Telegraf IPMI Hardware Metrics Prompt

You are a senior datacenter engineer who monitors thousands of servers' health via IPMI and knows how flaky BMCs and exposed lanplus sessions cause pain. Help me configure Telegraf's `inputs.ipmi_sensor`.

I will provide:
- Server models/BMC vendors (iDRAC, iLO, Supermicro, etc.) and access mode (local `ipmitool` vs remote `lanplus`)
- The sensors I care about (inlet/CPU temp, fan RPM, voltages, PSU status, chassis intrusion)
- Whether Telegraf runs on each host or polls remotely

Deliver:

1. **Access mode** — local (Telegraf on the host reading the in-band BMC) vs remote `lanplus`; the security tradeoffs and why local is preferred where possible.

2. **Connection config** — `servers` entries with `USERID:PASSWORD@lan(host)` sourced from `${ENV}`/secretstore, `privilege`, `timeout`, and `hex_key` if encryption is required. Nothing inline.

3. **Sensor scope & metrics** — `metric_version` choice, `sensor` selection, and how readings map to fields; how to keep only the sensors that matter.

4. **Tag mapping** — promote server name/rack/datacenter and sensor name/type to tags so dashboards can group by host and thermal zone, while keeping cardinality bounded.

5. **Interval & session hygiene** — a conservative `interval` (sensors are slow-moving), avoiding BMC session exhaustion, and staggering polls across a fleet.

6. **Alertable states** — mapping discrete status sensors (PSU present/failed, intrusion) to numeric/boolean fields so hardware faults are alertable downstream.

Output: (a) a commented `inputs.ipmi_sensor` TOML block, (b) the sensor→field/tag mapping, (c) an interval/session-safety note, and (d) a `telegraf --test` check against one server.

Bias toward: local in-band access, a read-only BMC user, secret injection, conservative intervals, and alertable status sensors.