diff --git a/roles/grafana/defaults/main.yml b/roles/grafana/defaults/main.yml
new file mode 100644
index 0000000000000000000000000000000000000000..cafa5542b6c11070a69e7f541129594bfbd3690a
--- /dev/null
+++ b/roles/grafana/defaults/main.yml
@@ -0,0 +1,3 @@
+---
+app_main_port: "3000"
+app_group: "{{ app_user }}"
\ No newline at end of file
diff --git a/roles/grafana/handlers/main.yml b/roles/grafana/handlers/main.yml
new file mode 100644
index 0000000000000000000000000000000000000000..42209d7c9a5e30055590c54a6af8bfbeb377f0a1
--- /dev/null
+++ b/roles/grafana/handlers/main.yml
@@ -0,0 +1,4 @@
+---
+- name: reload nginx grafana
+  service: name=nginx state=reloaded
+
diff --git a/roles/grafana/tasks/install.yml b/roles/grafana/tasks/install.yml
new file mode 100644
index 0000000000000000000000000000000000000000..7b74d8b7cddca7d9e901d3f4323ed4128cd651fc
--- /dev/null
+++ b/roles/grafana/tasks/install.yml
@@ -0,0 +1,75 @@
+---
+
+- name: Create of update let'encrypt certificate
+  import_role:
+    name: _letsencrypt_certificate
+  when: app_domain is defined and app_domain != ""
+
+- name: create user {{ app_user }}
+  import_role:
+    name: _user
+  vars:
+    user_name: "{{ app_user }}"
+    user_password: "{{ app_user_password }}"
+  when: app_user is defined
+
+- name: "directory for www logs mounted in jail"
+  file:
+    state: directory
+    path: "{{ app_instance_root }}/../logs"
+    mode: 0711
+    owner: "{{ app_user }}"
+    group: "{{ app_group }}"
+  when: app_user is defined
+
+- name: "Create data folder"
+  file:
+    state: directory
+    path: "{{ app_instance_root }}/data"
+    mode: 0775
+    owner: "{{ app_user }}"
+    group: "{{ app_group }}"
+  when: app_user is defined
+
+- name: "template of grafana.ini {{ app_instance_id }}"
+  template:
+    src: "grafana_ini.j2"
+    dest: "{{ app_instance_root }}/data/grafana.ini"
+
+- name: "template nginx_app.j2 {{ app_instance_id }}"
+  template:
+    src: "nginx_app.j2"
+    dest: "/etc/nginx/sites-available/{{ app_instance_id }}.conf"
+  notify: reload nginx grafana
+  tags:
+    - rev_proxy
+
+- name: "copy docker-compose {{ app_instance_id }}"
+  template:
+    src: "docker_compose_yml.j2"
+    dest: "{{ app_instance_root }}/docker-compose.yml"
+  tags:
+    - grafana_installation
+
+- name: "start grafana environment"
+  docker_compose:
+    project_src: "{{ app_instance_root }}"
+    state: present
+  tags:
+    - grafana_installation
+
+- name: log rotate
+  import_role:
+    name: _app_logrotate
+
+- name: "enable site for {{ app_domain }}"
+  file:
+    state: link
+    path: "/etc/nginx/sites-enabled/{{ app_instance_id }}.conf"
+    src: "/etc/nginx/sites-available/{{ app_instance_id }}.conf"
+  notify: reload nginx grafana
+
+- name: Add monit
+  import_role:
+    name: _app_monit
+  when: monit_request is defined and monit_request != ''
diff --git a/roles/grafana/tasks/main.yml b/roles/grafana/tasks/main.yml
new file mode 100644
index 0000000000000000000000000000000000000000..de873777ce32c4abfbc12075f11e3c77c02df787
--- /dev/null
+++ b/roles/grafana/tasks/main.yml
@@ -0,0 +1,24 @@
+---
+- name: "set user home var "
+  set_fact:
+    app_user_home: "/home/{{ app_user }}"
+  tags:
+    - setpath
+
+- name: "set instance root"
+  set_fact:
+    app_instance_root: "{{ app_user_home }}/{{ app_instance_id }}"
+  tags:
+    - setpath
+
+- name: "set instance root"
+  set_fact:
+    run_user: "{{ app_user }}"
+  tags:
+    - setpath
+
+- import_tasks: install.yml
+  when: app_run in ['install', 'reinstall']
+
+- import_tasks: uninstall.yml
+  when: app_run == 'uninstall'
\ No newline at end of file
diff --git a/roles/grafana/tasks/uninstall.yml b/roles/grafana/tasks/uninstall.yml
new file mode 100644
index 0000000000000000000000000000000000000000..e69de29bb2d1d6434b8b29ae775ad8c2e48c5391
diff --git a/roles/grafana/templates/docker_compose_yml.j2 b/roles/grafana/templates/docker_compose_yml.j2
new file mode 100644
index 0000000000000000000000000000000000000000..a8efc2f5701fc2ae27baac3edb03b72cbb25dc41
--- /dev/null
+++ b/roles/grafana/templates/docker_compose_yml.j2
@@ -0,0 +1,14 @@
+version: '3.7'
+
+services:
+  grafana:
+    image: grafana/grafana-oss
+    user: "472:0"
+    environment:
+      - GF_PATHS_DATA=/var/lib/grafana
+    volumes:
+      - {{ app_instance_root }}/data:/var/lib/grafana
+    ports:
+      - 127.0.0.1:${APP_MAIN_PORT:-3000}:3000
+    restart: always
+    command: sh -c "/usr/local/bin/init.sh && chown -R root:root /etc/grafana && chmod -R a+r /etc/grafana && chown -R grafana:grafana /var/lib/grafana && chown -R grafana:grafana /usr/share/grafana && chown grafana:grafana /home/storage/ && chmod 777 /home/storage/"
diff --git a/roles/grafana/templates/grafana_ini.j2 b/roles/grafana/templates/grafana_ini.j2
new file mode 100644
index 0000000000000000000000000000000000000000..c52e2c1a289834eba3939cea9b4904db8a6d3f23
--- /dev/null
+++ b/roles/grafana/templates/grafana_ini.j2
@@ -0,0 +1,1258 @@
+##################### Grafana Configuration Defaults #####################
+#
+# Do not modify this file in grafana installs
+#
+
+# possible values : production, development
+app_mode = production
+
+# instance name, defaults to HOSTNAME environment variable value or hostname if HOSTNAME var is empty
+instance_name = ${HOSTNAME}
+
+# force migration will run migrations that might cause dataloss
+force_migration = false
+
+#################################### Paths ###############################
+[paths]
+# Path to where grafana can store temp files, sessions, and the sqlite3 db (if that is used)
+data = data
+
+# Temporary files in `data` directory older than given duration will be removed
+temp_data_lifetime = 24h
+
+# Directory where grafana can store logs
+logs = data/log
+
+# Directory where grafana will automatically scan and look for plugins
+plugins = data/plugins
+
+# folder that contains provisioning config files that grafana will apply on startup and while running.
+provisioning = conf/provisioning
+
+#################################### Server ##############################
+[server]
+# Protocol (http, https, h2, socket)
+protocol = http
+
+# The ip address to bind to, empty will bind to all interfaces
+http_addr =
+
+# The http port to use
+http_port = 3000
+
+# The public facing domain name used to access grafana from a browser
+domain = localhost
+
+# Redirect to correct domain if host header does not match domain
+# Prevents DNS rebinding attacks
+enforce_domain = false
+
+# The full public facing url
+root_url = %(protocol)s://%(domain)s:%(http_port)s/
+
+# Serve Grafana from subpath specified in `root_url` setting. By default it is set to `false` for compatibility reasons.
+serve_from_sub_path = false
+
+# Log web requests
+router_logging = false
+
+# the path relative working path
+static_root_path = public
+
+# enable gzip
+enable_gzip = false
+
+# https certs & key file
+cert_file =
+cert_key =
+
+# Unix socket path
+socket = /tmp/grafana.sock
+
+# CDN Url
+cdn_url =
+
+# Sets the maximum time in minutes before timing out read of an incoming request and closing idle connections.
+# `0` means there is no timeout for reading the request.
+read_timeout = 0
+
+#################################### Database ############################
+[database]
+# You can configure the database connection by specifying type, host, name, user and password
+# as separate properties or as on string using the url property.
+
+# Either "mysql", "postgres" or "sqlite3", it's your choice
+type = sqlite3
+host = 127.0.0.1:3306
+name = grafana
+user = root
+# If the password contains # or ; you have to wrap it with triple quotes. Ex """#password;"""
+password =
+# Use either URL or the previous fields to configure the database
+# Example: mysql://user:secret@host:port/database
+url =
+
+# Max idle conn setting default is 2
+max_idle_conn = 2
+
+# Max conn setting default is 0 (mean not set)
+max_open_conn =
+
+# Connection Max Lifetime default is 14400 (means 14400 seconds or 4 hours)
+conn_max_lifetime = 14400
+
+# Set to true to log the sql calls and execution times.
+log_queries =
+
+# For "postgres", use either "disable", "require" or "verify-full"
+# For "mysql", use either "true", "false", or "skip-verify".
+ssl_mode = disable
+
+# Database drivers may support different transaction isolation levels.
+# Currently, only "mysql" driver supports isolation levels.
+# If the value is empty - driver's default isolation level is applied.
+# For "mysql" use "READ-UNCOMMITTED", "READ-COMMITTED", "REPEATABLE-READ" or "SERIALIZABLE".
+isolation_level =
+
+ca_cert_path =
+client_key_path =
+client_cert_path =
+server_cert_name =
+
+# For "sqlite3" only, path relative to data_path setting
+path = grafana.db
+
+# For "sqlite3" only. cache mode setting used for connecting to the database
+cache_mode = private
+
+# For "mysql" only if lockingMigration feature toggle is set. How many seconds to wait before failing to lock the database for the migrations, default is 0.
+locking_attempt_timeout_sec = 0
+
+#################################### Cache server #############################
+[remote_cache]
+# Either "redis", "memcached" or "database" default is "database"
+type = database
+
+# cache connectionstring options
+# database: will use Grafana primary database.
+# redis: config like redis server e.g. `addr=127.0.0.1:6379,pool_size=100,db=0,ssl=false`. Only addr is required. ssl may be 'true', 'false', or 'insecure'.
+# memcache: 127.0.0.1:11211
+connstr =
+
+#################################### Data proxy ###########################
+[dataproxy]
+
+# This enables data proxy logging, default is false
+logging = false
+
+# How long the data proxy waits to read the headers of the response before timing out, default is 30 seconds.
+# This setting also applies to core backend HTTP data sources where query requests use an HTTP client with timeout set.
+timeout = 30
+
+# How long the data proxy waits to establish a TCP connection before timing out, default is 10 seconds.
+dialTimeout = 10
+
+# How many seconds the data proxy waits before sending a keepalive request.
+keep_alive_seconds = 30
+
+# How many seconds the data proxy waits for a successful TLS Handshake before timing out.
+tls_handshake_timeout_seconds = 10
+
+# How many seconds the data proxy will wait for a server's first response headers after
+# fully writing the request headers if the request has an "Expect: 100-continue"
+# header. A value of 0 will result in the body being sent immediately, without
+# waiting for the server to approve.
+expect_continue_timeout_seconds = 1
+
+# Optionally limits the total number of connections per host, including connections in the dialing,
+# active, and idle states. On limit violation, dials will block.
+# A value of zero (0) means no limit.
+max_conns_per_host = 0
+
+# The maximum number of idle connections that Grafana will keep alive.
+max_idle_connections = 100
+
+# How many seconds the data proxy keeps an idle connection open before timing out.
+idle_conn_timeout_seconds = 90
+
+# If enabled and user is not anonymous, data proxy will add X-Grafana-User header with username into the request.
+send_user_header = false
+
+# Limit the amount of bytes that will be read/accepted from responses of outgoing HTTP requests.
+response_limit = 0
+
+# Limits the number of rows that Grafana will process from SQL data sources.
+row_limit = 1000000
+
+#################################### Analytics ###########################
+[analytics]
+# Server reporting, sends usage counters to stats.grafana.org every 24 hours.
+# No ip addresses are being tracked, only simple counters to track
+# running instances, dashboard and error counts. It is very helpful to us.
+# Change this option to false to disable reporting.
+reporting_enabled = true
+
+# The name of the distributor of the Grafana instance. Ex hosted-grafana, grafana-labs
+reporting_distributor = grafana-labs
+
+# Set to false to disable all checks to https://grafana.com
+# for new versions of grafana. The check is used
+# in some UI views to notify that a grafana update exists.
+# This option does not cause any auto updates, nor send any information
+# only a GET request to https://raw.githubusercontent.com/grafana/grafana/main/latest.json to get the latest version.
+check_for_updates = true
+
+# Set to false to disable all checks to https://grafana.com
+# for new versions of plugins. The check is used
+# in some UI views to notify that a plugin update exists.
+# This option does not cause any auto updates, nor send any information
+# only a GET request to https://grafana.com to get the latest versions.
+check_for_plugin_updates = true
+
+# Google Analytics universal tracking code, only enabled if you specify an id here
+google_analytics_ua_id =
+
+# Google Tag Manager ID, only enabled if you specify an id here
+google_tag_manager_id =
+
+# Rudderstack write key, enabled only if rudderstack_data_plane_url is also set
+rudderstack_write_key =
+
+# Rudderstack data plane url, enabled only if rudderstack_write_key is also set
+rudderstack_data_plane_url =
+
+# Rudderstack SDK url, optional, only valid if rudderstack_write_key and rudderstack_data_plane_url is also set
+rudderstack_sdk_url =
+
+# Rudderstack Config url, optional, used by Rudderstack SDK to fetch source config
+rudderstack_config_url =
+
+# Application Insights connection string. Specify an URL string to enable this feature.
+application_insights_connection_string =
+
+# Optional. Specifies an Application Insights endpoint URL where the endpoint string is wrapped in backticks ``.
+application_insights_endpoint_url =
+
+# Controls if the UI contains any links to user feedback forms
+feedback_links_enabled = true
+
+#################################### Security ############################
+[security]
+# disable creation of admin user on first start of grafana
+disable_initial_admin_creation = false
+
+# default admin user, created on startup
+admin_user = admin
+
+# default admin password, can be changed before first start of grafana, or in profile settings
+admin_password = admin
+
+# used for signing
+secret_key = {{ secret_key }}
+
+# current key provider used for envelope encryption, default to static value specified by secret_key
+encryption_provider = secretKey.v1
+
+# list of configured key providers, space separated (Enterprise only): e.g., awskms.v1 azurekv.v1
+available_encryption_providers =
+
+# disable gravatar profile images
+disable_gravatar = false
+
+# data source proxy whitelist (ip_or_domain:port separated by spaces)
+data_source_proxy_whitelist =
+
+# disable protection against brute force login attempts
+disable_brute_force_login_protection = false
+
+# set to true if you host Grafana behind HTTPS. default is false.
+cookie_secure = false
+
+# set cookie SameSite attribute. defaults to `lax`. can be set to "lax", "strict", "none" and "disabled"
+cookie_samesite = lax
+
+# set to true if you want to allow browsers to render Grafana in a <frame>, <iframe>, <embed> or <object>. default is false.
+allow_embedding = false
+
+# Set to true if you want to enable http strict transport security (HSTS) response header.
+# HSTS tells browsers that the site should only be accessed using HTTPS.
+strict_transport_security = false
+
+# Sets how long a browser should cache HSTS. Only applied if strict_transport_security is enabled.
+strict_transport_security_max_age_seconds = 86400
+
+# Set to true if to enable HSTS preloading option. Only applied if strict_transport_security is enabled.
+strict_transport_security_preload = false
+
+# Set to true if to enable the HSTS includeSubDomains option. Only applied if strict_transport_security is enabled.
+strict_transport_security_subdomains = false
+
+# Set to true to enable the X-Content-Type-Options response header.
+# The X-Content-Type-Options response HTTP header is a marker used by the server to indicate that the MIME types advertised
+# in the Content-Type headers should not be changed and be followed.
+x_content_type_options = true
+
+# Set to true to enable the X-XSS-Protection header, which tells browsers to stop pages from loading
+# when they detect reflected cross-site scripting (XSS) attacks.
+x_xss_protection = true
+
+# Enable adding the Content-Security-Policy header to your requests.
+# CSP allows to control resources the user agent is allowed to load and helps prevent XSS attacks.
+content_security_policy = false
+
+# Set Content Security Policy template used when adding the Content-Security-Policy header to your requests.
