itself (it can't report its own downtime) — that's expected.