Repository navigation
chore: drop the Grafana Cloud and npm credentials - #225
Merged
Merged
Conversation
All three have lost their purpose, so the values go rather than get rotated. Claude Code telemetry now goes to obs-01 instead of Grafana Cloud: metrics to the five-year Prometheus, events to Loki, over http on VLAN 1 or inside WireGuard from outside. Neither receiver authenticates anyone, so the two Grafana tokens have nothing left to authenticate — grafana_api_token signed the OTLP gateway header, grafana_sa_token pushed a dashboard that now lives in the homelab-k8s repo as a ConfigMap and arrives by ArgoCD. The just recipe and the dashboard JSON go with them. npm_token was already dead: npm answers E401 with it, and its 1Password item is deleted, so onepasswordRead would fail the whole config render. The npmrc auth block goes too — nothing renders it any more. Traces are OTEL_TRACES_EXPORTER=none, not unset. Unset is not off: the SDK keeps batching spans and posting them at whatever endpoint it can infer, failing on every export in a way that looks configured and silently is not. obs-01 has no trace store, and adding Tempo for a signal nothing asks a question of is not worth a service and a volume. OTEL_METRICS_INCLUDE_SESSION_ID flips to false. The default is true and Claude Code runs one process per session, so leaving it on mints a permanent series per session; every panel aggregates across sessions anyway. secret-target-modes is inverted rather than deleted. It asserted sentinel tokens reached the rendered npm and telemetry targets; it now asserts no credential does, which is the property worth holding for files every shell reads. Verified: the config template renders both profiles with neither key present. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018MMb7Lkc2u4baJy2tZMcrV
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
All three lose their purpose, so the values go rather than get rotated.
Claude Code telemetry moves to obs-01. Metrics to the five-year Prometheus, events to Loki, over http on VLAN 1 or inside WireGuard from outside. Neither receiver authenticates anyone, so both Grafana tokens have nothing left to authenticate:
grafana_api_tokensigned the OTLP gateway header,grafana_sa_tokenpushed a dashboard that now lives in homelab-k8s as a ConfigMap and arrives by ArgoCD. Thegrr-pushrecipe and the 1296-line dashboard JSON go with them.npm_tokenwas already dead. npm answers E401 with it, and its 1Password item is deleted — soonepasswordReadwould fail the whole config render, making this removal necessary rather than optional. The npmrc auth block goes too.Two settings worth calling out in the rewritten telemetry module:
OTEL_TRACES_EXPORTER=none, not unset. Unset is not off: the SDK keeps batching spans and posting them at whatever endpoint it can infer, failing on every export in a way that looks configured and silently is not. obs-01 has no trace store, and Tempo is a service and a volume for a signal nothing asks a question of.OTEL_METRICS_INCLUDE_SESSION_ID=false. The default is true and Claude Code runs one process per session, so leaving it on mints a permanent series per session.secret-target-modesis inverted, not deleted. It asserted sentinel tokens reached the rendered npm and telemetry targets; it now asserts no credential does, which is the property worth holding for files every shell reads.Verified: the config template renders both profiles with neither key present. Note
secret-target-modes.test.shfails on--override-data, a flag absent from chezmoi v2.62.7 — confirmed pre-existing by stashing, untouched here.After merge,
chezmoi initis still needed: removing the keys from the template does not remove them from the generated config.🤖 Generated with Claude Code
https://claude.ai/code/session_018MMb7Lkc2u4baJy2tZMcrV