+# $NONCE in the template includes a random nonce.
+# $ROOT_PATH is server.root_url without the protocol.
+content_security_policy_template = """script-src 'self' 'unsafe-eval' 'unsafe-inline' 'strict-dynamic' $NONCE;object-src 'none';font-src 'self';style-src 'self' 'unsafe-inline' blob:;img-src * data:;base-uri 'self';connect-src 'self' grafana.com ws://$ROOT_PATH wss://$ROOT_PATH;manifest-src 'self';media-src 'none';form-action 'self';"""
+
+# Controls if old angular plugins are supported or not. This will be disabled by default in future release
+angular_support_enabled = true
+
+[security.encryption]
+# Defines the time-to-live (TTL) for decrypted data encryption keys stored in memory (cache).
+# Please note that small values may cause performance issues due to a high frequency decryption operations.
+data_keys_cache_ttl = 15m
+
+# Defines the frequency of data encryption keys cache cleanup interval.
+# On every interval, decrypted data encryption keys that reached the TTL are removed from the cache.
+data_keys_cache_cleanup_interval = 1m
+
+#################################### Snapshots ###########################
+[snapshots]
+# snapshot sharing options
+external_enabled = false
+external_snapshot_url = https://snapshots.raintank.io
+external_snapshot_name = Publish to snapshots.raintank.io
+
+# Set to true to enable this Grafana instance act as an external snapshot server and allow unauthenticated requests for
+# creating and deleting snapshots.
+public_mode = false
+
+# remove expired snapshot
+snapshot_remove_expired = true
+
+#################################### Dashboards ##################
+
+[dashboards]
+# Number dashboard versions to keep (per dashboard). Default: 20, Minimum: 1
+versions_to_keep = 20
+
+# Minimum dashboard refresh interval. When set, this will restrict users to set the refresh interval of a dashboard lower than given interval. Per default this is 5 seconds.
+# The interval string is a possibly signed sequence of decimal numbers, followed by a unit suffix (ms, s, m, h, d), e.g. 30s or 1m.
+min_refresh_interval = 5s
+
+# Path to the default home dashboard. If this value is empty, then Grafana uses StaticRootPath + "dashboards/home.json"
+default_home_dashboard_path =
+
+################################### Data sources #########################
+[datasources]
+# Upper limit of data sources that Grafana will return. This limit is a temporary configuration and it will be deprecated when pagination will be introduced on the list data sources API.
+datasource_limit = 5000
+
+#################################### Users ###############################
+[users]
+# disable user signup / registration
+allow_sign_up = false
+
+# Allow non admin users to create organizations
+allow_org_create = false
+
+# Set to true to automatically assign new users to the default organization (id 1)
+auto_assign_org = true
+
+# Set this value to automatically add new users to the provided organization (if auto_assign_org above is set to true)
+auto_assign_org_id = 1
+
+# Default role new users will be automatically assigned (if auto_assign_org above is set to true)
+auto_assign_org_role = Viewer
+
+# Require email validation before sign up completes
+verify_email_enabled = false
+
+# Background text for the user field on the login page
+login_hint = email or username
+password_hint = password
+
+# Default UI theme ("dark" or "light")
+default_theme = dark
+
+# Default locale (supported IETF language tag, such as en-US)
+default_locale = en-US
+
+# Path to a custom home page. Users are only redirected to this if the default home dashboard is used. It should match a frontend route and contain a leading slash.
+home_page =
+
+# External user management
+external_manage_link_url =
+external_manage_link_name =
+external_manage_info =
+
+# Viewers can edit/inspect dashboard settings in the browser. But not save the dashboard.
+viewers_can_edit = false
+
+# Editors can administrate dashboard, folders and teams they create
+editors_can_admin = false
+
+# The duration in time a user invitation remains valid before expiring. This setting should be expressed as a duration. Examples: 6h (hours), 2d (days), 1w (week). Default is 24h (24 hours). The minimum supported duration is 15m (15 minutes).
+user_invite_max_lifetime_duration = 24h
+
+# Enter a comma-separated list of usernames to hide them in the Grafana UI. These users are shown to Grafana admins and to themselves.
+hidden_users =
+
+[auth]
+# Login cookie name
+login_cookie_name = grafana_session
+
+# The maximum lifetime (duration) an authenticated user can be inactive before being required to login at next visit. Default is 7 days (7d). This setting should be expressed as a duration, e.g. 5m (minutes), 6h (hours), 10d (days), 2w (weeks), 1M (month). The lifetime resets at each successful token rotation (token_rotation_interval_minutes).
+login_maximum_inactive_lifetime_duration =
+
+# The maximum lifetime (duration) an authenticated user can be logged in since login time before being required to login. Default is 30 days (30d). This setting should be expressed as a duration, e.g. 5m (minutes), 6h (hours), 10d (days), 2w (weeks), 1M (month).
+login_maximum_lifetime_duration =
+
+# How often should auth tokens be rotated for authenticated users when being active. The default is each 10 minutes.
+token_rotation_interval_minutes = 10
+
+# Set to true to disable (hide) the login form, useful if you use OAuth
+disable_login_form = false
+
+# Set to true to disable the sign out link in the side menu. Useful if you use auth.proxy or auth.jwt.
+disable_signout_menu = false
+
+# URL to redirect the user to after sign out
+signout_redirect_url =
+
+# Set to true to attempt login with OAuth automatically, skipping the login screen.
+# This setting is ignored if multiple OAuth providers are configured.
+oauth_auto_login = false
+
+# OAuth state max age cookie duration in seconds. Defaults to 600 seconds.
+oauth_state_cookie_max_age = 600
+
+# Skip forced assignment of OrgID 1 or 'auto_assign_org_id' for social logins
+oauth_skip_org_role_update_sync = false
+
+# limit of api_key seconds to live before expiration
+api_key_max_seconds_to_live = -1
+
+# Set to true to enable SigV4 authentication option for HTTP-based datasources
+sigv4_auth_enabled = false
+
+# Set to true to enable verbose logging of SigV4 request signing
+sigv4_verbose_logging = false
+
+#################################### Anonymous Auth ######################
+[auth.anonymous]
+# enable anonymous access
+enabled = false
+
+# specify organization name that should be used for unauthenticated users
+org_name = Main Org.
+
+# specify role for unauthenticated users
+org_role = Viewer
+
+# mask the Grafana version number for unauthenticated users
+hide_version = false
+
+#################################### GitHub Auth #########################
+[auth.github]
+enabled = false
+allow_sign_up = true
+client_id = some_id
+client_secret =
+scopes = user:email,read:org
+auth_url = https://github.com/login/oauth/authorize
+token_url = https://github.com/login/oauth/access_token
+api_url = https://api.github.com/user
+allowed_domains =
+team_ids =
+allowed_organizations =
+
+#################################### GitLab Auth #########################
+[auth.gitlab]
+enabled = false
+allow_sign_up = true
+client_id = some_id
+client_secret =
+scopes = api
+auth_url = https://gitlab.com/oauth/authorize
+token_url = https://gitlab.com/oauth/token
+api_url = https://gitlab.com/api/v4
+allowed_domains =
+allowed_groups =
+role_attribute_path =
+role_attribute_strict = false
+
+#################################### Google Auth #########################
+[auth.google]
+enabled = false
+allow_sign_up = true
+client_id = some_client_id
+client_secret =
+scopes = https://www.googleapis.com/auth/userinfo.profile https://www.googleapis.com/auth/userinfo.email
+auth_url = https://accounts.google.com/o/oauth2/auth
+token_url = https://accounts.google.com/o/oauth2/token
+api_url = https://www.googleapis.com/oauth2/v1/userinfo
+allowed_domains =
+hosted_domain =
+
+#################################### Grafana.com Auth ####################
+# legacy key names (so they work in env variables)
+[auth.grafananet]
+enabled = false
+allow_sign_up = true
+client_id = some_id
+client_secret =
+scopes = user:email
+allowed_organizations =
+
+[auth.grafana_com]
+enabled = false
+allow_sign_up = true
+client_id = some_id
+client_secret =
+scopes = user:email
+allowed_organizations =
+
+#################################### Azure AD OAuth #######################
+[auth.azuread]
+name = Azure AD
+enabled = false
+allow_sign_up = true
+client_id = some_client_id
+client_secret =
+scopes = openid email profile
+auth_url = https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/authorize
+token_url = https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/token
+allowed_domains =
+allowed_groups =
+role_attribute_strict = false
+
+#################################### Okta OAuth #######################
+[auth.okta]
+name = Okta
+icon = okta
+enabled = false
+allow_sign_up = true
+client_id = some_id
+client_secret =
+scopes = openid profile email groups
+auth_url = https://<tenant-id>.okta.com/oauth2/v1/authorize
+token_url = https://<tenant-id>.okta.com/oauth2/v1/token
+api_url = https://<tenant-id>.okta.com/oauth2/v1/userinfo
+allowed_domains =
+allowed_groups =
+role_attribute_path =
+role_attribute_strict = false
+
+#################################### Generic OAuth #######################
+[auth.generic_oauth]
+name = OAuth
+icon = signin
+enabled = false
+allow_sign_up = true
+client_id = some_id
+client_secret =
+scopes = user:email
+empty_scopes = false
+email_attribute_name = email:primary
+email_attribute_path =
+login_attribute_path =
+name_attribute_path =
+role_attribute_path =
+role_attribute_strict = false
+groups_attribute_path =
+id_token_attribute_name =
+team_ids_attribute_path =
+auth_url =
+token_url =
+api_url =
+teams_url =
+allowed_domains =
+team_ids =
+allowed_organizations =
+tls_skip_verify_insecure = false
+tls_client_cert =
+tls_client_key =
+tls_client_ca =
+use_pkce = false
+auth_style =
+
+#################################### Basic Auth ##########################
+[auth.basic]
+enabled = true
+
+#################################### Auth Proxy ##########################
+[auth.proxy]
+enabled = false
+header_name = X-WEBAUTH-USER
+header_property = username
+auto_sign_up = true
+sync_ttl = 60
+whitelist =
+headers =
+headers_encoded = false
+enable_login_token = false
+
+#################################### Auth JWT ##########################
+[auth.jwt]
+enabled = false
+enable_login_token = false
+header_name =
+email_claim =
+username_claim =
+jwk_set_url =
+jwk_set_file =
+cache_ttl = 60m
+expected_claims = {}
+key_file =
+auto_sign_up = false
+
+#################################### Auth LDAP ###########################
+[auth.ldap]
+enabled = false
+config_file = /etc/grafana/ldap.toml
+allow_sign_up = true
+
+# LDAP background sync (Enterprise only)
+# At 1 am every day
+sync_cron = "0 1 * * *"
+active_sync_enabled = true
+
+#################################### AWS ###########################
+[aws]
+# Enter a comma-separated list of allowed AWS authentication providers.
+# Options are: default (AWS SDK Default), keys (Access && secret key), credentials (Credentials field), ec2_iam_role (EC2 IAM Role)
+allowed_auth_providers = default,keys,credentials
+
+# Allow AWS users to assume a role using temporary security credentials.
+# If true, assume role will be enabled for all AWS authentication providers that are specified in aws_auth_providers
+assume_role_enabled = true
+
+# Specify max no of pages to be returned by the ListMetricPages API
+list_metrics_page_limit = 500
+
+#################################### Azure ###############################
+[azure]
+# Azure cloud environment where Grafana is hosted
+# Possible values are AzureCloud, AzureChinaCloud, AzureUSGovernment and AzureGermanCloud
+# Default value is AzureCloud (i.e. public cloud)
+cloud = AzureCloud
+
+# Specifies whether Grafana hosted in Azure service with Managed Identity configured (e.g. Azure Virtual Machines instance)
+# If enabled, the managed identity can be used for authentication of Grafana in Azure services
+# Disabled by default, needs to be explicitly enabled
+managed_identity_enabled = false
+
+# Client ID to use for user-assigned managed identity
+# Should be set for user-assigned identity and should be empty for system-assigned identity
+managed_identity_client_id =
+
+#################################### Role-based Access Control ###########
+[rbac]
+enabled = true
+# If enabled, cache permissions in a in memory cache (Enterprise only)
+permission_cache = true
+
+#################################### SMTP / Emailing #####################
+[smtp]
+enabled = true
+host = {{ smtp_host }}:{{ smtp_port }}
+user = {{ smtp_user }}
+# If the password contains # or ; you have to wrap it with triple quotes. Ex """#password;"""
+password = """{{ smtp_password }}"""
+cert_file =
+key_file =
+skip_verify = false
+from_address = {{ smtp_from }}
+from_name = Grafana - Service Pâquerette
+ehlo_identity =
+startTLS_policy =
+
+[emails]
+welcome_email_on_sign_up = false
+templates_pattern = emails/*.html, emails/*.txt
+content_types = text/html
+
+#################################### Logging ##########################
+[log]
+# Either "console", "file", "syslog". Default is console and file
+# Use space to separate multiple modes, e.g. "console file"
+mode = console file
+
+# Either "debug", "info", "warn", "error", "critical", default is "info"
+level = info
+
+# optional settings to set different levels for specific loggers. Ex filters = sqlstore:debug
+filters =
+
+# For "console" mode only
+[log.console]
+level =
+
+# log line format, valid options are text, console and json
+format = console
+
+# For "file" mode only
+[log.file]
+level =
+
+# log line format, valid options are text, console and json
+format = text
+
+# This enables automated log rotate(switch of following options), default is true
+log_rotate = true
+
+# Max line number of single file, default is 1000000
+max_lines = 1000000
+
+# Max size shift of single file, default is 28 means 1 << 28, 256MB
+max_size_shift = 28
+
+# Segment log daily, default is true
+daily_rotate = true
+
+# Expired days of log file(delete after max days), default is 7
+max_days = 7
+
+[log.syslog]
+level =
+
+# log line format, valid options are text, console and json
+format = text
+
+# Syslog network type and address. This can be udp, tcp, or unix. If left blank, the default unix endpoints will be used.
+network =
+address =
+
+# Syslog facility. user, daemon and local0 through local7 are valid.
+facility =
+
+# Syslog tag. By default, the process' argv[0] is used.
+tag =
+
+[log.frontend]
+# Should Sentry javascript agent be initialized
+enabled = false
+
+# Defines which provider to use sentry or grafana
+provider = sentry
+
+# Sentry DSN if you want to send events to Sentry.
+sentry_dsn =
+
+# Custom HTTP endpoint to send events to. Default will log the events to stdout.
+custom_endpoint =
+
+# Rate of events to be reported to Sentry between 0 (none) and 1 (all), float
+sample_rate = 1.0
+
+# Requests per second limit enforced per an extended period, for Grafana backend log ingestion endpoint (/log).
+log_endpoint_requests_per_second_limit = 3
+
+# Max requests accepted per short interval of time for Grafana backend log ingestion endpoint (/log)
+log_endpoint_burst_limit = 15
+
+# Should error instrumentation be enabled, only affects Grafana Javascript Agent
+instrumentations_errors_enabled = true
+
+# Should console instrumentation be enabled, only affects Grafana Javascript Agent
+instrumentations_console_enabled = false
+
+# Should webvitals instrumentation be enabled, only affects Grafana Javascript Agent
+instrumentations_webvitals_enabled = false
+
+# Api Key, only applies to Grafana Javascript Agent provider
+api_key =
+
+#################################### Usage Quotas ########################
+[quota]
+enabled = false
+
+#### set quotas to -1 to make unlimited. ####
+# limit number of users per Org.
+org_user = 10
+
+# limit number of dashboards per Org.
+org_dashboard = 100
+
+# limit number of data_sources per Org.
+org_data_source = 10
+
+# limit number of api_keys per Org.
+org_api_key = 10
+
+# limit number of alerts per Org.
+org_alert_rule = 100
+
+# limit number of orgs a user can create.
+user_org = 10
+
+# Global limit of users.
+global_user = -1
+
+# global limit of orgs.
+global_org = -1
+
+# global limit of dashboards
+global_dashboard = -1
+
+# global limit of api_keys
+global_api_key = -1
+
+# global limit on number of logged in users.
+global_session = -1
+
+# global limit of alerts
+global_alert_rule = -1
+
+#################################### Unified Alerting ####################
+[unified_alerting]
+# Enable the Unified Alerting sub-system and interface. When enabled we'll migrate all of your alert rules and notification channels to the new system. New alert rules will be created and your notification channels will be converted into an Alertmanager configuration. Previous data is preserved to enable backwards compatibility but new data is removed when switching. When this configuration section and flag are not defined, the state is defined at runtime. See the documentation for more details.
