From f6fdeeed6379f48d7e867b3fa4e0b629c30c8285 Mon Sep 17 00:00:00 2001 From: Julien Gomes Dias Date: Mon, 14 Mar 2022 11:53:49 +0100 Subject: [PATCH 01/19] [add] Prometheus and Grafana role for monitoring. --- roles/grafana/files/docker-composer.yml | 14 ++++ roles/grafana/handlers/main.yml | 4 ++ roles/grafana/tasks/install.yml | 59 ++++++++++++++++ roles/grafana/tasks/main.yml | 6 ++ roles/grafana/tasks/uninstall.yml | 0 roles/grafana/templates/nginx_app.j2 | 67 ++++++++++++++++++ roles/prometheus/.travis.yml | 29 ++++++++ roles/prometheus/README.md | 38 ++++++++++ roles/prometheus/defaults/main.yml | 2 + roles/prometheus/files/docker-composer.yml | 17 +++++ roles/prometheus/handlers/main.yml | 4 ++ roles/prometheus/tasks/install.yml | 74 ++++++++++++++++++++ roles/prometheus/tasks/main.yml | 6 ++ roles/prometheus/tasks/uninstall.yml | 0 roles/prometheus/templates/nginx_app.j2 | 67 ++++++++++++++++++ roles/prometheus/templates/prometheus.yml.j2 | 12 ++++ roles/prometheus/tests/inventory | 2 + roles/prometheus/tests/test.yml | 5 ++ roles/prometheus/vars/main.yml | 2 + 19 files changed, 408 insertions(+) create mode 100644 roles/grafana/files/docker-composer.yml create mode 100644 roles/grafana/handlers/main.yml create mode 100644 roles/grafana/tasks/install.yml create mode 100644 roles/grafana/tasks/main.yml create mode 100644 roles/grafana/tasks/uninstall.yml create mode 100644 roles/grafana/templates/nginx_app.j2 create mode 100644 roles/prometheus/.travis.yml create mode 100644 roles/prometheus/README.md create mode 100644 roles/prometheus/defaults/main.yml create mode 100644 roles/prometheus/files/docker-composer.yml create mode 100644 roles/prometheus/handlers/main.yml create mode 100644 roles/prometheus/tasks/install.yml create mode 100644 roles/prometheus/tasks/main.yml create mode 100644 roles/prometheus/tasks/uninstall.yml create mode 100644 roles/prometheus/templates/nginx_app.j2 create mode 100644 roles/prometheus/templates/prometheus.yml.j2 create mode 100644 roles/prometheus/tests/inventory create mode 100644 roles/prometheus/tests/test.yml create mode 100644 roles/prometheus/vars/main.yml diff --git a/roles/grafana/files/docker-composer.yml b/roles/grafana/files/docker-composer.yml new file mode 100644 index 00000000..1166e509 --- /dev/null +++ b/roles/grafana/files/docker-composer.yml @@ -0,0 +1,14 @@ +version: '3.7' + +volumes: + grafana_data: {} + +services: + grafana: + image: grafana/grafana-oss + user: "472" + volumes: + - grafana_data:/var/lib/grafana + ports: + - 127.0.0.1:${APP_MAIN_PORT:-3000}:3000 + restart: always diff --git a/roles/grafana/handlers/main.yml b/roles/grafana/handlers/main.yml new file mode 100644 index 00000000..0113ea54 --- /dev/null +++ b/roles/grafana/handlers/main.yml @@ -0,0 +1,4 @@ +--- +- name: reload nginx weblate + service: name=nginx state=reloaded + diff --git a/roles/grafana/tasks/install.yml b/roles/grafana/tasks/install.yml new file mode 100644 index 00000000..c00790d1 --- /dev/null +++ b/roles/grafana/tasks/install.yml @@ -0,0 +1,59 @@ +--- + +- name: update or check inventory + import_role: + name: _app_log_inventory + vars: + log_type: "install" + +- name: Create of update let'encrypt certificate + import_role: + name: _letsencrypt_certificate + when: app_domain is defined and app_domain != "" + +- name: create user {{ app_user }} + import_role: + name: _user + vars: + user_name: "{{ app_user }}" + user_password: "{{ app_user_password }}" + when: app_user is defined + +- import_tasks: nginx.yml + +- name: "{{ app_instance_root }} directory" + file: + path: "{{ app_instance_root }}" + state: present + tags: + - grafana_installation + +- name: "copy docker-compose {{ app_instance_id }}" + copy: + src: "docker-compose.yml" + dest: "{{ app_instance_root }}/docker-compose.yml" + tags: + - grafana_installation + +- name: "start prometheus environment" + docker_compose: + project_src: "{{ app_instance_root }}" + state: present + tags: + - grafana_installation + +- name: log rotate + import_role: + name: _app_logrotate + +- name: "enable site for {{ app_domain }}" + file: + state: link + path: "/etc/nginx/sites-enabled/{{ app_instance_id }}.conf" + src: "/etc/nginx/sites-available/{{ app_instance_id }}.conf" + notify: reload nginx