netbis: NPM 6대 Vector→zlambda→VL 로그 수집 파이프라인 구축

services/netbis.md

@@ -222,6 +222,35 @@ Workers Paid에 포함. CrowdSec Worker Bouncer 요청 로그를 R2에 저장
 - Nginx: worker_connections 10240, proxy_buffers 16 32k, keepalive_requests 1000, open_file_cache
 - real_ip_header: CF-Connecting-IP (컨테이너 내 sed, 재시작 시 초기화 주의)
 
+### 로그 수집 (Vector → zlambda → VictoriaLogs)
+
+6대 모두 호스트-레벨 Vector 0.55 가 NPM 로그 파일을 tail → zlambda(vector-relay 0.45, 컨테이너) → VictoriaLogs(`vl.inouter.com`). 2026-04-23 구축.
+
+```
+NPM-1..6 호스트 Vector(0.55)
+  source: file tail /root/data/logs/proxy-host-*_access.log 등 (NPM-6만 /home/kaffa/npm/data/log/)
+  transform: remap (VRL, NPM proxy/standard log 포맷 파싱 → ip/method/path/status/bytes/user_agent/referer/domain/upstream)
+  sink: http POST http://139.162.71.52:9999/ (zlambda public IP) basic auth (user=npm-relay, password=zlambda agenix bearer)
+    └─ zlambda Vector-relay(0.45, Docker, net vector-net)
+        source: http_server 0.0.0.0:9999 basic auth
+        transform: remap — `.relay = "zlambda"` 태그
+        sink: elasticsearch bulk https://vl.inouter.com/insert/elasticsearch
+             └─ VictoriaLogs (index `npm-netbis`, stream fields: host, service, log_type)
+```
+
+| 항목 | 값 |
+|------|-----|
+| NPM Vector 설치 | `sh.vector.dev` 공식 스크립트 → `/usr/local/bin/vector`, systemd unit `vector.service` |
+| NPM Vector 설정 | `/etc/vector/vector.yaml` (mode 600, bearer 평문 포함), checkpoints `/var/lib/vector/npm_{access,error}/` |
+| 라벨 | `host=npm-1..6`, `service=npm`, `log_type=access|error`, `zone=<서빙 zone CSV>`(npm-1/5/6 은 `shared`), `relay=zlambda`, `program=npm`, `proxy_host_id`(파일명에서 추출) |
+| 파싱 포맷 | NPM proxy log_format + standard log_format(fallback/letsencrypt). 실패 시 `log_format=raw` |
+| zlambda relay | [[zlambda]] NixOS container `vector-relay` (Docker `timberio/vector:0.45.0-debian`, net `vector-net`, port 9999/tcp) |
+| zlambda 모듈 | `~/nixos-infra/vector.nix` — 전용 render/env systemd + Docker oci-container |
+| bearer token | zlambda agenix `secrets/vector-bearer-token.age` (kaffa + zlambda host key 복호화). NPM config 에는 평문, Vault 백업은 `secret/cloud/vector-relay-netbis` |
+| Linode 방화벽 (zlambda 691875) | inbound allow TCP 9999 from 6 NPM /32 IPs (`allow-npm-relay-9999` rule) |
+| VL 샘플 쿼리 | `service:npm host:"npm-4"` / `service:npm zone:"fall-vip.com"` / `service:npm log_type:error` |
+| 로그 이력 | [[../history/2026-04-23-netbis-npm-vl-collection|history]] |
+
 ## 유사시 전환 절차
 
 1. Cloudflare DNS에서 각 도메인 A 레코드를 `139.162.71.52`로 변경 (수동)