+enabled =
+
+# Comma-separated list of organization IDs for which to disable unified alerting. Only supported if unified alerting is enabled.
+disabled_orgs =
+
+# Specify the frequency of polling for admin config changes.
+# The interval string is a possibly signed sequence of decimal numbers, followed by a unit suffix (ms, s, m, h, d), e.g. 30s or 1m.
+admin_config_poll_interval = 60s
+
+# Specify the frequency of polling for Alertmanager config changes.
+# The interval string is a possibly signed sequence of decimal numbers, followed by a unit suffix (ms, s, m, h, d), e.g. 30s or 1m.
+alertmanager_config_poll_interval = 60s
+
+# Listen address/hostname and port to receive unified alerting messages for other Grafana instances. The port is used for both TCP and UDP. It is assumed other Grafana instances are also running on the same port.
+ha_listen_address = "0.0.0.0:9094"
+
+# Explicit address/hostname and port to advertise other Grafana instances. The port is used for both TCP and UDP.
+ha_advertise_address = ""
+
+# Comma-separated list of initial instances (in a format of host:port) that will form the HA cluster. Configuring this setting will enable High Availability mode for alerting.
+ha_peers = ""
+
+# Time to wait for an instance to send a notification via the Alertmanager. In HA, each Grafana instance will
+# be assigned a position (e.g. 0, 1). We then multiply this position with the timeout to indicate how long should
+# each instance wait before sending the notification to take into account replication lag.
+# The interval string is a possibly signed sequence of decimal numbers, followed by a unit suffix (ms, s, m, h, d), e.g. 30s or 1m.
+ha_peer_timeout = 15s
+
+# The interval between sending gossip messages. By lowering this value (more frequent) gossip messages are propagated
+# across cluster more quickly at the expense of increased bandwidth usage.
+# The interval string is a possibly signed sequence of decimal numbers, followed by a unit suffix (ms, s, m, h, d), e.g. 30s or 1m.
+ha_gossip_interval = 200ms
+
+# The interval between gossip full state syncs. Setting this interval lower (more frequent) will increase convergence speeds
+# across larger clusters at the expense of increased bandwidth usage.
+# The interval string is a possibly signed sequence of decimal numbers, followed by a unit suffix (ms, s, m, h, d), e.g. 30s or 1m.
+ha_push_pull_interval = 60s
+
+# Enable or disable alerting rule execution. The alerting UI remains visible. This option has a legacy version in the `[alerting]` section that takes precedence.
+execute_alerts = true
+
+# Alert evaluation timeout when fetching data from the datasource. This option has a legacy version in the `[alerting]` section that takes precedence.
+# The timeout string is a possibly signed sequence of decimal numbers, followed by a unit suffix (ms, s, m, h, d), e.g. 30s or 1m.
+evaluation_timeout = 30s
+
+# Number of times we'll attempt to evaluate an alert rule before giving up on that evaluation. This option has a legacy version in the `[alerting]` section that takes precedence.
+max_attempts = 3
+
+# Minimum interval to enforce between rule evaluations. Rules will be adjusted if they are less than this value or if they are not multiple of the scheduler interval (10s). Higher values can help with resource management as we'll schedule fewer evaluations over time. This option has a legacy version in the `[alerting]` section that takes precedence.
+# The interval string is a possibly signed sequence of decimal numbers, followed by a unit suffix (ms, s, m, h, d), e.g. 30s or 1m.
+min_interval = 10s
+
+[unified_alerting.screenshots]
+# Enable screenshots in notifications. This option requires a remote HTTP image rendering service. Please
+# see [rendering] for further configuration options.
+capture = false
+
+# The maximum number of screenshots that can be taken at the same time. This option is different from
+# concurrent_render_request_limit as max_concurrent_screenshots sets the number of concurrent screenshots
+# that can be taken at the same time for all firing alerts where as concurrent_render_request_limit sets
+# the total number of concurrent screenshots across all Grafana services.
+max_concurrent_screenshots = 5
+
+# Uploads screenshots to the local Grafana server or remote storage such as Azure, S3 and GCS. Please
+# see [external_image_storage] for further configuration options. If this option is false then
+# screenshots will be persisted to disk for up to temp_data_lifetime.
+upload_external_image_storage = false
+
+#################################### Alerting ############################
+[alerting]
+# Enable the legacy alerting sub-system and interface. If Unified Alerting is already enabled and you try to go back to legacy alerting, all data that is part of Unified Alerting will be deleted. When this configuration section and flag are not defined, the state is defined at runtime. See the documentation for more details.
+enabled =
+
+# Makes it possible to turn off alert execution but alerting UI is visible
+execute_alerts = true
+
+# Default setting for new alert rules. Defaults to categorize error and timeouts as alerting. (alerting, keep_state)
+error_or_timeout = alerting
+
+# Default setting for how Grafana handles nodata or null values in alerting. (alerting, no_data, keep_state, ok)
+nodata_or_nullvalues = no_data
+
+# Alert notifications can include images, but rendering many images at the same time can overload the server
+# This limit will protect the server from render overloading and make sure notifications are sent out quickly
+concurrent_render_limit = 5
+
+# Default setting for alert calculation timeout. Default value is 30
+evaluation_timeout_seconds = 30
+
+# Default setting for alert notification timeout. Default value is 30
+notification_timeout_seconds = 30
+
+# Default setting for max attempts to sending alert notifications. Default value is 3
+max_attempts = 3
+
+# Makes it possible to enforce a minimal interval between evaluations, to reduce load on the backend
+min_interval_seconds = 1
+
+# Configures for how long alert annotations are stored. Default is 0, which keeps them forever.
+# This setting should be expressed as an duration. Ex 6h (hours), 10d (days), 2w (weeks), 1M (month).
+max_annotation_age =
+
+# Configures max number of alert annotations that Grafana stores. Default value is 0, which keeps all alert annotations.
+max_annotations_to_keep =
+
+#################################### Annotations #########################
+[annotations]
+# Configures the batch size for the annotation clean-up job. This setting is used for dashboard, API, and alert annotations.
+cleanupjob_batchsize = 100
+
+[annotations.dashboard]
+# Dashboard annotations means that annotations are associated with the dashboard they are created on.
+
+# Configures how long dashboard annotations are stored. Default is 0, which keeps them forever.
+# This setting should be expressed as a duration. Examples: 6h (hours), 10d (days), 2w (weeks), 1M (month).
+max_age =
+
+# Configures max number of dashboard annotations that Grafana stores. Default value is 0, which keeps all dashboard annotations.
+max_annotations_to_keep =
+
+[annotations.api]
+# API annotations means that the annotations have been created using the API without any
+# association with a dashboard.
+
+# Configures how long Grafana stores API annotations. Default is 0, which keeps them forever.
+# This setting should be expressed as a duration. Examples: 6h (hours), 10d (days), 2w (weeks), 1M (month).
+max_age =
+
+# Configures max number of API annotations that Grafana keeps. Default value is 0, which keeps all API annotations.
+max_annotations_to_keep =
+
+#################################### Explore #############################
+[explore]
+# Enable the Explore section
+enabled = true
+
+#################################### Help #############################
+[help]
+# Enable the Help section
+enabled = true
+
+#################################### Profile #############################
+[profile]
+# Enable the Profile section
+enabled = true
+
+#################################### Query History #############################
+[query_history]
+# Enable the Query history
+enabled = true
+
+#################################### Internal Grafana Metrics ############
+# Metrics available at HTTP URL /metrics and /metrics/plugins/:pluginId
+[metrics]
+enabled              = true
+interval_seconds     = 10
+# Disable total stats (stat_totals_*) metrics to be generated
+disable_total_stats = false
+
+#If both are set, basic auth will be required for the metrics endpoints.
+basic_auth_username =
+basic_auth_password =
+
+# Metrics environment info adds dimensions to the `grafana_environment_info` metric, which
+# can expose more information about the Grafana instance.
+[metrics.environment_info]
+#exampleLabel1 = exampleValue1
+#exampleLabel2 = exampleValue2
+
+# Send internal Grafana metrics to graphite
+[metrics.graphite]
+# Enable by setting the address setting (ex localhost:2003)
+address =
+prefix = prod.grafana.%(instance_name)s.
+
+#################################### Grafana.com integration  ##########################
+[grafana_net]
+url = https://grafana.com
+
+[grafana_com]
+url = https://grafana.com
+
+#################################### Distributed tracing ############
+# Opentracing is deprecated use opentelemetry instead
+[tracing.jaeger]
+# jaeger destination (ex localhost:6831)
+address =
+# tag that will always be included in when creating new spans. ex (tag1:value1,tag2:value2)
+always_included_tag =
+# Type specifies the type of the sampler: const, probabilistic, rateLimiting, or remote
+sampler_type = const
+# jaeger samplerconfig param
+# for "const" sampler, 0 or 1 for always false/true respectively
+# for "probabilistic" sampler, a probability between 0 and 1
+# for "rateLimiting" sampler, the number of spans per second
+# for "remote" sampler, param is the same as for "probabilistic"
+# and indicates the initial sampling rate before the actual one
+# is received from the mothership
+sampler_param = 1
+# sampling_server_url is the URL of a sampling manager providing a sampling strategy.
+sampling_server_url =
+# Whether or not to use Zipkin span propagation (x-b3- HTTP headers).
+zipkin_propagation = false
+# Setting this to true disables shared RPC spans.
+# Not disabling is the most common setting when using Zipkin elsewhere in your infrastructure.
+disable_shared_zipkin_spans = false
+
+[tracing.opentelemetry.jaeger]
+# jaeger destination (ex http://localhost:14268/api/traces)
+address =
+# Propagation specifies the text map propagation format: w3c, jaeger
+propagation =
+
+# This is a configuration for OTLP exporter with GRPC protocol
+[tracing.opentelemetry.otlp]
+# otlp destination (ex localhost:4317)
+address =
+# Propagation specifies the text map propagation format: w3c, jaeger
+propagation =
+
+#################################### External Image Storage ##############
+[external_image_storage]
+# Used for uploading images to public servers so they can be included in slack/email messages.
+# You can choose between (s3, webdav, gcs, azure_blob, local)
+provider =
+
+[external_image_storage.s3]
+endpoint =
+path_style_access =
+bucket_url =
+bucket =
+region =
+path =
+access_key =
+secret_key =
+
+[external_image_storage.webdav]
+url =
+username =
+password =
+public_url =
+
+[external_image_storage.gcs]
+key_file =
+bucket =
+path =
+enable_signed_urls = false
+signed_url_expiration =
+
+[external_image_storage.azure_blob]
+account_name =
+account_key =
+container_name =
+
+[external_image_storage.local]
+# does not require any configuration
+
+[rendering]
+# Options to configure a remote HTTP image rendering service, e.g. using https://github.com/grafana/grafana-image-renderer.
+# URL to a remote HTTP image renderer service, e.g. http://localhost:8081/render, will enable Grafana to render panels and dashboards to PNG-images using HTTP requests to an external service.
+server_url =
+# If the remote HTTP image renderer service runs on a different server than the Grafana server you may have to configure this to a URL where Grafana is reachable, e.g. http://grafana.domain/.
+callback_url =
+# Concurrent render request limit affects when the /render HTTP endpoint is used. Rendering many images at the same time can overload the server,
+# which this setting can help protect against by only allowing a certain amount of concurrent requests.
+concurrent_render_request_limit = 30
+
+[panels]
+# here for to support old env variables, can remove after a few months
+enable_alpha = false
+disable_sanitize_html = false
+
+[plugins]
+enable_alpha = false
+app_tls_skip_verify_insecure = false
+# Enter a comma-separated list of plugin identifiers to identify plugins to load even if they are unsigned. Plugins with modified signatures are never loaded.
+allow_loading_unsigned_plugins =
+# Enable or disable installing / uninstalling / updating plugins directly from within Grafana.
+plugin_admin_enabled = true
+plugin_admin_external_manage_enabled = false
+plugin_catalog_url = https://grafana.com/grafana/plugins/
+# Enter a comma-separated list of plugin identifiers to hide in the plugin catalog.
+plugin_catalog_hidden_plugins =
+
+#################################### Grafana Live ##########################################
+[live]
+# max_connections to Grafana Live WebSocket endpoint per Grafana server instance. See Grafana Live docs
+# if you are planning to make it higher than default 100 since this can require some OS and infrastructure
+# tuning. 0 disables Live, -1 means unlimited connections.
+max_connections = 100
+
+# allowed_origins is a comma-separated list of origins that can establish connection with Grafana Live.
+# If not set then origin will be matched over root_url. Supports wildcard symbol "*".
+allowed_origins =
+
+# engine defines an HA (high availability) engine to use for Grafana Live. By default no engine used - in
+# this case Live features work only on a single Grafana server.
+# Available options: "redis".
+# Setting ha_engine is an EXPERIMENTAL feature.
+ha_engine =
+
+# ha_engine_address sets a connection address for Live HA engine. Depending on engine type address format can differ.
+# For now we only support Redis connection address in "host:port" format.
+# This option is EXPERIMENTAL.
+ha_engine_address = "127.0.0.1:6379"
+
+#################################### Grafana Image Renderer Plugin ##########################
+[plugin.grafana-image-renderer]
+# Instruct headless browser instance to use a default timezone when not provided by Grafana, e.g. when rendering panel image of alert.
+# See ICU’s metaZones.txt (https://cs.chromium.org/chromium/src/third_party/icu/source/data/misc/metaZones.txt) for a list of supported
+# timezone IDs. Fallbacks to TZ environment variable if not set.
+rendering_timezone =
+
+# Instruct headless browser instance to use a default language when not provided by Grafana, e.g. when rendering panel image of alert.
+# Please refer to the HTTP header Accept-Language to understand how to format this value, e.g. 'fr-CH, fr;q=0.9, en;q=0.8, de;q=0.7, *;q=0.5'.
+rendering_language =
+
+# Instruct headless browser instance to use a default device scale factor when not provided by Grafana, e.g. when rendering panel image of alert.
+# Default is 1. Using a higher value will produce more detailed images (higher DPI), but will require more disk space to store an image.
+rendering_viewport_device_scale_factor =
+
+# Instruct headless browser instance whether to ignore HTTPS errors during navigation. Per default HTTPS errors are not ignored. Due to
+# the security risk it's not recommended to ignore HTTPS errors.
+rendering_ignore_https_errors =
+
+# Instruct headless browser instance whether to capture and log verbose information when rendering an image. Default is false and will
+# only capture and log error messages. When enabled, debug messages are captured and logged as well.
+# For the verbose information to be included in the Grafana server log you have to adjust the rendering log level to debug, configure
+# [log].filter = rendering:debug.
+rendering_verbose_logging =
+
+# Instruct headless browser instance whether to output its debug and error messages into running process of remote rendering service.
+# Default is false. This can be useful to enable (true) when troubleshooting.
+rendering_dumpio =
+
+# Additional arguments to pass to the headless browser instance. Default is --no-sandbox. The list of Chromium flags can be found
+# here (https://peter.sh/experiments/chromium-command-line-switches/). Multiple arguments is separated with comma-character.
+rendering_args =
+
+# You can configure the plugin to use a different browser binary instead of the pre-packaged version of Chromium.
+# Please note that this is not recommended, since you may encounter problems if the installed version of Chrome/Chromium is not
+# compatible with the plugin.
+rendering_chrome_bin =
+
+# Instruct how headless browser instances are created. Default is 'default' and will create a new browser instance on each request.
+# Mode 'clustered' will make sure that only a maximum of browsers/incognito pages can execute concurrently.
+# Mode 'reusable' will have one browser instance and will create a new incognito page on each request.
+rendering_mode =
+
+# When rendering_mode = clustered, you can instruct how many browsers or incognito pages can execute concurrently. Default is 'browser'
+# and will cluster using browser instances.
+# Mode 'context' will cluster using incognito pages.
+rendering_clustering_mode =
+# When rendering_mode = clustered, you can define the maximum number of browser instances/incognito pages that can execute concurrently. Default is '5'.
+rendering_clustering_max_concurrency =
+# When rendering_mode = clustered, you can specify the duration a rendering request can take before it will time out. Default is `30` seconds.
+rendering_clustering_timeout =
+
+# Limit the maximum viewport width, height and device scale factor that can be requested.
+rendering_viewport_max_width =
+rendering_viewport_max_height =
+rendering_viewport_max_device_scale_factor =
+
+# Change the listening host and port of the gRPC server. Default host is 127.0.0.1 and default port is 0 and will automatically assign
+# a port not in use.