weblate + +- name: Add monit + import_role: + name: _app_monit + when: monit_request is defined and monit_request != '' diff --git a/roles/grafana/tasks/main.yml b/roles/grafana/tasks/main.yml new file mode 100644 index 00000000..f118b22a --- /dev/null +++ b/roles/grafana/tasks/main.yml @@ -0,0 +1,6 @@ +--- +- import_tasks: install.yml + when: app_run in ['install', 'reinstall'] + +- import_tasks: uninstall.yml + when: app_run == 'uninstall' \ No newline at end of file diff --git a/roles/grafana/tasks/uninstall.yml b/roles/grafana/tasks/uninstall.yml new file mode 100644 index 00000000..e69de29b diff --git a/roles/grafana/templates/nginx_app.j2 b/roles/grafana/templates/nginx_app.j2 new file mode 100644 index 00000000..4b34402a --- /dev/null +++ b/roles/grafana/templates/nginx_app.j2 @@ -0,0 +1,67 @@ +map $http_user_agent $log_ua { + ~Monit 0; + default 1; +} + +server { + listen 80; + listen [::]:80; + server_name {{ app_domain | mandatory }}; + # enforce https + return 301 https://$server_name$request_uri; +} + +server { + listen 443 ssl http2; + listen [::]:443 ssl http2; + server_name {{ app_domain }}; + + ssl_certificate /etc/letsencrypt/live/{{ app_domain }}/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/{{ app_domain }}/privkey.pem; + + # Add headers to serve security related headers + # Before enabling Strict-Transport-Security headers please read into this + # topic first. + # add_header Strict-Transport-Security "max-age=15768000; + # includeSubDomains; preload;"; + # + # WARNING: Only add the preload option once you read about + # the consequences in https://hstspreload.org/. This option + # will add the domain to a hardcoded list that is shipped + # in all major browsers and getting removed from this list + # could take several months. + + add_header X-Content-Type-Options nosniff; + add_header X-XSS-Protection "1; mode=block"; + add_header X-Robots-Tag all; # https://developers.google.com/search/docs/advanced/robots/robots_meta_tag + add_header X-Download-Options noopen; + add_header X-Permitted-Cross-Domain-Policies none; + add_header Strict-Transport-Security "max-age=15768000"; + + # Enable gzip but do not remove ETag headers + gzip on; + gzip_vary on; + gzip_comp_level 4; + gzip_min_length 256; + gzip_proxied expired no-cache no-store private no_last_modified no_etag auth; + gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy; + + + access_log {{ www_log }}/{{ app_instance_id }}/access.log combined if=$log_ua; + error_log {{ www_log }}/{{ app_instance_id }}/error.log; + + # set max upload size + client_max_body_size 512M; + fastcgi_buffers 64 4K; + + + location / { + proxy_set_header HOST $host; + proxy_set_header X-Forwarded-Proto https; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Host $server_name; + proxy_pass http://localhost:{{ app_main_port }}; + } + +} diff --git a/roles/prometheus/.travis.yml b/roles/prometheus/.travis.yml new file mode 100644 index 00000000..36bbf620 --- /dev/null +++ b/roles/prometheus/.travis.yml @@ -0,0 +1,29 @@ +--- +language: python +python: "2.7" + +# Use the new container infrastructure +sudo: false + +# Install ansible +addons: + apt: + packages: + - python-pip + +install: + # Install ansible + - pip install ansible + + # Check ansible version + - ansible --version + + # Create ansible.cfg with correct roles_path + - printf '[defaults]\nroles_path=../' >ansible.cfg + +script: + # Basic role syntax check + - ansible-playbook tests/test.yml -i tests/inventory --syntax-check + +notifications: + webhooks: https://galaxy.ansible.com/api/v1/notifications/ \ No newline at end of file diff --git a/roles/prometheus/README.md b/roles/prometheus/README.md new file mode 100644 index 00000000..225dd44b --- /dev/null +++ b/roles/prometheus/README.md @@ -0,0 +1,38 @@ +Role Name +========= + +A brief description of the role goes here. + +Requirements +------------ + +Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required. + +Role Variables +-------------- + +A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well. + +Dependencies +------------ + +A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles. + +Example Playbook +---------------- + +Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too: + + - hosts: