otel: rate-limit otel.odamus.com (nginx 4319) + filtreeri cadvisor btrfs hoiatus

dev/config/otel-collector/config.yaml

@@ -52,6 +52,13 @@ processors:
   batch:
     send_batch_size: 500
     timeout: 10s
+  # Filtreeri välja tuntud, kahjutud mürad.
+  # cAdvisor logib btrfs hoiatuse (konteiner ei näe /dev/mapper/data-root) — benignne.
+  filter/logs:
+    error_mode: ignore
+    logs:
+      log_record:
+        - 'IsMatch(body, "Unable to get btrfs mountpoint IDs")'
 
 exporters:
   otlp:
@@ -70,7 +77,7 @@ service:
       exporters: [otlp]
     logs:
       receivers: [filelog]
-      processors: [memory_limiter, batch]
+      processors: [memory_limiter, filter/logs, batch]
       exporters: [otlp]
     traces:
       receivers: [otlp]

dev/config/otel-ratelimit/nginx.conf

@@ -0,0 +1,39 @@
+worker_processes 1;
+events { worker_connections 1024; }
+
+http {
+    # Real client IP: edge Caddy edastab X-Forwarded-For. Usalda tailneti (100.64.0.0/10)
+    # ja edge'i avalikku IP-d; real_ip_recursive off -> võetakse XFF-i viimane (päris klient).
+    set_real_ip_from 100.64.0.0/10;
+    set_real_ip_from 188.166.84.16;
+    real_ip_header X-Forwarded-For;
+    real_ip_recursive off;
+
+    # Rate-limit: 20 päringut/s IP kohta, puhverdus 60 (nodelay = kohe).
+    limit_req_zone $binary_remote_addr zone=otlp:10m rate=20r/s;
+    limit_req_status 429;
+    limit_conn_zone $binary_remote_addr zone=otlpconn:10m;
+
+    log_format main '$remote_addr "$request" $status';
+    access_log /dev/stdout main;
+
+    upstream collector { server clickstack:4318; }
+
+    server {
+        listen 4319;
+
+        location / {
+            limit_req zone=otlp burst=60 nodelay;
+            limit_conn otlpconn 40;
+
+            proxy_pass http://collector;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header Authorization $http_authorization;
+            proxy_request_buffering off;
+            proxy_read_timeout 60s;
+            client_max_body_size 10m;
+        }
+    }
+}

dev/docker-compose.yml

@@ -258,6 +258,24 @@ services:
     networks:
       - main_ai_network
 
+  # Rate-limiter HyperDX OTLP ingest'ile (otel.odamus.com). Edge Caddy -> see -> clickstack:4318.
+  # nginx limit_req (Caddy standardbuildis rate_limit plugin't pole).
+  otel-ratelimit:
+    image: nginx:alpine
+    container_name: otel-ratelimit
+    restart: unless-stopped
+    mem_limit: 32m
+    environment:
+      - TZ=Europe/Tallinn
+    volumes:
+      - ./config/otel-ratelimit/nginx.conf:/etc/nginx/nginx.conf:ro
+    ports:
+      - "100.87.1.24:4319:4319"
+    depends_on:
+      - clickstack
+    networks:
+      - main_ai_network
+
 networks:
   main_ai_network:
     external: true