+grpc_host =
+grpc_port =
+
+[enterprise]
+license_path =
+
+[feature_toggles]
+# there are currently two ways to enable feature toggles in the `grafana.ini`.
+# you can either pass an array of feature you want to enable to the `enable` field or
+# configure each toggle by setting the name of the toggle to true/false. Toggles set to true/false
+# will take precedence over toggles in the `enable` list.
+
+# enable = feature1,feature2
+enable =
+
+# The new prometheus visual query builder
+promQueryBuilder = true
+
+# The new loki visual query builder
+lokiQueryBuilder = true
+
+# Experimental Explore to Dashboard workflow
+explore2Dashboard = true
+
+# Experimental Command Palette
+commandPalette = true
+
+# Use dynamic labels in CloudWatch datasource
+cloudWatchDynamicLabels = true
+
+# feature1 = true
+# feature2 = false
+
+[date_formats]
+# For information on what formatting patterns that are supported https://momentjs.com/docs/#/displaying/
+
+# Default system date format used in time range picker and other places where full time is displayed
+full_date = YYYY-MM-DD HH:mm:ss
+
+# Used by graph and other places where we only show small intervals
+interval_second = HH:mm:ss
+interval_minute = HH:mm
+interval_hour = MM/DD HH:mm
+interval_day = MM/DD
+interval_month = YYYY-MM
+interval_year = YYYY
+
+# Experimental feature
+use_browser_locale = false
+
+# Default timezone for user preferences. Options are 'browser' for the browser local timezone or a timezone name from IANA Time Zone database, e.g. 'UTC' or 'Europe/Amsterdam' etc.
+default_timezone = browser
+
+[expressions]
+# Enable or disable the expressions functionality.
+enabled = true
+
+[geomap]
+# Set the JSON configuration for the default basemap
+default_baselayer_config =
+
+# Enable or disable loading other base map layers
+enable_custom_baselayers = true
+
+#################################### Dashboard previews #####################################
+
+[dashboard_previews.crawler]
+# Number of dashboards rendered in parallel. Default is 6.
+thread_count =
+
+# Timeout passed down to the Image Renderer plugin. It is used in two separate places within a single rendering request:
+# First during the initial navigation to the dashboard and then when waiting for all the panels to load. Default is 20s.
+# This setting should be expressed as a duration. Examples: 10s (seconds), 1m (minutes).
+rendering_timeout =
+
+# Maximum duration of a single crawl. Default is 1h.
+# This setting should be expressed as a duration. Examples: 10s (seconds), 1m (minutes).
+max_crawl_duration =
+
+# Minimum interval between two subsequent scheduler runs. Default is 12h.
+# This setting should be expressed as a duration. Examples: 10s (seconds), 1m (minutes).
+scheduler_interval =
diff --git a/roles/grafana/templates/nginx_app.j2 b/roles/grafana/templates/nginx_app.j2
new file mode 100644
index 0000000000000000000000000000000000000000..4b34402a8a9a5aaad410f265bd30288364878c7e
--- /dev/null
+++ b/roles/grafana/templates/nginx_app.j2
@@ -0,0 +1,67 @@
+map $http_user_agent $log_ua {
+  ~Monit 0;
+  default 1;
+}
+
+server {
+  listen 80;
+  listen [::]:80;
+  server_name {{ app_domain | mandatory }};
+  # enforce https
+  return 301 https://$server_name$request_uri;
+}
+
+server {
+  listen 443 ssl http2;
+  listen [::]:443 ssl http2;
+  server_name {{ app_domain }};
+
+  ssl_certificate /etc/letsencrypt/live/{{ app_domain }}/fullchain.pem;
+  ssl_certificate_key /etc/letsencrypt/live/{{ app_domain }}/privkey.pem;
+
+  # Add headers to serve security related headers
+  # Before enabling Strict-Transport-Security headers please read into this
+  # topic first.
+  # add_header Strict-Transport-Security "max-age=15768000;
+  # includeSubDomains; preload;";
+  #
+  # WARNING: Only add the preload option once you read about
+  # the consequences in https://hstspreload.org/. This option
+  # will add the domain to a hardcoded list that is shipped
+  # in all major browsers and getting removed from this list
+  # could take several months.
+
+  add_header X-Content-Type-Options nosniff;
+  add_header X-XSS-Protection "1; mode=block";
+  add_header X-Robots-Tag all; # https://developers.google.com/search/docs/advanced/robots/robots_meta_tag
+  add_header X-Download-Options noopen;
+  add_header X-Permitted-Cross-Domain-Policies none;
+  add_header Strict-Transport-Security "max-age=15768000";
+
+  # Enable gzip but do not remove ETag headers
+  gzip on;
+  gzip_vary on;
+  gzip_comp_level 4;
+  gzip_min_length 256;
+  gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
+  gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
+
+
+  access_log {{ www_log }}/{{ app_instance_id }}/access.log combined if=$log_ua;
+  error_log {{ www_log }}/{{ app_instance_id }}/error.log;
+
+  # set max upload size
+  client_max_body_size 512M;
+  fastcgi_buffers 64 4K;
+
+
+  location / {
+      proxy_set_header HOST $host;
+      proxy_set_header X-Forwarded-Proto https;
+      proxy_set_header X-Real-IP $remote_addr;
+      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header X-Forwarded-Host $server_name;
+      proxy_pass http://localhost:{{ app_main_port }};
+  }
+
+}
diff --git a/roles/grafana/vars/main.yml b/roles/grafana/vars/main.yml
new file mode 100644
index 0000000000000000000000000000000000000000..d416330867f7a7d3b80b521d922f83b1cd5e8f4e
--- /dev/null
+++ b/roles/grafana/vars/main.yml
@@ -0,0 +1,2 @@
+---
+# vars file for prometheus
diff --git a/roles/node-exporter/.ansible-lint b/roles/node-exporter/.ansible-lint
new file mode 100644
index 0000000000000000000000000000000000000000..d1aaa54ffb9d57f16eac2786e6f249dab379c131
--- /dev/null
+++ b/roles/node-exporter/.ansible-lint
@@ -0,0 +1,5 @@
+---
+skip_list:
+  - '106'
+  - '204'
+  - '208'
diff --git a/roles/node-exporter/.gitignore b/roles/node-exporter/.gitignore
new file mode 100644
index 0000000000000000000000000000000000000000..db70ede36781364bd12801220e479d3cd45518e6
--- /dev/null
+++ b/roles/node-exporter/.gitignore
@@ -0,0 +1,7 @@
+*.retry
+*.log
+.molecule
+.cache
+__pycache__/
+.pytest_cache
+.tox
diff --git a/roles/node-exporter/.mergify.yml b/roles/node-exporter/.mergify.yml
new file mode 100644
index 0000000000000000000000000000000000000000..b73910586a6efaaf249442758626ef194aae746b
--- /dev/null
+++ b/roles/node-exporter/.mergify.yml
@@ -0,0 +1,16 @@
+---
+pull_request_rules:
+  - name: automatic merge and new release from cloudalchemybot
+    conditions:
+      - "status-success=Travis CI - Pull Request"
+      - status-success=WIP
+      - head~=autoupdate|skeleton
+      - author=cloudalchemybot
+    actions:
+      merge:
+        method: squash
+        strict: true
+  - name: delete head branch after merge
+    conditions: []
+    actions:
+      delete_head_branch: {}
diff --git a/roles/node-exporter/.yamllint b/roles/node-exporter/.yamllint
new file mode 100644
index 0000000000000000000000000000000000000000..8f2e1fa2cd6e180353c589325c8f25c50f97f302
--- /dev/null
+++ b/roles/node-exporter/.yamllint
@@ -0,0 +1,14 @@
+---
+extends: default
+ignore: |
+  .github/
+  meta/
+
+rules:
+  braces:
+    max-spaces-inside: 1
+    level: error
+  brackets:
+    max-spaces-inside: 1
+    level: error
+  line-length: disable
diff --git a/roles/node-exporter/CHANGELOG.md b/roles/node-exporter/CHANGELOG.md
new file mode 100644
index 0000000000000000000000000000000000000000..654322d2270664279be1c3dd241582cdb39833cd
--- /dev/null
+++ b/roles/node-exporter/CHANGELOG.md
@@ -0,0 +1,580 @@
+# Change Log
+
+## [**Next release**](https://galaxy.ansible.com/cloudalchemy/node_exporter)
+
+## [2.0.0] - 2021-04-19
+**Merged pull requests:**
+
+- Merge pull request [#219](https://github.com/cloudalchemy/ansible-node-exporter/issues/219) from cloudalchemy/skeleton
+- :robot: sync with cloudalchemy/skeleton (SHA: 5ca88c27): Merge pull request [#9](https://github.com/cloudalchemy/ansible-node-exporter/issues/9) from cloudalchemy/superq/more_updates
+
+
+## [1.0.0] - 2021-04-11
+**Merged pull requests:**
+
+- Merge pull request [#214](https://github.com/cloudalchemy/ansible-node-exporter/issues/214) from cloudalchemy/superq/envs
+- Merge pull request [#213](https://github.com/cloudalchemy/ansible-node-exporter/issues/213) from cloudalchemy/superq/chglog
+- Merge pull request [#212](https://github.com/cloudalchemy/ansible-node-exporter/issues/212) from cloudalchemy/superq/publisher_image
+- Merge pull request [#209](https://github.com/cloudalchemy/ansible-node-exporter/issues/209) from cloudalchemy/autoupdate
+- Merge pull request [#208](https://github.com/cloudalchemy/ansible-node-exporter/issues/208) from cloudalchemy/autoupdate
+- Merge pull request [#207](https://github.com/cloudalchemy/ansible-node-exporter/issues/207) from nop33/fix-typos
+- Merge pull request [#206](https://github.com/cloudalchemy/ansible-node-exporter/issues/206) from cloudalchemy/paulfantom-patch-1
+- Merge pull request [#204](https://github.com/cloudalchemy/ansible-node-exporter/issues/204) from cloudalchemy/bjk/update_requirements
+- Merge pull request [#202](https://github.com/cloudalchemy/ansible-node-exporter/issues/202) from cloudalchemy/autoupdate
+- Merge pull request [#197](https://github.com/cloudalchemy/ansible-node-exporter/issues/197) from cloudalchemy/paulfantom/fix-release
+- Merge pull request [#196](https://github.com/cloudalchemy/ansible-node-exporter/issues/196) from kmille/master
+- Merge pull request [#195](https://github.com/cloudalchemy/ansible-node-exporter/issues/195) from cloudalchemy/paulfantom/scenario-latest
+- Merge pull request [#182](https://github.com/cloudalchemy/ansible-node-exporter/issues/182) from parmsib/patch-1
+- Merge pull request [#187](https://github.com/cloudalchemy/ansible-node-exporter/issues/187) from cloudalchemy/superq/internal_defaults
+- Merge pull request [#193](https://github.com/cloudalchemy/ansible-node-exporter/issues/193) from cloudalchemy/paulfantom-patch-1
+- Merge pull request [#188](https://github.com/cloudalchemy/ansible-node-exporter/issues/188) from ctrlaltdel/master
+- Merge pull request [#191](https://github.com/cloudalchemy/ansible-node-exporter/issues/191) from cloudalchemy/superq/circle_release
+- Merge pull request [#190](https://github.com/cloudalchemy/ansible-node-exporter/issues/190) from cloudalchemy/superq/circleci
+- Merge pull request [#189](https://github.com/cloudalchemy/ansible-node-exporter/issues/189) from cloudalchemy/moleculev3
+- Merge pull request [#184](https://github.com/cloudalchemy/ansible-node-exporter/issues/184) from thdhondt/patch-1
+
+
+## [0.22.0] - 2020-10-02
+### Chore
+- troubleshooting document
+
+**Merged pull requests:**
+
+- Merge pull request [#179](https://github.com/cloudalchemy/ansible-node-exporter/issues/179) from kklimonda/master
+- Merge pull request [#178](https://github.com/cloudalchemy/ansible-node-exporter/issues/178) from FilippoProjetto/patch-1
+- Merge pull request [#172](https://github.com/cloudalchemy/ansible-node-exporter/issues/172) from pngmbh/troubleshooting
+
+
+## [0.21.5] - 2020-07-21
+**Merged pull requests:**
+
+- Merge pull request [#170](https://github.com/cloudalchemy/ansible-node-exporter/issues/170) from bittopaz/patch-1
+
+
+## [0.21.4] - 2020-07-20
+**Merged pull requests:**
+
+- Merge pull request [#169](https://github.com/cloudalchemy/ansible-node-exporter/issues/169) from cloudalchemy/superq/localhost_checksums
+
+
+## [0.21.3] - 2020-06-18
+**Merged pull requests:**
+
+- Merge pull request [#163](https://github.com/cloudalchemy/ansible-node-exporter/issues/163) from sengel/missing_backslash
+
+
+## [0.21.2] - 2020-06-18
+**Merged pull requests:**
+
+- always import install.yml when using local dir ([#162](https://github.com/cloudalchemy/ansible-node-exporter/issues/162))
+
+
+## [0.21.1] - 2020-06-17
+**Merged pull requests:**
+
+- New prometheus/node_exporter upstream release! ([#159](https://github.com/cloudalchemy/ansible-node-exporter/issues/159))
+
+
+## [0.21.0] - 2020-05-31
+**Merged pull requests:**
+
+- *: add support for node_exporter TLS settings ([#156](https://github.com/cloudalchemy/ansible-node-exporter/issues/156))
+
+
+## [0.20.0] - 2020-04-30
+**Merged pull requests:**
+
+- Use symbolic permissions for textfile collector dir ([#150](https://github.com/cloudalchemy/ansible-node-exporter/issues/150))
+- :robot: sync with cloudalchemy/skeleton (SHA: 40e7ce18): lock molecule to v2 ([#149](https://github.com/cloudalchemy/ansible-node-exporter/issues/149))
+- always validate GitHub certificate as there is no reason not to… ([#148](https://github.com/cloudalchemy/ansible-node-exporter/issues/148))
+- Install 'policycoreutils-python' on redhat/centos < 8 and fedora… ([#145](https://github.com/cloudalchemy/ansible-node-exporter/issues/145))
+- Add quotes to node_exporter parametrs in systemd service ([#144](https://github.com/cloudalchemy/ansible-node-exporter/issues/144))
+
+
+## [0.19.0] - 2020-01-31
+**Merged pull requests:**
+
+- remove system user management and convert variables to internal ones ([#142](https://github.com/cloudalchemy/ansible-node-exporter/issues/142))
+- Do not manage system directories ([#140](https://github.com/cloudalchemy/ansible-node-exporter/issues/140))
+- Add binary install directory ([#137](https://github.com/cloudalchemy/ansible-node-exporter/issues/137))
+
+
+## [0.18.0] - 2020-01-16
+**Merged pull requests:**
+
+- :robot: sync with cloudalchemy/skeleton (SHA: 69fc5be8): Merge pull request [#4](https://github.com/cloudalchemy/ansible-node-exporter/issues/4) from cloudalchemy/travis_fix ([#138](https://github.com/cloudalchemy/ansible-node-exporter/issues/138))
+- :robot: sync with cloudalchemy/skeleton (SHA: f4521f6a): use latest available python ([#136](https://github.com/cloudalchemy/ansible-node-exporter/issues/136))
+- Fix syntax on SELinux installation for clearlinux ([#134](https://github.com/cloudalchemy/ansible-node-exporter/issues/134))
+- tasks,vars: move selinux package dependencies into separate tasks to allow potential ootb support for more OSes ([#132](https://github.com/cloudalchemy/ansible-node-exporter/issues/132))
+- :robot: sync with cloudalchemy/skeleton (SHA: bb0f0949): remove IRC link ([#133](https://github.com/cloudalchemy/ansible-node-exporter/issues/133))
+- Updated README.md ([#129](https://github.com/cloudalchemy/ansible-node-exporter/issues/129))
+- add option to propagate binaries without access to internet ([#126](https://github.com/cloudalchemy/ansible-node-exporter/issues/126))
+- [REPO SYNC] add declarative label sync; add autolabelling PRs ([#123](https://github.com/cloudalchemy/ansible-node-exporter/issues/123))
+
+
+## [0.17.0] - 2019-11-14
+**Merged pull requests:**
+
+- [REPO SYNC] molecule: use CI images from quay.io instead of dock… ([#121](https://github.com/cloudalchemy/ansible-node-exporter/issues/121))
+- tasks: remove already covered entries when choosing an OS specific vars ([#118](https://github.com/cloudalchemy/ansible-node-exporter/issues/118))
+- Run preflight tasks to register variables when check_mode is enabled ([#117](https://github.com/cloudalchemy/ansible-node-exporter/issues/117))
+- tasks: do not touch any settings of system directory /usr/local/bin ([#116](https://github.com/cloudalchemy/ansible-node-exporter/issues/116))
+- [REPO SYNC] Update releaser.sh ([#120](https://github.com/cloudalchemy/ansible-node-exporter/issues/120))
+- [REPO SYNC] add support for CentOS8 ([#119](https://github.com/cloudalchemy/ansible-node-exporter/issues/119))
+
+
+## [0.16.0] - 2019-10-18
+**Merged pull requests:**
+
+- add official support for CentOS8 ([#114](https://github.com/cloudalchemy/ansible-node-exporter/issues/114))
+- molecule/default/tests: test if permissions of other files are u… ([#112](https://github.com/cloudalchemy/ansible-node-exporter/issues/112))
