IONOS VPS vps-i1
Environment ID: vps-i1
Type: production
Status: active
Purpose
Primary production VPS for the p24-infra monitoring stack. Hosts Prometheus, Grafana, Thanos, Alertmanager, and all custom exporters. Also runs Traccar for GPS tracking and serves as the host for the AI-Dev-IO1 Claude Code agent runner.
Hardware
| Field | Value |
|---|---|
| Provider | IONOS |
| IP | 217.154.82.162 |
| OS | AlmaLinux 9.7 |
| vCPU | 6 |
| RAM | 8 GB |
| Disk | 239 GB |
| DNS | *.vps-i1.infra.zintegrowana.online (wildcard → 217.154.82.162) |
Running Containers
| Container | Purpose | Port |
|---|---|---|
monitoring-caddy-1 | TLS reverse proxy | 80, 443 |
monitoring-grafana-1 | Dashboards | 127.0.0.1:3000 |
monitoring-prometheus-1 | Metrics collection, 15d local TSDB | 127.0.0.1:9090 |
monitoring-alertmanager-1 | Email alerts via Mailgun EU | 127.0.0.1:9093 |
monitoring-thanos-sidecar-1 | Uploads 2h Prometheus blocks to Wasabi S3 | — |
monitoring-thanos-query-1 | Unified PromQL over local + S3 | 127.0.0.1:10902 |
node_exporter | Host metrics | 9100 |
queue-exporter | Supabase queue depths | 9200 |
pg-stats-exporter | Supabase pg_stat_statements slow queries | 9201 |
backup-exporter | Wasabi backup status JSON | 9220 |
cost-exporter | Vercel/Supabase/Wasabi billing | 9210 |
vercel-exporter | Vercel deployment metrics | — |
credential-exporter | Credential rotation age tracking | — |
pdf-service | HTML-to-PDF API (wraps Gotenberg) | 8100 |
gotenberg | PDF rendering engine | internal |
traccar | GPS tracking | 8082 (web), 5027 (GPS/UDP) |
traccar-db | MySQL for Traccar | internal |
Access
# As root (human developer)
ssh root@217.154.82.162 -i C:\Users\konar\.ssh\id_ed25519
# As claude-admin (CI/automated)
ssh claude-admin@217.154.82.162
# Passwordless sudo for: docker, systemctl, mkdir, chown, cp, teeAI-Dev-IO1 Claude Agent
| Field | Value |
|---|---|
| GitHub user | AI-Dev-IO1 |
| Claude version | v2.1.121 (/usr/bin/claude) |
| Auth | OAuth subscription (Claude Max) — not API key |
| Credentials | /home/claude-runner/.claude/.credentials.json |
| Max parallel agents | 3 |
| Role | monitoring-ops |
| Daily scan window | 09:00–22:45 UTC (max 3 parallel) |
| Nightly review window | 23:00–01:00 UTC (max 5 parallel) |
| Env sync | 6-hour cron via Ansible claude-env-sync role |
Re-auth procedure
OAuth tokens expire every 8–12 hours and auto-refresh. If auth fails:
- Claude attempts Playwright automation first (no human needed)
- If that fails twice: Discord alert + GitHub issue with
human-actionlabel
Operations
# Check stack status
ssh root@217.154.82.162 "cd /opt/p24-infra/monitoring && docker compose ps"
# Hot-reload Prometheus config
ssh root@217.154.82.162 "curl -X POST http://localhost:9090/-/reload"
# View grafana logs
ssh root@217.154.82.162 "cd /opt/p24-infra/monitoring && docker compose logs --tail=50 grafana"
# Restart a service
ssh root@217.154.82.162 "cd /opt/p24-infra/monitoring && docker compose restart alertmanager"
# Pull latest and redeploy
ssh root@217.154.82.162 "cd /opt/p24-infra && git pull && cd monitoring && docker compose up -d"Monitoring URLs
| URL | Service | Auth |
|---|---|---|
grafana.vps-i1.infra.zintegrowana.online | Grafana | Grafana login |
prometheus.vps-i1.infra.zintegrowana.online | Prometheus | basic_auth |
alertmanager.vps-i1.infra.zintegrowana.online | Alertmanager | basic_auth |
traccar.vps-i1.infra.zintegrowana.online | Traccar GPS | Traccar login |
status.vps-i1.infra.zintegrowana.online | Uptime Kuma | Kuma login |
infra.zintegrowana.online | Grafana (public alias) | Grafana login |
Secrets
Primary source: secrets/monitoring.env.sops (SOPS+age)
Server fallback: /opt/p24-infra/monitoring/.env
Secrets Access
| Secret store | Access method | Can decrypt SOPS? |
|---|---|---|
secrets/monitoring.env.sops | Direct SOPS decrypt � age key at /home/claude-runner/.age/keys.txt | Yes � claude-runner has the age key |
All other secrets/*.env.sops files | Same age key � can decrypt all SOPS files | Yes |
| On-server plaintext fallback | /opt/p24-infra/monitoring/.env (deployed by CI) | N/A � already plaintext |
| GitHub Actions secrets | Not accessible from VPS directly | N/A |
vps-i1 / AI-Dev-IO1 does hold the SOPS age key at /home/claude-runner/.age/keys.txt (verified 2026-06-24). The monitoring stack secrets can be decrypted directly on the VPS. CI also deploys a plaintext copy to /opt/p24-infra/monitoring/.env on each merge.
Notes
- Wildcard DNS
*.vps-i1.infra.zintegrowana.onlinecovers all services — no DNS change needed for new services, just add a Caddy entry. - Monitoring compose file:
/opt/p24-infra/monitoring/docker-compose.yml - Repo synced to
/opt/p24-infraon every push tomainordev