sudo mkdir -p /opt/monitoring/prometheus
docker network create monitoring
docker network inspect monitoring -f '{{range .IPAM.Config}}Subred: {{.Subnet}}  Puerta de enlace: {{.Gateway}}{{end}}'

sudo tee /opt/monitoring/.env > /dev/null <<'EOF'
# Versiones fijas: cámbialas a mano cuando decidas actualizar
KUMA_VERSION=1
NODE_EXPORTER_VERSION=TU_VERSION_NODE_EXPORTER
CADVISOR_VERSION=TU_VERSION_CADVISOR
PROMETHEUS_VERSION=TU_VERSION_PROMETHEUS
GRAFANA_VERSION=TU_VERSION_GRAFANA
# Contraseña del usuario admin de Grafana (larga, de tu gestor)
GRAFANA_PASSWORD=TU_CONTRASENA_GRAFANA
EOF
sudo chmod 600 /opt/monitoring/.env

sudo nano /opt/monitoring/docker-compose.yml

cd /opt/monitoring
sudo docker compose up -d
sudo docker compose ps

sudo tee /etc/nginx/sites-available/uptime.TU_DOMINIO > /dev/null <<'EOF'
# HTTP: Let's Encrypt y redirección a HTTPS
server {
    listen 80;
    listen [::]:80;
    server_name uptime.TU_DOMINIO;

    location ^~ /.well-known/acme-challenge/ {
        root /var/www/letsencrypt;
    }

    location / {
        return 301 https://$host$request_uri;
    }
}

# HTTPS: Uptime Kuma (contenedor en 127.0.0.1:3001), solo por la VPN
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name uptime.TU_DOMINIO;

    ssl_certificate     /etc/letsencrypt/live/uptime.TU_DOMINIO/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/uptime.TU_DOMINIO/privkey.pem;
    include snippets/tls.conf;
    include snippets/solo-vpn.conf;

    add_header Strict-Transport-Security "max-age=86400" always;
    add_header X-Content-Type-Options "nosniff" always;

    location / {
        proxy_pass http://127.0.0.1:3001;
        include snippets/proxy.conf;
    }
}
EOF

sudo ln -s /etc/nginx/sites-available/uptime.TU_DOMINIO /etc/nginx/sites-enabled/
sudo certbot certonly --webroot -w /var/www/letsencrypt -d uptime.TU_DOMINIO --cert-name uptime.TU_DOMINIO
sudo nginx -t && sudo systemctl reload nginx

sudo ufw allow from TU_SUBRED to TU_GATEWAY port 9100 proto tcp comment 'Prometheus -> node-exporter'

sudo nano /opt/monitoring/prometheus/prometheus.yml

cd /opt/monitoring
sudo docker compose up -d
sleep 40
docker exec prometheus wget -qO- 'http://localhost:9090/api/v1/targets' | grep -o '"scrapeUrl":"[^"]*"\|"health":"[^"]*"'

cd /opt/monitoring
sudo docker compose up -d

sudo tee /etc/nginx/sites-available/monitor.TU_DOMINIO > /dev/null <<'EOF'
# HTTP: Let's Encrypt y redirección a HTTPS
server {
    listen 80;
    listen [::]:80;
    server_name monitor.TU_DOMINIO;

    location ^~ /.well-known/acme-challenge/ {
        root /var/www/letsencrypt;
    }

    location / {
        return 301 https://$host$request_uri;
    }
}

# HTTPS: Grafana (contenedor en 127.0.0.1:3000), solo por la VPN
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name monitor.TU_DOMINIO;

    ssl_certificate     /etc/letsencrypt/live/monitor.TU_DOMINIO/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/monitor.TU_DOMINIO/privkey.pem;
    include snippets/tls.conf;
    include snippets/solo-vpn.conf;

    add_header Strict-Transport-Security "max-age=86400" always;
    add_header X-Content-Type-Options "nosniff" always;

    location / {
        proxy_pass http://127.0.0.1:3000;
        include snippets/proxy.conf;
    }
}
EOF

sudo ln -s /etc/nginx/sites-available/monitor.TU_DOMINIO /etc/nginx/sites-enabled/
sudo certbot certonly --webroot -w /var/www/letsencrypt -d monitor.TU_DOMINIO --cert-name monitor.TU_DOMINIO
sudo nginx -t && sudo systemctl reload nginx

docker exec prometheus wget -qO- 'http://localhost:9090/api/v1/query?query=node_network_receive_bytes_total' | grep -o '"device":"[^"]*"' | sort -u
ip -br link | awk '{print $1}'

cd /tmp
curl -fsSO https://www.ebenezer.org.es/descargas/chequeo-servidor.sh
curl -fsSO https://www.ebenezer.org.es/descargas/SHA256SUMS.txt
sha256sum -c --ignore-missing SHA256SUMS.txt
sudo install -m 750 chequeo-servidor.sh /usr/local/bin/chequeo-servidor.sh
rm chequeo-servidor.sh SHA256SUMS.txt
sudo nano /usr/local/bin/chequeo-servidor.sh

sudo /usr/local/bin/chequeo-servidor.sh

sudo tee /etc/cron.d/chequeo-servidor > /dev/null <<'EOF'
# Chequeo diario del servidor a las 07:15; correo solo si hay incidencias
15 7 * * * root /usr/local/bin/chequeo-servidor.sh --plain > /var/log/chequeo-servidor.log 2>&1; [ $? -ne 0 ] && (echo "Subject: [Chequeo] Incidencias en $(hostname)"; echo; cat /var/log/chequeo-servidor.log) | /usr/sbin/sendmail TU_BUZON@TU_DOMINIO
EOF

(echo "Subject: [Chequeo] Prueba"; echo; echo "Si lees esto, los avisos funcionan.") | /usr/sbin/sendmail TU_BUZON@TU_DOMINIO

cd /opt/monitoring && sudo docker compose ps
sudo ss -tlnp | grep -E ':(3000|3001|9100)\b'
docker exec prometheus wget -qO- 'http://localhost:9090/api/v1/targets' | grep -o '"health":"[^"]*"' | sort | uniq -c
sudo /usr/local/bin/chequeo-servidor.sh --quiet