+- tasks: do not use alias for createhome as it seems to be broken ([#111](https://github.com/cloudalchemy/ansible-node-exporter/issues/111))
+
+
+## [0.15.0] - 2019-09-11
+**Merged pull requests:**
+
+- add RHEL8 and debian buster support; remove testing on debian jessie ([#101](https://github.com/cloudalchemy/ansible-node-exporter/issues/101))
+- Synchronize files from cloudalchemy/skeleton ([#102](https://github.com/cloudalchemy/ansible-node-exporter/issues/102))
+- :robot: synchronize with last commit in cloudalchemy/skeleton (SHA: 1f68dc21) ([#100](https://github.com/cloudalchemy/ansible-node-exporter/issues/100))
+- Moving to python 3 and dropping support for python 2.x (on deploy… ([#99](https://github.com/cloudalchemy/ansible-node-exporter/issues/99))
+- :robot: synchronize files from cloudalchemy/skeleton ([#97](https://github.com/cloudalchemy/ansible-node-exporter/issues/97))
+- added restartsec and startlimitinterval configurations ([#96](https://github.com/cloudalchemy/ansible-node-exporter/issues/96))
+- preflight: Fix detection of systemd version for systemd 240+ ([#93](https://github.com/cloudalchemy/ansible-node-exporter/issues/93))
+- Updated README with correct default value ([#92](https://github.com/cloudalchemy/ansible-node-exporter/issues/92))
+- node_exporter version check ([#91](https://github.com/cloudalchemy/ansible-node-exporter/issues/91))
+
+
+## [0.14.0] - 2019-06-05
+**Merged pull requests:**
+
+- Fix wrong size of /home shown by node-exporter ([#87](https://github.com/cloudalchemy/ansible-node-exporter/issues/87))
+- :tada: automated upstream release update ([#90](https://github.com/cloudalchemy/ansible-node-exporter/issues/90))
+- make node_exporter executable file root-owned ([#89](https://github.com/cloudalchemy/ansible-node-exporter/issues/89))
+- Add retries to package installs ([#88](https://github.com/cloudalchemy/ansible-node-exporter/issues/88))
+- Create suse.yml ([#86](https://github.com/cloudalchemy/ansible-node-exporter/issues/86))
+- New prometheus/node_exporter upstream release! ([#85](https://github.com/cloudalchemy/ansible-node-exporter/issues/85))
+- Synchronize files from cloudalchemy/skeleton ([#84](https://github.com/cloudalchemy/ansible-node-exporter/issues/84))
+
+
+## [0.13.1] - 2019-05-04
+**Merged pull requests:**
+
+- Fix systemd service startup ordering ([#83](https://github.com/cloudalchemy/ansible-node-exporter/issues/83))
+
+
+## [0.13.0] - 2019-04-01
+**Merged pull requests:**
+
+- fix preflight check responsible for collector enablement ([#81](https://github.com/cloudalchemy/ansible-node-exporter/issues/81))
+- Refactor preflight checks ([#79](https://github.com/cloudalchemy/ansible-node-exporter/issues/79))
+- make SELinux settings ipv6 compatible ([#78](https://github.com/cloudalchemy/ansible-node-exporter/issues/78))
+- fix(tasks/configure.yml): typo in task name ([#77](https://github.com/cloudalchemy/ansible-node-exporter/issues/77))
+- Add systemd state to started for first run of the role ([#72](https://github.com/cloudalchemy/ansible-node-exporter/issues/72))
+- reintroduce user management into defaults and add testing user creation ([#74](https://github.com/cloudalchemy/ansible-node-exporter/issues/74))
+
+
+## [0.12.1] - 2019-02-19
+**Merged pull requests:**
+
+- Correctly enable extra collectors ([#70](https://github.com/cloudalchemy/ansible-node-exporter/issues/70))
+- Lock down systemd service ([#68](https://github.com/cloudalchemy/ansible-node-exporter/issues/68))
+
+
+## [0.12.0] - 2018-12-17
+**Merged pull requests:**
+
+- Better tags and configuration handling ([#66](https://github.com/cloudalchemy/ansible-node-exporter/issues/66))
+- simplify automated CPU arch choosing ([#64](https://github.com/cloudalchemy/ansible-node-exporter/issues/64))
+- add alternative tests ([#65](https://github.com/cloudalchemy/ansible-node-exporter/issues/65))
+
+
+## [0.11.4] - 2018-12-05
+**Merged pull requests:**
+
+- Add support for multi-line ansible_managed strings ([#63](https://github.com/cloudalchemy/ansible-node-exporter/issues/63))
+
+
+## [0.11.3] - 2018-12-03
+**Merged pull requests:**
+
+- New node_exporter upstream release! ([#62](https://github.com/cloudalchemy/ansible-node-exporter/issues/62))
+- Remove setting niceness in systemd service file ([#60](https://github.com/cloudalchemy/ansible-node-exporter/issues/60))
+
+
+## [0.11.2] - 2018-10-08
+**Merged pull requests:**
+
+- move to ansible 2.7 ([#58](https://github.com/cloudalchemy/ansible-node-exporter/issues/58))
+
+
+## [0.11.1] - 2018-10-04
+**Merged pull requests:**
+
+- do not set specific capabilities ([#57](https://github.com/cloudalchemy/ansible-node-exporter/issues/57))
+
+
+## [0.11.0] - 2018-09-19
+**Merged pull requests:**
+
+- Add support for Clear linux ([#55](https://github.com/cloudalchemy/ansible-node-exporter/issues/55))
+- make textfile dir writable by node-exp group ([#56](https://github.com/cloudalchemy/ansible-node-exporter/issues/56))
+
+
+## [0.10.2] - 2018-09-06
+**Merged pull requests:**
+
+- reload-daemon on systemd enable ([#53](https://github.com/cloudalchemy/ansible-node-exporter/issues/53))
+
+
+## [0.10.1] - 2018-08-15
+**Merged pull requests:**
+
+- download checksum file only once ([#51](https://github.com/cloudalchemy/ansible-node-exporter/issues/51))
+
+
+## [0.10.0] - 2018-07-15
+**Merged pull requests:**
+
+- import_tasks instead of include; bringing role up to ansible-prometheus standards; minor changes ([#48](https://github.com/cloudalchemy/ansible-node-exporter/issues/48))
+
+
+## [0.9.0] - 2018-07-01
+**Merged pull requests:**
+
+- ansible 2.6 + allow remote docker host ([#46](https://github.com/cloudalchemy/ansible-node-exporter/issues/46))
+- use tox for running test matrix ([#45](https://github.com/cloudalchemy/ansible-node-exporter/issues/45))
+
+
+## [0.8.0] - 2018-06-10
+**Merged pull requests:**
+
+- Add support for textfile collector ([#42](https://github.com/cloudalchemy/ansible-node-exporter/issues/42))
+
+
+## [0.7.0] - 2018-06-10
+**Merged pull requests:**
+
+- Install newer node_exporter by default ([#36](https://github.com/cloudalchemy/ansible-node-exporter/issues/36))
+- specify file name for dest in get_url call ([#40](https://github.com/cloudalchemy/ansible-node-exporter/issues/40))
+
+
+## [0.6.20] - 2018-05-27
+**Merged pull requests:**
+
+- Fix architecture var parsing ([#39](https://github.com/cloudalchemy/ansible-node-exporter/issues/39))
+- Offer a better IRC Web clients to users ([#38](https://github.com/cloudalchemy/ansible-node-exporter/issues/38))
+
+
+## [0.6.19] - 2018-05-23
+**Merged pull requests:**
+
+- Fix failing role on non-SELinux RedHat ([#37](https://github.com/cloudalchemy/ansible-node-exporter/issues/37))
+- split download and unarchive and add checksum validation ([#35](https://github.com/cloudalchemy/ansible-node-exporter/issues/35))
+- move to molecule 2.x ([#34](https://github.com/cloudalchemy/ansible-node-exporter/issues/34))
+
+
+## [0.6.18] - 2018-04-13
+**Merged pull requests:**
+
+- Merge pull request [#33](https://github.com/cloudalchemy/ansible-node-exporter/issues/33) from nikosgraser/master
+
+
+## [0.6.17] - 2018-04-12
+**Merged pull requests:**
+
+- Merge pull request [#32](https://github.com/cloudalchemy/ansible-node-exporter/issues/32) from Porkepix/skip_capabilities_check_mode
+
+
+## [0.6.16] - 2018-04-06
+**Merged pull requests:**
+
+- Merge pull request [#31](https://github.com/cloudalchemy/ansible-node-exporter/issues/31) from Porkepix/fix_tests_as_filter
+- Merge pull request [#30](https://github.com/cloudalchemy/ansible-node-exporter/issues/30) from Porkepix/fix_gitignore
+
+
+## [0.6.15] - 2018-04-05
+
+## [0.6.14] - 2018-04-02
+**Merged pull requests:**
+
+- retry downloads ([#29](https://github.com/cloudalchemy/ansible-node-exporter/issues/29))
+
+
+## [0.6.13] - 2018-03-30
+**Merged pull requests:**
+
+- Merge pull request [#28](https://github.com/cloudalchemy/ansible-node-exporter/issues/28) from Porkepix/fix-check_mode
+
+
+## [0.6.12] - 2018-03-26
+**Merged pull requests:**
+
+- Merge pull request [#26](https://github.com/cloudalchemy/ansible-node-exporter/issues/26) from cloudalchemy/bionic
+
+
+## [0.6.11] - 2018-03-24
+**Merged pull requests:**
+
+- Merge pull request [#27](https://github.com/cloudalchemy/ansible-node-exporter/issues/27) from cloudalchemy/new_ansible
+
+
+## [0.6.10] - 2018-03-05
+**Merged pull requests:**
+
+- Merge pull request [#25](https://github.com/cloudalchemy/ansible-node-exporter/issues/25) from swesterveld/fix-warning-jinja-templating-delimiters
+
+
+## [0.6.9] - 2018-02-18
+**Merged pull requests:**
+
+- Merge pull request [#24](https://github.com/cloudalchemy/ansible-node-exporter/issues/24) from cloudalchemy/fedora_support
+- resolve [#18](https://github.com/cloudalchemy/ansible-node-exporter/issues/18)
+
+
+## [0.6.8] - 2018-02-14
+**Merged pull requests:**
+
+- Merge pull request [#23](https://github.com/cloudalchemy/ansible-node-exporter/issues/23) from swesterveld/fix_daemon_reload_for_role_include
+
+
+## [0.6.7] - 2018-01-14
+**Merged pull requests:**
+
+- custom dockerfiles; support more OSes ([#21](https://github.com/cloudalchemy/ansible-node-exporter/issues/21))
+
+
+## [0.6.6] - 2018-01-13
+**Merged pull requests:**
+
+- Add preflight checks ([#22](https://github.com/cloudalchemy/ansible-node-exporter/issues/22))
+
+
+## [0.6.5] - 2018-01-13
+**Merged pull requests:**
+
+- Merge pull request [#20](https://github.com/cloudalchemy/ansible-node-exporter/issues/20) from cloudalchemy/paulfantom-patch-1
+
+
+## [0.6.4] - 2018-01-09
+**Merged pull requests:**
+
+- Merge pull request [#19](https://github.com/cloudalchemy/ansible-node-exporter/issues/19) from cloudalchemy/issue17
+
+
+## [0.6.3] - 2018-01-08
+
+## [0.6.2] - 2018-01-06
+**Merged pull requests:**
+
+- Merge pull request [#15](https://github.com/cloudalchemy/ansible-node-exporter/issues/15) from cloudalchemy/minor_fix
+
+
+## [0.6.1] - 2018-01-04
+**Merged pull requests:**
+
+- Merge pull request [#14](https://github.com/cloudalchemy/ansible-node-exporter/issues/14) from cloudalchemy/paulfantom-patch-1
+- Merge pull request [#13](https://github.com/cloudalchemy/ansible-node-exporter/issues/13) from cloudalchemy/docs
+
+
+## [0.6.0] - 2018-01-02
+**Merged pull requests:**
+
+- Merge pull request [#12](https://github.com/cloudalchemy/ansible-node-exporter/issues/12) from cloudalchemy/paulfantom-patch-1
+
+
+## [0.5.11] - 2018-01-02
+**Merged pull requests:**
+
+- Merge pull request [#11](https://github.com/cloudalchemy/ansible-node-exporter/issues/11) from cloudalchemy/raspberrypi
+
+
+## [0.5.10] - 2018-01-01
+**Merged pull requests:**
+
+- Merge pull request [#10](https://github.com/cloudalchemy/ansible-node-exporter/issues/10) from cloudalchemy/disabled_collectors
+
+
+## [0.5.9] - 2017-12-27
+**Merged pull requests:**
+
+- Merge pull request [#9](https://github.com/cloudalchemy/ansible-node-exporter/issues/9) from anisse/patch-1
+
+
+## [0.5.8] - 2017-12-27
+**Merged pull requests:**
+
+- Merge pull request [#8](https://github.com/cloudalchemy/ansible-node-exporter/issues/8) from anisse/patch-3
+
+
+## [0.5.7] - 2017-12-15
+**Merged pull requests:**
+
+- Merge pull request [#6](https://github.com/cloudalchemy/ansible-node-exporter/issues/6) from cloudalchemy/go_arch
+- Merge pull request [#7](https://github.com/cloudalchemy/ansible-node-exporter/issues/7) from cloudalchemy/version
+
+
+## [0.5.6] - 2017-12-06
+**Merged pull requests:**
+
+- Merge pull request [#4](https://github.com/cloudalchemy/ansible-node-exporter/issues/4) from cloudalchemy/paulfantom-patch-1
+
+
+## [0.5.5] - 2017-11-30
+
+## [0.5.4] - 2017-11-30
+
+## [0.5.3] - 2017-11-29
+**Merged pull requests:**
+
+- Merge pull request [#1](https://github.com/cloudalchemy/ansible-node-exporter/issues/1) from cloudalchemy/ci
+
+
+## [0.5.1] - 2017-11-09
+**Merged pull requests:**
+
+- Merge pull request [#10](https://github.com/cloudalchemy/ansible-node-exporter/issues/10) from SoInteractive/version_upgrade
+
+
+## [0.5.0] - 2017-10-16
+**Merged pull requests:**
+
+- Merge pull request [#9](https://github.com/cloudalchemy/ansible-node-exporter/issues/9) from SoInteractive/feature_travis
+
+
+## [0.4.3] - 2017-10-12
+**Merged pull requests:**
+
+- Merge pull request [#8](https://github.com/cloudalchemy/ansible-node-exporter/issues/8) from SoInteractive/Add_selinux
+
+
+## [0.4.2] - 2017-10-05
+**Merged pull requests:**
+
+- Merge pull request [#7](https://github.com/cloudalchemy/ansible-node-exporter/issues/7) from SoInteractive/systemd
+
+
+## [0.4.1] - 2017-09-26
+**Merged pull requests:**
+
+- Merge pull request [#6](https://github.com/cloudalchemy/ansible-node-exporter/issues/6) from SoInteractive/fix_typo
+
+
+## [0.4.0] - 2017-09-20
+**Merged pull requests:**
+
+- Merge pull request [#5](https://github.com/cloudalchemy/ansible-node-exporter/issues/5) from paulfantom/feature_installation
+
+
+## [0.3.3] - 2017-08-09
+
+## [0.3.4] - 2017-08-09
+**Merged pull requests:**
+
+- Merge pull request [#4](https://github.com/cloudalchemy/ansible-node-exporter/issues/4) from SoInteractive/testing_branch
+
+
+## [0.3.2] - 2017-07-26
+
+## [0.3.1] - 2017-07-26
+**Merged pull requests:**
+
+- Merge pull request [#3](https://github.com/cloudalchemy/ansible-node-exporter/issues/3) from SoInteractive/fix_user_uid
+
+
+## [0.3.0] - 2017-07-21
+
+## [0.2.0] - 2017-07-21
+**Merged pull requests:**
+
+- Merge pull request [#2](https://github.com/cloudalchemy/ansible-node-exporter/issues/2) from SoInteractive/feature_autoupdate_minor
+
+
+## [0.1.2] - 2017-06-14
+
+## [0.1.1] - 2017-06-14
+
+## [0.1.0] - 2017-06-06
+
+## [0.0.2] - 2017-05-18
+
+## 0.0.1 - 2017-05-04
+
+[Unreleased]: https://github.com/cloudalchemy/ansible-node-exporter/compare/2.0.0...HEAD
+[2.0.0]: https://github.com/cloudalchemy/ansible-node-exporter/compare/1.0.0...2.0.0
+[1.0.0]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.22.0...1.0.0
+[0.22.0]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.21.5...0.22.0
+[0.21.5]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.21.4...0.21.5
+[0.21.4]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.21.3...0.21.4
+[0.21.3]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.21.2...0.21.3
+[0.21.2]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.21.1...0.21.2
+[0.21.1]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.21.0...0.21.1
+[0.21.0]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.20.0...0.21.0
+[0.20.0]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.19.0...0.20.0
+[0.19.0]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.18.0...0.19.0
+[0.18.0]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.17.0...0.18.0
+[0.17.0]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.16.0...0.17.0
+[0.16.0]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.15.0...0.16.0
+[0.15.0]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.14.0...0.15.0
+[0.14.0]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.13.1...0.14.0
+[0.13.1]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.13.0...0.13.1
+[0.13.0]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.12.1...0.13.0
+[0.12.1]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.12.0...0.12.1
+[0.12.0]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.11.4...0.12.0
+[0.11.4]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.11.3...0.11.4
+[0.11.3]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.11.2...0.11.3
+[0.11.2]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.11.1...0.11.2
+[0.11.1]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.11.0...0.11.1
+[0.11.0]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.10.2...0.11.0
+[0.10.2]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.10.1...0.10.2
+[0.10.1]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.10.0...0.10.1
+[0.10.0]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.9.0...0.10.0
+[0.9.0]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.8.0...0.9.0
+[0.8.0]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.7.0...0.8.0
+[0.7.0]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.6.20...0.7.0
+[0.6.20]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.6.19...0.6.20
+[0.6.19]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.6.18...0.6.19
+[0.6.18]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.6.17...0.6.18
+[0.6.17]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.6.16...0.6.17
+[0.6.16]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.6.15...0.6.16
+[0.6.15]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.6.14...0.6.15
+[0.6.14]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.6.13...0.6.14
+[0.6.13]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.6.12...0.6.13
+[0.6.12]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.6.11...0.6.12
+[0.6.11]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.6.10...0.6.11
+[0.6.10]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.6.9...0.6.10
+[0.6.9]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.6.8...0.6.9
+[0.6.8]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.6.7...0.6.8
+[0.6.7]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.6.6...0.6.7
+[0.6.6]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.6.5...0.6.6
+[0.6.5]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.6.4...0.6.5
+[0.6.4]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.6.3...0.6.4
+[0.6.3]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.6.2...0.6.3
+[0.6.2]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.6.1...0.6.2
+[0.6.1]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.6.0...0.6.1
+[0.6.0]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.5.11...0.6.0
+[0.5.11]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.5.10...0.5.11
+[0.5.10]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.5.9...0.5.10
+[0.5.9]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.5.8...0.5.9
+[0.5.8]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.5.7...0.5.8
+[0.5.7]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.5.6...0.5.7
+[0.5.6]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.5.5...0.5.6
+[0.5.5]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.5.4...0.5.5
+[0.5.4]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.5.3...0.5.4
+[0.5.3]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.5.1...0.5.3
+[0.5.1]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.5.0...0.5.1
+[0.5.0]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.4.3...0.5.0
+[0.4.3]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.4.2...0.4.3
+[0.4.2]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.4.1...0.4.2
+[0.4.1]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.4.0...0.4.1
+[0.4.0]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.3.3...0.4.0
+[0.3.3]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.3.4...0.3.3
+[0.3.4]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.3.2...0.3.4
+[0.3.2]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.3.1...0.3.2
+[0.3.1]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.3.0...0.3.1
+[0.3.0]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.2.0...0.3.0
+[0.2.0]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.1.2...0.2.0
+[0.1.2]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.1.1...0.1.2
+[0.1.1]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.1.0...0.1.1
+[0.1.0]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.0.2...0.1.0
+[0.0.2]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.0.1...0.0.2
diff --git a/roles/node-exporter/CONTRIBUTING.md b/roles/node-exporter/CONTRIBUTING.md
new file mode 100644
index 0000000000000000000000000000000000000000..f922673f2e8cbc42eb43a10c7390cf4361422ca6
--- /dev/null
+++ b/roles/node-exporter/CONTRIBUTING.md
@@ -0,0 +1,98 @@
+# Contributor Guideline
+
+This document provides an overview of how you can participate in improving this project or extending it. We are
+grateful for all your help: bug reports and fixes, code contributions, documentation or ideas. Feel free to join, we 
+appreciate your support!!
+
+## Communication
+
+### GitHub repositories
+
+Much of the issues, goals and ideas are tracked in the respective projects in GitHub. Please use this channel to report
+bugs, ask questions, and request new features .
+
+## git and GitHub
+
+In order to contribute code please:
+
+1. Fork the project on GitHub
+2. Clone the project
+3. Add changes (and tests)
+4. Commit and push
+5. Create a merge-request
+
+To have your code merged, see the expectations listed below.
+
+You can find a well-written guide [here](https://help.github.com/articles/fork-a-repo).
+
+Please follow common commit best-practices. Be explicit, have a short summary, a well-written description and
+references. This is especially important for the merge-request.
+
+Some great guidelines can be found [here](https://wiki.openstack.org/wiki/GitCommitMessages) and
+[here](http://robots.thoughtbot.com/5-useful-tips-for-a-better-commit-message).
+
+## Releases
+
+We try to stick to semantic versioning and our releases are automated. Release is created by assigning a keyword (in a
+way similar to circle ci keyword [`[ci skip]`](https://docs.travis-ci.com/user/customizing-the-build#Skipping-a-build))
+to a commit with merge request. Available keywords are (square brackets are important!):
+ 
+* `[patch]`, `[fix]`, `[bugfix]` - for PATCH version release
+* `[minor]`, `[feature]`, `[feat]` - for MINOR version release
+* `[major]`, `[breaking change]` - for MAJOR version release
+ 
+## Changelog
+ 
+Changelog is generated automatically during release process and all information is taken from github issues, PRs and
+labels.
+
+## Expectations
+
+### Keep it simple
+
+We try to provide production ready ansible roles which should be as much zero-conf as possible but this doesn't mean to
+overcomplicate things. Just follow [KISS](https://en.wikipedia.org/wiki/KISS_principle).
+
+### Be explicit
+
+* Please avoid using nonsensical property and variable names.
+* Use self-describing attribute names for user configuration.
+* In case of failures, communicate what happened and why a failure occurs to the user. Make it easy to track the code
+or action that produced the error. Try to catch and handle errors if possible to provide improved failure messages.
+
+
+### Add tests
+
+We are striving to use at least two test scenarios located in [/molecule](molecule) directory. First one
+([default](molecule/default)) is testing default configuration without any additional variables, second one 
+([alternative](molecule/alternative)) is testing what happens when many variables from 
+[/defaults/main.yml](defaults/main.yml) are changed. When adding new functionalities please add tests to proper
+scenarios. Tests are written in testinfra framework and are located in `/tests` subdirectory of scenario directory
+(for example default tests are in [/molecule/default/tests](molecule/default/tests)).
+More information about:
+  - [testinfra](http://testinfra.readthedocs.io/en/latest/index.html)
+  - [molecule](https://molecule.readthedocs.io/en/latest/index.html)
+
+### Follow best practices
+
+Please follow [ansible best practices](http://docs.ansible.com/ansible/latest/playbooks_best_practices.html) and
+especially provide meaningful names to tasks and even comments where needed.
+
+Our test framework automatically lints code with [`yamllint`](https://github.com/adrienverge/yamllint),
+[`ansible-lint`](https://github.com/willthames/ansible-lint), and [`flake8`](https://gitlab.com/pycqa/flake8) programs
+so be sure to follow their rules.
+
+Remember: Code is generally read much more often than written.
+
+### Use Markdown
+
+Wherever possible, please refrain from any other formats and stick to simple markdown.
+
+## Requirements regarding roles design 
+
+We are trying to create the best and most secure installation method for non-containerized prometheus stack components.
+To accomplish this all roles need to support:
+
+- current and at least one previous ansible version
+- systemd as the only available process manager
+- at least latest debian and CentOS distributions
diff --git a/roles/node-exporter/LICENSE b/roles/node-exporter/LICENSE
new file mode 100644
index 0000000000000000000000000000000000000000..2b1b2c03e224bb4acb5d55e88a351018b961098a
--- /dev/null
+++ b/roles/node-exporter/LICENSE
@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2017-2018 Pawel Krupa and Roman Demachkovych
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/roles/node-exporter/README.md b/roles/node-exporter/README.md
new file mode 100644
index 0000000000000000000000000000000000000000..df501076e3f6da4be1b5a7c9b5bbfbf630b24eea
--- /dev/null
+++ b/roles/node-exporter/README.md
@@ -0,0 +1,108 @@
+
+############# Repris du rôle de Cloud Alchemy https://github.com/cloudalchemy/ansible-node-exporter
+
+
+<p><img src="https://www.circonus.com/wp-content/uploads/2015/03/sol-icon-itOps.png" alt="graph logo" title="graph" align="right" height="60" /></p>
+
+# Ansible Role: node exporter
+
+[![Build Status](https://travis-ci.org/cloudalchemy/ansible-node-exporter.svg?branch=master)](https://travis-ci.org/cloudalchemy/ansible-node-exporter)
+[![License](https://img.shields.io/badge/license-MIT%20License-brightgreen.svg)](https://opensource.org/licenses/MIT)
+[![Ansible Role](https://img.shields.io/badge/ansible%20role-cloudalchemy.node_exporter-blue.svg)](https://galaxy.ansible.com/cloudalchemy/node_exporter/)
+[![GitHub tag](https://img.shields.io/github/tag/cloudalchemy/ansible-node-exporter.svg)](https://github.com/cloudalchemy/ansible-node-exporter/tags)
+
+## Warning
+
+Due to limitations of galaxy.ansible.com we had to move the role to https://galaxy.ansible.com/cloudalchemy/node_exporter and use `_` instead of `-` in role name. This is a breaking change and unfortunately, it affects all versions of node_exporter role as ansible galaxy doesn't offer any form of redirection. We are sorry for the inconvenience.
+
+## Description
+
+Deploy prometheus [node exporter](https://github.com/prometheus/node_exporter) using ansible.
+
+## Requirements
+
+- Ansible >= 2.7 (It might work on previous versions, but we cannot guarantee it)
+- gnu-tar on Mac deployer host (`brew install gnu-tar`)
+- Passlib is required when using the basic authentication feature (`pip install passlib[bcrypt]`)
+
+## Role Variables
+
+All variables which can be overridden are stored in [defaults/main.yml](defaults/main.yml) and are listed in the table below.
+
+| Name           | Default Value | Description                        |
+| -------------- | ------------- | -----------------------------------|
+| `node_exporter_version` | 1.1.2 | Node exporter package version. Also accepts latest as parameter. |
+| `node_exporter_binary_local_dir` | "" | Enables the use of local packages instead of those distributed on github. The parameter may be set to a directory where the `node_exporter` binary is stored on the host where ansible is run. This overrides the `node_exporter_version` parameter |
+| `app_main_port` | "9100" | Port on which node exporter will listen |
+| `node_exporter_web_telemetry_path` | "/metrics" | Path under which to expose metrics |
+| `node_exporter_enabled_collectors` | ```["systemd",{textfile: {directory: "{{node_exporter_textfile_dir}}"}}]``` | List of dicts defining additionally enabled collectors and their configuration. It adds collectors to [those enabled by default](https://github.com/prometheus/node_exporter#enabled-by-default). |
+| `node_exporter_disabled_collectors` | [] | List of disabled collectors. By default node_exporter disables collectors listed [here](https://github.com/prometheus/node_exporter#disabled-by-default). |
+| `node_exporter_textfile_dir` | "/var/lib/node_exporter" | Directory used by the [Textfile Collector](https://github.com/prometheus/node_exporter#textfile-collector). To get permissions to write metrics in this directory, users must be in `node-exp` system group. __Note__: More information in TROUBLESHOOTING.md guide.
+| `node_exporter_tls_server_config` | {} | Configuration for TLS authentication. Keys and values are the same as in [node_exporter docs](https://github.com/prometheus/node_exporter/blob/master/https/README.md#sample-config). |
+| `node_exporter_http_server_config` | {} | Config for HTTP/2 support. Keys and values are the same as in [node_exporter docs](https://github.com/prometheus/node_exporter/blob/master/https/README.md#sample-config). |
+| `node_exporter_basic_auth_users` | {} | Dictionary of users and password for basic authentication. Passwords are automatically hashed with bcrypt. |
+
+## Example
+
+### Playbook
+
+Use it in a playbook as follows:
+```yaml
+- hosts: all
+  roles:
+    - cloudalchemy.node_exporter
+```
+
+### TLS config
+
+Before running node_exporter role, the user needs to provision their own certificate and key.
+```yaml
+- hosts: all
+  pre_tasks:
+    - name: Create node_exporter cert dir
+      file:
+        path: "/etc/node_exporter"
+        state: directory
+        owner: root
+        group: root
+
+    - name: Create cert and key
+      openssl_certificate:
+        path: /etc/node_exporter/tls.cert
+        csr_path: /etc/node_exporter/tls.csr
+        privatekey_path: /etc/node_exporter/tls.key
+        provider: selfsigned
+  roles:
+    - cloudalchemy.node_exporter
+  vars:
+    node_exporter_tls_server_config:
+      cert_file: /etc/node_exporter/tls.cert
+      key_file: /etc/node_exporter/tls.key
+    node_exporter_basic_auth_users:
+      randomuser: examplepassword 
+```
+
+
+### Demo site
+
+We provide an example site that demonstrates a full monitoring solution based on prometheus and grafana. The repository with code and links to running instances is [available on github](https://github.com/cloudalchemy/demo-site) and the site is hosted on [DigitalOcean](https://digitalocean.com).
+
+## Local Testing
+
+The preferred way of locally testing the role is to use Docker and [molecule](https://github.com/ansible-community/molecule) (v3.x). You will have to install Docker on your system. See "Get started" for a Docker package suitable for your system. Running your tests is as simple as executing `molecule test`.
+
+## Continuous Integration
+
+Combining molecule and circle CI allows us to test how new PRs will behave when used with multiple ansible versions and multiple operating systems. This also allows use to create test scenarios for different role configurations. As a result we have quite a large test matrix which can take more time than local testing, so please be patient.
+
+## Contributing
+
+See [contributor guideline](CONTRIBUTING.md).
+
+## Troubleshooting
+
+See [troubleshooting](TROUBLESHOOTING.md).
+
+## License
+
+This project is licensed under MIT License. See [LICENSE](/LICENSE) for more details.
diff --git a/roles/node-exporter/TROUBLESHOOTING.md b/roles/node-exporter/TROUBLESHOOTING.md
new file mode 100644
index 0000000000000000000000000000000000000000..f56539121d2d1129031bf2d6355bc169be63e215
--- /dev/null
+++ b/roles/node-exporter/TROUBLESHOOTING.md
@@ -0,0 +1,43 @@
+# Troubleshooting
+
+## Bad requests (HTTP 400)
+
+This role downloads checksums from the Github project to verify the integrity of artifacts installed on your servers. When downloading the checksums, a "bad request" error might occur.
+
+This happens in environments which (knowningly or unknowling) use the [netrc mechanism](https://www.gnu.org/software/inetutils/manual/html_node/The-_002enetrc-file.html) to auto-login into servers.
+
+Unless netrc is needed by your playbook and ansible roles, please unset the var like so:
+
+```
+$ NETRC= ansible-playbook ...
+```
+
+Or:
+
+```
+$ export NETRC=
+$ ansible-playbook ...
+```
+
+## node_exporter doesn't report data from textfile collector
+
+There are 3 potential issues why node_exporter doesn't pick up data:
+
+1. Duplicated metrics across multiple files.
+2. File is not readable by node_exporter process.
+3. Textfile collector is not enabled.
+
+Solving first possibility is out of scope of the role as data is created somewhere else. When creating that data ensure
+files are readable by `node-exp` user. To get access to the directory with files your process needs to be in `node-exp`
+group.
+
+Lastly ansible role misconfiguration can also lead to data not being picked up. Check if `node_exporter` textfile
+collector is enabled in `node_exporter_enabled_collectors` as follows:
+
+```yaml
+node_exporter_enabled_collectors:
+  - textfile:
+      directory: "{{ node_exporter_textfile_dir }}"
+```
+
+__note___: `node_exporter_textfile_dir` variable is only responsible for creating a directory not enabling a collector.
diff --git a/roles/node-exporter/defaults/main.yml b/roles/node-exporter/defaults/main.yml
new file mode 100644
index 0000000000000000000000000000000000000000..4b22314b4dd8e899419b0ec0460de86a4e391f77
--- /dev/null
+++ b/roles/node-exporter/defaults/main.yml
@@ -0,0 +1,30 @@
+---
+node_exporter_version: 1.3.1
+node_exporter_binary_local_dir: ""
+node_exporter_web_telemetry_path: "/metrics"
+
+app_main_port: 9100
+
+node_exporter_textfile_dir: "/var/lib/node_exporter"
+
+node_exporter_tls_server_config: {}
+
+node_exporter_http_server_config: {}
+
+node_exporter_basic_auth_users: {}
+
+node_exporter_enabled_collectors:
+  - systemd
+  - textfile:
+      directory: "{{ node_exporter_textfile_dir }}"
+#  - filesystem:
+#      ignored-mount-points: "^/(sys|proc|dev)($|/)"
+#      ignored-fs-types: "^(sys|proc|auto)fs$"
+
+node_exporter_disabled_collectors: []
+
+# Internal variables.
+_node_exporter_binary_install_dir: "/usr/local/bin"
+_node_exporter_system_group: "node-exp"
+_node_exporter_system_user: "{{ _node_exporter_system_group }}"
+node_exporter_checksum: "68f3802c2dd3980667e4ba65ea2e1fb03f4a4ba026cca375f15a0390ff850949"
diff --git a/roles/node-exporter/handlers/main.yml b/roles/node-exporter/handlers/main.yml
new file mode 100644
index 0000000000000000000000000000000000000000..225d6eddd06020d8c3c3bb16cef57fffac8c99c3
--- /dev/null
+++ b/roles/node-exporter/handlers/main.yml
@@ -0,0 +1,10 @@
+---
+- name: restart node_exporter
+  become: true
+  systemd:
+    daemon_reload: true
+    name: node_exporter
+    state: restarted
+
+- name: reload nginx node_exporter
+  service: name=nginx state=reloaded
diff --git a/roles/node-exporter/tasks/configure.yml b/roles/node-exporter/tasks/configure.yml
new file mode 100644
index 0000000000000000000000000000000000000000..70bbedc59edc275df0303279100a90442347bd44
--- /dev/null
+++ b/roles/node-exporter/tasks/configure.yml
@@ -0,0 +1,37 @@
+---
+- name: Copy the node_exporter systemd service file
+  template:
+    src: node_exporter.service.j2
+    dest: /etc/systemd/system/node_exporter.service
+    owner: root
+    group: root
+    mode: 0644
+  notify: restart node_exporter
+
+- block:
+    - name: Create node_exporter config directory
+      file:
+        path: "/etc/node_exporter"
+        state: directory
+        owner: root
+        group: root
+        mode: u+rwX,g+rwX,o=rX
+
+    - name: Copy the node_exporter config file
+      template:
+        src: config.yaml.j2
+        dest: /etc/node_exporter/config.yaml
+        owner: root
+        group: root
+        mode: 0644
+      notify: restart node_exporter
+
+- name: Create textfile collector dir
+  file:
+    path: "{{ node_exporter_textfile_dir }}"
+    state: directory
+    owner: "{{ _node_exporter_system_user }}"
+    group: "{{ _node_exporter_system_group }}"
+    recurse: true
+    mode: u+rwX,g+rwX,o=rX
+  when: node_exporter_textfile_dir | length > 0
diff --git a/roles/node-exporter/tasks/install.yml b/roles/node-exporter/tasks/install.yml
new file mode 100644
index 0000000000000000000000000000000000000000..09be71bf1ba59492adf73bc190772b6c7663c470
--- /dev/null
+++ b/roles/node-exporter/tasks/install.yml
@@ -0,0 +1,70 @@
+---
+- name: Create the node_exporter group
+  group:
+    name: "{{ _node_exporter_system_group }}"
+    state: present
+    system: true
+  when: _node_exporter_system_group != "root"
+
+- name: Create the node_exporter user
+  user:
+    name: "{{ _node_exporter_system_user }}"
+    groups: "{{ _node_exporter_system_group }}"
+    append: true
+    shell: /usr/sbin/nologin
+    system: true
+    create_home: false
+    home: /
+  when: _node_exporter_system_user != "root"
+
+- block:
+    - name: Download node_exporter binary to local folder
+      become: false
+      get_url:
+        url: "https://github.com/prometheus/node_exporter/releases/download/v{{ node_exporter_version }}/node_exporter-{{ node_exporter_version }}.linux-{{ go_arch }}.tar.gz"
+        dest: "/tmp/node_exporter-{{ node_exporter_version }}.linux-{{ go_arch }}.tar.gz"
+        checksum: "sha256:{{ node_exporter_checksum }}"
+        mode: '0644'
+      register: _download_binary
+      until: _download_binary is succeeded
+      retries: 5
+      delay: 2
+      delegate_to: localhost
+      check_mode: false
+
+    - name: Unpack node_exporter binary
+      become: false
+      unarchive:
+        src: "/tmp/node_exporter-{{ node_exporter_version }}.linux-{{ go_arch }}.tar.gz"
+        dest: "/tmp"
+        creates: "/tmp/node_exporter-{{ node_exporter_version }}.linux-{{ go_arch }}/node_exporter"
+      delegate_to: localhost
+      check_mode: false
+
+    - name: Propagate node_exporter binaries
+      copy:
+        src: "/tmp/node_exporter-{{ node_exporter_version }}.linux-{{ go_arch }}/node_exporter"
+        dest: "{{ _node_exporter_binary_install_dir }}/node_exporter"
+        mode: 0755
+        owner: root
+        group: root
+      notify: restart node_exporter
+      when: not ansible_check_mode
+  when: node_exporter_binary_local_dir | length == 0
+
+- name: propagate locally distributed node_exporter binary
+  copy:
+    src: "{{ node_exporter_binary_local_dir }}/node_exporter"
+    dest: "{{ _node_exporter_binary_install_dir }}/node_exporter"
+    mode: 0755
+    owner: root
+    group: root
+  when: node_exporter_binary_local_dir | length > 0
+  notify: restart node_exporter
+
+- name: "ufw: Allow port {{ app_main_port }}"
+  ufw:
+    rule: allow
+    port: "{{ app_main_port }}"
+    proto: tcp
+    src: "{{ ip_monitoring_server }}"
diff --git a/roles/node-exporter/tasks/main.yml b/roles/node-exporter/tasks/main.yml
new file mode 100644
index 0000000000000000000000000000000000000000..dba9a378311c7f6b7308c5202ccd5aad8f2c6fb6
--- /dev/null
+++ b/roles/node-exporter/tasks/main.yml
@@ -0,0 +1,27 @@
+---
+- name: Check if node_exporter is installed
+  stat:
+    path: "{{ _node_exporter_binary_install_dir }}/node_exporter"
+  register: __node_exporter_is_installed
+  check_mode: false
+  tags:
+    - node_exporter_install
+
+- import_tasks: install.yml
+
+- import_tasks: configure.yml
+  become: true
+  tags:
+    - node_exporter_configure
+
+- name: Ensure Node Exporter is enabled on boot
+  become: true
+  systemd:
+    daemon_reload: true
+    name: node_exporter
+    enabled: true
+    state: started
+  when:
+    - not ansible_check_mode
+  tags:
+    - node_exporter_run
diff --git a/roles/node-exporter/tasks/uninstall.yml b/roles/node-exporter/tasks/uninstall.yml
new file mode 100644
index 0000000000000000000000000000000000000000..e69de29bb2d1d6434b8b29ae775ad8c2e48c5391
diff --git a/roles/node-exporter/templates/config.yaml.j2 b/roles/node-exporter/templates/config.yaml.j2
new file mode 100644
index 0000000000000000000000000000000000000000..dd60f778e99467454abc17dea8bd96dac0f0c05a
--- /dev/null
+++ b/roles/node-exporter/templates/config.yaml.j2
@@ -0,0 +1,16 @@
+---
+{{ ansible_managed | comment }}
+{% if node_exporter_tls_server_config | length > 0 %}
+tls_server_config:
+{{ node_exporter_tls_server_config | to_nice_yaml | indent(2, true) }}
+{% endif %}
+
+{% if node_exporter_http_server_config | length > 0 %}
+http_server_config:
+{{ node_exporter_http_server_config | to_nice_yaml | indent(2, true) }}
+{% endif %}
+
+{% if admin_pwd is defined %}
+basic_auth_users:
+  admin: "{{ admin_node_exporter_crypt_pwd }}"
+{% endif %}
diff --git a/roles/node-exporter/templates/nginx_app.j2 b/roles/node-exporter/templates/nginx_app.j2
new file mode 100644
index 0000000000000000000000000000000000000000..4b34402a8a9a5aaad410f265bd30288364878c7e
--- /dev/null
+++ b/roles/node-exporter/templates/nginx_app.j2
@@ -0,0 +1,67 @@
+map $http_user_agent $log_ua {
+  ~Monit 0;
+  default 1;
+}
+
+server {
+  listen 80;
+  listen [::]:80;
+  server_name {{ app_domain | mandatory }};
+  # enforce https
+  return 301 https://$server_name$request_uri;
+}
+
+server {
+  listen 443 ssl http2;
+  listen [::]:443 ssl http2;
+  server_name {{ app_domain }};
+
+  ssl_certificate /etc/letsencrypt/live/{{ app_domain }}/fullchain.pem;
+  ssl_certificate_key /etc/letsencrypt/live/{{ app_domain }}/privkey.pem;
+
+  # Add headers to serve security related headers
+  # Before enabling Strict-Transport-Security headers please read into this
+  # topic first.
+  # add_header Strict-Transport-Security "max-age=15768000;
+  # includeSubDomains; preload;";
+  #
+  # WARNING: Only add the preload option once you read about
+  # the consequences in https://hstspreload.org/. This option
+  # will add the domain to a hardcoded list that is shipped
+  # in all major browsers and getting removed from this list
+  # could take several months.
+
+  add_header X-Content-Type-Options nosniff;
+  add_header X-XSS-Protection "1; mode=block";
+  add_header X-Robots-Tag all; # https://developers.google.com/search/docs/advanced/robots/robots_meta_tag
+  add_header X-Download-Options noopen;
+  add_header X-Permitted-Cross-Domain-Policies none;
+  add_header Strict-Transport-Security "max-age=15768000";
+
+  # Enable gzip but do not remove ETag headers
+  gzip on;
+  gzip_vary on;
+  gzip_comp_level 4;
+  gzip_min_length 256;
+  gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
+  gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
+
+
+  access_log {{ www_log }}/{{ app_instance_id }}/access.log combined if=$log_ua;
+  error_log {{ www_log }}/{{ app_instance_id }}/error.log;
+
+  # set max upload size
+  client_max_body_size 512M;
+  fastcgi_buffers 64 4K;
+
+
+  location / {
+      proxy_set_header HOST $host;
+      proxy_set_header X-Forwarded-Proto https;
+      proxy_set_header X-Real-IP $remote_addr;
+      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header X-Forwarded-Host $server_name;
+      proxy_pass http://localhost:{{ app_main_port }};
+  }
+
+}
diff --git a/roles/node-exporter/templates/node_exporter.service.j2 b/roles/node-exporter/templates/node_exporter.service.j2
new file mode 100644
index 0000000000000000000000000000000000000000..49e5aad5b0943c8aa977aa5ff68b40424a63ef82
--- /dev/null
+++ b/roles/node-exporter/templates/node_exporter.service.j2
@@ -0,0 +1,51 @@
+{{ ansible_managed | comment }}
+
+[Unit]
+Description=Prometheus Node Exporter
+After=network-online.target
+
+[Service]
+Type=simple
+User={{ _node_exporter_system_user }}
+Group={{ _node_exporter_system_group }}
+ExecStart={{ _node_exporter_binary_install_dir }}/node_exporter \
+{% for collector in node_exporter_enabled_collectors -%}
+{%   if not collector is mapping %}
+    --collector.{{ collector }} \
+{%   else -%}
+{%     set name, options = (collector.items()|list)[0] -%}
+    --collector.{{ name }} \
+{%     for k,v in options|dictsort %}
+    --collector.{{ name }}.{{ k }}={{ v | quote }} \
+{%     endfor -%}
+{%   endif -%}
+{% endfor -%}
+{% for collector in node_exporter_disabled_collectors %}
+    --no-collector.{{ collector }} \
+{% endfor %}
+{% if node_exporter_tls_server_config | length > 0 or node_exporter_http_server_config | length > 0 or admin_pwd is defined %}
+    --web.config=/etc/node_exporter/config.yaml \
+{% endif %}
+    --web.listen-address=0.0.0.0:{{ app_main_port }} \
+    --web.telemetry-path={{ node_exporter_web_telemetry_path }}
+
+SyslogIdentifier=node_exporter
+Restart=always
+RestartSec=1
+StartLimitInterval=0
+
+{% for m in ansible_mounts if m.mount == '/home' %}
+ProtectHome=read-only
+{% else %}
+ProtectHome=yes
+{% endfor %}
+NoNewPrivileges=yes
+
+ProtectSystem=strict
+ProtectControlGroups=true
+ProtectKernelModules=true
+ProtectKernelTunables=yes
+
+
+[Install]
+WantedBy=multi-user.target
diff --git a/roles/node-exporter/test-requirements.txt b/roles/node-exporter/test-requirements.txt
new file mode 100644
index 0000000000000000000000000000000000000000..1b6e9a96ed20fa99ea744227d8f390add852c6e9
--- /dev/null
+++ b/roles/node-exporter/test-requirements.txt
@@ -0,0 +1,8 @@
+molecule>=3.0.0
+molecule-docker
+docker
+ansible-lint>=3.4.0
+testinfra>=1.7.0
+jmespath
+selinux
+passlib
diff --git a/roles/node-exporter/vars/main.yml b/roles/node-exporter/vars/main.yml
new file mode 100644
index 0000000000000000000000000000000000000000..1025a8787de8b60164b0083e840239f3b8e5d366
--- /dev/null
+++ b/roles/node-exporter/vars/main.yml
@@ -0,0 +1,5 @@
+---
+go_arch_map:
+  x86_64: 'amd64'
+
+go_arch: "{{ go_arch_map[ansible_architecture] | default(ansible_architecture) }}"
diff --git a/roles/prometheus/.travis.yml b/roles/prometheus/.travis.yml
new file mode 100644
index 0000000000000000000000000000000000000000..36bbf6208cfd42ac91bfbe7f9126bc9044e186c6
--- /dev/null
+++ b/roles/prometheus/.travis.yml
@@ -0,0 +1,29 @@
+---
+language: python
+python: "2.7"
+
+# Use the new container infrastructure
+sudo: false
+
+# Install ansible
+addons:
+  apt:
+    packages:
+    - python-pip
+
+install:
+  # Install ansible
+  - pip install ansible
+
+  # Check ansible version
+  - ansible --version
+
+  # Create ansible.cfg with correct roles_path
+  - printf '[defaults]\nroles_path=../' >ansible.cfg
+
+script:
+  # Basic role syntax check
+  - ansible-playbook tests/test.yml -i tests/inventory --syntax-check
+
+notifications:
+  webhooks: https://galaxy.ansible.com/api/v1/notifications/
\ No newline at end of file
diff --git a/roles/prometheus/README.md b/roles/prometheus/README.md
new file mode 100644
index 0000000000000000000000000000000000000000..225dd44b9fc5b3abff7e9c68ff9e91d505cdd5f0
--- /dev/null
+++ b/roles/prometheus/README.md
@@ -0,0 +1,38 @@
+Role Name
+=========
+
+A brief description of the role goes here.
+
+Requirements
+------------
+
+Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
+
+Role Variables
+--------------
+
+A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
+
+Dependencies
+------------
+
+A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
+
+Example Playbook
+----------------
+
+Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
+
+    - hosts: servers
+      roles:
+         - { role: username.rolename, x: 42 }
+
+License
+-------
+
+BSD
+
+Author Information
+------------------
+
+An optional section for the role authors to include contact information, or a website (HTML is not allowed).
diff --git a/roles/prometheus/defaults/main.yml b/roles/prometheus/defaults/main.yml
new file mode 100644
index 0000000000000000000000000000000000000000..68271de0ce9fa1a6386de51acd373066710b579b
--- /dev/null
+++ b/roles/prometheus/defaults/main.yml
@@ -0,0 +1,4 @@
+---
+# defaults file for prometheus
+app_main_port: "9090"
+app_group: "{{ app_user }}"
diff --git a/roles/prometheus/files/docker-compose.yml b/roles/prometheus/files/docker-compose.yml
new file mode 100644
index 0000000000000000000000000000000000000000..7597da41e48bd540fc36a1175e377d0021530041
--- /dev/null
+++ b/roles/prometheus/files/docker-compose.yml
@@ -0,0 +1,18 @@
+version: '3.7'
+
+volumes:
+  prometheus_data: {}
+
+services:
+
+  prometheus:
+    image: prom/prometheus
+    volumes:
+      - ./prometheus/:/etc/prometheus/
+      - prometheus_data:/prometheus
+    command:
+      - '--config.file=/etc/prometheus/prometheus.yml'
+      - '--web.config.file=/etc/prometheus/web.yml'
+    ports:
+      - 127.0.0.1:${APP_MAIN_PORT:-9090}:9090
+    restart: always
diff --git a/roles/prometheus/handlers/main.yml b/roles/prometheus/handlers/main.yml
new file mode 100644
index 0000000000000000000000000000000000000000..33a89a7424ce7788b97190d4123ae84080c9abac
--- /dev/null
+++ b/roles/prometheus/handlers/main.yml
@@ -0,0 +1,4 @@
+---
+- name: reload nginx prometheus
+  service: name=nginx state=reloaded
+
diff --git a/roles/prometheus/tasks/install.yml b/roles/prometheus/tasks/install.yml
new file mode 100644
index 0000000000000000000000000000000000000000..e77bae36cc188a9e66a754274529d2f02db5abcc
--- /dev/null
+++ b/roles/prometheus/tasks/install.yml
@@ -0,0 +1,100 @@
+---
+
+- name: Create of update let'encrypt certificate
+  import_role:
+    name: _letsencrypt_certificate
+  when: app_domain is defined and app_domain != ""
+
+- name: create user {{ app_user }}
+  import_role:
+    name: _user
+  vars:
+    user_name: "{{ app_user }}"
+    user_password: "{{ app_user_password }}"
+  when: app_user is defined
+
+- name: "directory for www logs mounted in jail"
+  file:
+    state: directory
+    path: "{{ app_instance_root }}/../logs"
+    mode: 0711
+    owner: "{{ app_user }}"
+    group: "{{ app_group }}"
+  when: app_user is defined
+
+- name: "template nginx_app.j2 {{ app_instance_id }}"
+  template:
+    src: "nginx_app.j2"
+    dest: "/etc/nginx/sites-available/{{ app_instance_id }}.conf"
+  notify: reload nginx prometheus
+  tags:
+    - rev_proxy
+
+- name: "Prometheus conf directory"
+  file:
+    path: "{{ app_instance_root }}/prometheus"
+    state: directory
+  tags:
+    - prometheus_installation
+
+- name: "Move configuration file of Prometheus"
+  template:
+    src: "prometheus.yml.j2"
+    dest: "{{ app_instance_root }}/prometheus/prometheus.yml"
+    backup: yes
+  tags:
+    - prometheus_installation
+
+- name: "Move configuration file of Prometheus"
+  template:
+    src: "web.yml.j2"
+    dest: "{{ app_instance_root }}/prometheus/web.yml"
+    backup: yes
+  tags:
+    - prometheus_installation
+
+- name: "Copy node_exporter targets file"
+  copy:
+    src: "~/.pm_monitoring/node_exporter.json"
+    dest: "{{ app_instance_root }}/prometheus/node_exporter.json"
+    mode: 0755
+  tags:
+    - prometheus_installation
+
+- name: "Copy services targets file"
+  copy:
+    src: "~/.pm_monitoring/services.json"
+    dest: "{{ app_instance_root }}/prometheus/services.json"
+    mode: 0755
+  tags:
+    - prometheus_installation
+
+- name: "copy docker-compose {{ app_instance_id }}"
+  copy:
+    src: "docker-compose.yml"
+    dest: "{{ app_instance_root }}/docker-compose.yml"
+  tags:
+    - prometheus_installation
+
+- name: "start prometheus environment"
+  docker_compose:
+    project_src: "{{ app_instance_root }}"
+    state: present
+  tags:
+    - prometheus_installation
+
+- name: log rotate
+  import_role:
+    name: _app_logrotate
+
+- name: "enable site for {{ app_domain }}"
+  file:
+    state: link
+    path: "/etc/nginx/sites-enabled/{{ app_instance_id }}.conf"
+    src: "/etc/nginx/sites-available/{{ app_instance_id }}.conf"
+  notify: reload nginx prometheus
+
+- name: Add monit
+  import_role:
+    name: _app_monit
+  when: monit_request is defined and monit_request != ''
diff --git a/roles/prometheus/tasks/main.yml b/roles/prometheus/tasks/main.yml
new file mode 100644
index 0000000000000000000000000000000000000000..c5e910b16741c1798a64960411d7466f9add1e80
--- /dev/null
+++ b/roles/prometheus/tasks/main.yml
@@ -0,0 +1,25 @@
+---
+
+- name: "set user home var "
+  set_fact:
+    app_user_home: "/home/{{ app_user }}"
+  tags:
+    - setpath
+
+- name: "set instance root"
+  set_fact:
+    app_instance_root: "{{ app_user_home }}/{{ app_instance_id }}"
+  tags:
+    - setpath
+
+- name: "set instance root"
+  set_fact:
+    run_user: "{{ app_user }}"
+  tags:
+    - setpath
+
+- import_tasks: install.yml
+  when: app_run in ['install', 'reinstall']
+
+- import_tasks: uninstall.yml
+  when: app_run == 'uninstall'
diff --git a/roles/prometheus/tasks/uninstall.yml b/roles/prometheus/tasks/uninstall.yml
new file mode 100644
index 0000000000000000000000000000000000000000..e69de29bb2d1d6434b8b29ae775ad8c2e48c5391
diff --git a/roles/prometheus/templates/nginx_app.j2 b/roles/prometheus/templates/nginx_app.j2
new file mode 100644
index 0000000000000000000000000000000000000000..4b34402a8a9a5aaad410f265bd30288364878c7e
--- /dev/null
+++ b/roles/prometheus/templates/nginx_app.j2
@@ -0,0 +1,67 @@
+map $http_user_agent $log_ua {
+  ~Monit 0;
+  default 1;
+}
+
+server {
+  listen 80;
+  listen [::]:80;
+  server_name {{ app_domain | mandatory }};
+  # enforce https
+  return 301 https://$server_name$request_uri;
+}
+
+server {
+  listen 443 ssl http2;
+  listen [::]:443 ssl http2;
+  server_name {{ app_domain }};
+
+  ssl_certificate /etc/letsencrypt/live/{{ app_domain }}/fullchain.pem;
+  ssl_certificate_key /etc/letsencrypt/live/{{ app_domain }}/privkey.pem;
+
+  # Add headers to serve security related headers
+  # Before enabling Strict-Transport-Security headers please read into this
+  # topic first.
+  # add_header Strict-Transport-Security "max-age=15768000;
+  # includeSubDomains; preload;";
+  #
+  # WARNING: Only add the preload option once you read about
+  # the consequences in https://hstspreload.org/. This option
+  # will add the domain to a hardcoded list that is shipped
+  # in all major browsers and getting removed from this list
+  # could take several months.
+
+  add_header X-Content-Type-Options nosniff;
+  add_header X-XSS-Protection "1; mode=block";
+  add_header X-Robots-Tag all; # https://developers.google.com/search/docs/advanced/robots/robots_meta_tag
+  add_header X-Download-Options noopen;
+  add_header X-Permitted-Cross-Domain-Policies none;
+  add_header Strict-Transport-Security "max-age=15768000";
+
+  # Enable gzip but do not remove ETag headers
+  gzip on;
+  gzip_vary on;
+  gzip_comp_level 4;
+  gzip_min_length 256;
+  gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
+  gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
+
+
+  access_log {{ www_log }}/{{ app_instance_id }}/access.log combined if=$log_ua;
+  error_log {{ www_log }}/{{ app_instance_id }}/error.log;
+
+  # set max upload size
+  client_max_body_size 512M;
+  fastcgi_buffers 64 4K;
+
+
+  location / {
+      proxy_set_header HOST $host;
+      proxy_set_header X-Forwarded-Proto https;
+      proxy_set_header X-Real-IP $remote_addr;
+      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header X-Forwarded-Host $server_name;
+      proxy_pass http://localhost:{{ app_main_port }};
+  }
+
+}
diff --git a/roles/prometheus/templates/prometheus.yml.j2 b/roles/prometheus/templates/prometheus.yml.j2
new file mode 100644
index 0000000000000000000000000000000000000000..45d2ceb10d26fc9798ef84be933f786aa13ca6d5
--- /dev/null
+++ b/roles/prometheus/templates/prometheus.yml.j2
@@ -0,0 +1,29 @@
+global:
+  scrape_interval:     15s
+  evaluation_interval: 15s
+
+rule_files:
+  # - "first.rules"
+  # - "second.rules"
+
+scrape_configs:
+  - job_name: prometheus
+    basic_auth:
+      username: "admin"   
+      password: "{{ clear_admin_pwd }}"
+    static_configs:
+      - targets: ['localhost:{{ app_main_port }}']
+  - job_name: node_exporter
+    basic_auth:
+      username: "admin"
+      password: "{{ admin_node_exporter_pwd }}"
+    file_sd_configs:
+      - files:
+        - node_exporter.json
+  - job_name: services
+    basic_auth:
+      username: "metrics"
+      password: "{{ admin_services_pwd }}"
+    file_sd_configs:
+      - files:
+        - services.json
diff --git a/roles/prometheus/templates/rules.j2 b/roles/prometheus/templates/rules.j2
new file mode 100644
index 0000000000000000000000000000000000000000..cc9f82dc6277fa99111e14c4188dc9daaf918505
--- /dev/null
+++ b/roles/prometheus/templates/rules.j2
@@ -0,0 +1,122 @@
+global:
+  # The smarthost and SMTP sender used for mail notifications.
+  smtp_smarthost: '{{ smtp_host }}:{{ smtp_port }}'
+  smtp_from: '{{ smtp_from }}'
+  smtp_auth_username: '{{ smtp_user }}'
+  smtp_auth_password: 'password'
+
+# The directory from which notification templates are read.
+templates:
+  - '/etc/alertmanager/template/*.tmpl'
+
+# The root route on which each incoming alert enters.
+route:
+  # The labels by which incoming alerts are grouped together. For example,
+  # multiple alerts coming in for cluster=A and alertname=LatencyHigh would
+  # be batched into a single group.
+  #
+  # To aggregate by all possible labels use '...' as the sole label name.
+  # This effectively disables aggregation entirely, passing through all
+  # alerts as-is. This is unlikely to be what you want, unless you have
+  # a very low alert volume or your upstream notification system performs
+  # its own grouping. Example: group_by: [...]
+  group_by: ['alertname', 'cluster', 'service']
+
+  # When a new group of alerts is created by an incoming alert, wait at
+  # least 'group_wait' to send the initial notification.
+  # This way ensures that you get multiple alerts for the same group that start
+  # firing shortly after another are batched together on the first
+  # notification.
+  group_wait: 30s
+
+  # When the first notification was sent, wait 'group_interval' to send a batch
+  # of new alerts that started firing for that group.
+  group_interval: 5m
+
+  # If an alert has successfully been sent, wait 'repeat_interval' to
+  # resend them.
+  repeat_interval: 3h
+
+  # A default receiver
+  receiver: team-X-mails
+
+  # All the above attributes are inherited by all child routes and can
+  # overwritten on each.
+
+  # The child route trees.
+  routes:
+    # This routes performs a regular expression match on alert labels to
+    # catch alerts that are related to a list of services.
+    - matchers:
+        - service=~"foo1|foo2|baz"
+      receiver: team-X-mails
+      # The service has a sub-route for critical alerts, any alerts
+      # that do not match, i.e. severity != critical, fall-back to the
+      # parent node and are sent to 'team-X-mails'
+      routes:
+        - matchers:
+            - severity="critical"
+          receiver: team-X-pager
+    - matchers:
+        - service="files"
+      receiver: team-Y-mails
+
+      routes:
+        - matchers:
+            - severity="critical"
+          receiver: team-Y-pager
+
+    # This route handles all alerts coming from a database service. If there's
+    # no team to handle it, it defaults to the DB team.
+    - matchers:
+        - service="database"
+      receiver: team-DB-pager
+      # Also group alerts by affected database.
+      group_by: [alertname, cluster, database]
+      routes:
+        - matchers:
+            - owner="team-X"
+          receiver: team-X-pager
+          continue: true
+        - matchers:
+            - owner="team-Y"
+          receiver: team-Y-pager
+
+
+# Inhibition rules allow to mute a set of alerts given that another alert is
+# firing.
+# We use this to mute any warning-level notifications if the same alert is
+# already critical.
+inhibit_rules:
+  - source_matchers: [severity="critical"]
+    target_matchers: [severity="warning"]
+    # Apply inhibition if the alertname is the same.
+    # CAUTION:
+    #   If all label names listed in `equal` are missing
+    #   from both the source and target alerts,
+    #   the inhibition rule will apply!
+    equal: [alertname, cluster, service]
+
+
+receivers:
+  - name: 'team-X-mails'
+    email_configs:
+      - to: 'team-X+alerts@example.org'
+
+  - name: 'team-X-pager'
+    email_configs:
+      - to: 'team-X+alerts-critical@example.org'
+    pagerduty_configs:
+      - service_key: <team-X-key>
+
+  - name: 'team-Y-mails'
+    email_configs:
+      - to: 'team-Y+alerts@example.org'
+
+  - name: 'team-Y-pager'
+    pagerduty_configs:
+      - service_key: <team-Y-key>
+
+  - name: 'team-DB-pager'
+    pagerduty_configs:
+      - service_key: <team-DB-key>
\ No newline at end of file
diff --git a/roles/prometheus/templates/web.yml.j2 b/roles/prometheus/templates/web.yml.j2
new file mode 100644
index 0000000000000000000000000000000000000000..e37944de6e1ad074f7ec875928002d9f417a51d2
--- /dev/null
+++ b/roles/prometheus/templates/web.yml.j2
@@ -0,0 +1,2 @@
+basic_auth_users:
+    admin: {{ admin_pwd }}
\ No newline at end of file
diff --git a/roles/prometheus/tests/inventory b/roles/prometheus/tests/inventory
new file mode 100644
index 0000000000000000000000000000000000000000..878877b0776c44f55fc4e458f70840f31da5bb01
--- /dev/null
+++ b/roles/prometheus/tests/inventory
@@ -0,0 +1,2 @@
+localhost
+
diff --git a/roles/prometheus/tests/test.yml b/roles/prometheus/tests/test.yml
new file mode 100644
index 0000000000000000000000000000000000000000..87930df3a07924b8478a8838feb95a351fdbaad6
--- /dev/null
+++ b/roles/prometheus/tests/test.yml
@@ -0,0 +1,5 @@
+---
+- hosts: localhost
+  remote_user: root
+  roles:
+    - prometheus
diff --git a/roles/prometheus/vars/main.yml b/roles/prometheus/vars/main.yml
new file mode 100644
index 0000000000000000000000000000000000000000..d416330867f7a7d3b80b521d922f83b1cd5e8f4e
--- /dev/null
+++ b/roles/prometheus/vars/main.yml
@@ -0,0 +1,2 @@
+---
+# vars file for prometheus