servers + roles: + - { role: username.rolename, x: 42 } + +License +------- + +BSD + +Author Information +------------------ + +An optional section for the role authors to include contact information, or a website (HTML is not allowed). diff --git a/roles/prometheus/defaults/main.yml b/roles/prometheus/defaults/main.yml new file mode 100644 index 00000000..4d2f9861 --- /dev/null +++ b/roles/prometheus/defaults/main.yml @@ -0,0 +1,2 @@ +--- +# defaults file for prometheus diff --git a/roles/prometheus/files/docker-composer.yml b/roles/prometheus/files/docker-composer.yml new file mode 100644 index 00000000..896be177 --- /dev/null +++ b/roles/prometheus/files/docker-composer.yml @@ -0,0 +1,17 @@ +version: '3.7' + +volumes: + prometheus_data: {} + +services: + + prometheus: + image: prom/prometheus + volumes: + - ./prometheus/:/etc/prometheus/ + - prometheus_data:/prometheus + command: + - '--config.file=/etc/prometheus/prometheus.yml' + ports: + - 127.0.0.1:${APP_MAIN_PORT:-9090}:9090 + restart: always diff --git a/roles/prometheus/handlers/main.yml b/roles/prometheus/handlers/main.yml new file mode 100644 index 00000000..0113ea54 --- /dev/null +++ b/roles/prometheus/handlers/main.yml @@ -0,0 +1,4 @@ +--- +- name: reload nginx weblate + service: name=nginx state=reloaded + diff --git a/roles/prometheus/tasks/install.yml b/roles/prometheus/tasks/install.yml new file mode 100644 index 00000000..a1d2bd4b --- /dev/null +++ b/roles/prometheus/tasks/install.yml @@ -0,0 +1,74 @@ +--- + +- name: update or check inventory + import_role: + name: _app_log_inventory + vars: + log_type: "install" + +- name: Create of update let'encrypt certificate + import_role: + name: _letsencrypt_certificate + when: app_domain is defined and app_domain != "" + +- name: create user {{ app_user }} + import_role: + name: _user + vars: + user_name: "{{ app_user }}" + user_password: "{{ app_user_password }}" + when: app_user is defined + +- import_tasks: nginx.yml + +- name: "/opt/prometheus_grafana directory" + file: + path: "{{ app_instance_root }}" + state: present + tags: + - prometheus_installation + +- name: "/opt/prometheus_grafana directory" + file: + path: "{{ app_instance_root }}/prometheus" + state: present + tags: + - prometheus_installation + +- name: "Move configuration file of Prometheus" + template: + src: "prometheus.yml.j2" + dest: "{{ app_instance_root }}/prometheus/prometheus.yml" + backup: yes + tags: + - prometheus_installation + +- name: "copy docker-compose {{ app_instance_id }}" + copy: + src: "docker-compose.yml" + dest: "{{ app_instance_root }}/docker-compose.yml" + tags: + - prometheus_installation + +- name: "start prometheus environment" + docker_compose: + project_src: "{{ app_instance_root }}" + state: present + tags: + - prometheus_installation + +- name: log rotate + import_role: + name: _app_logrotate + +- name: "enable site for {{ app_domain }}" + file: + state: link + path: "/etc/nginx/sites-enabled/{{ app_instance_id }}.conf" + src: "/etc/nginx/sites-available/{{ app_instance_id }}.conf" + notify: reload nginx weblate + +- name: Add monit + import_role: + name: _app_monit + when: monit_request is defined and monit_request != '' diff --git a/roles/prometheus/tasks/main.yml b/roles/prometheus/tasks/main.yml new file mode 100644 index 00000000..f118b22a --- /dev/null +++ b/roles/prometheus/tasks/main.yml @@ -0,0 +1,6 @@ +--- +- import_tasks: install.yml + when: app_run in ['install', 'reinstall'] + +- import_tasks: uninstall.yml + when: app_run == 'uninstall' \ No newline at end of file diff --git a/roles/prometheus/tasks/uninstall.yml b/roles/prometheus/tasks/uninstall.yml new file mode 100644 index 00000000..e69de29b diff --git a/roles/prometheus/templates/nginx_app.j2 b/roles/prometheus/templates/nginx_app.j2 new file mode 100644 index 00000000..4b34402a --- /dev/null +++ b/roles/prometheus/templates/nginx_app.j2 @@ -0,0 +1,67 @@ +map $http_user_agent $log_ua { + ~Monit 0; + default 1; +} + +server { + listen 80; + listen [::]:80; + server_name {{ app_domain | mandatory }}; + # enforce https + return 301 https://$server_name$request_uri; +} + +server { + listen 443 ssl http2; + listen [::]:443 ssl http2; + server_name {{ app_domain }}; + + ssl_certificate /etc/letsencrypt/live/{{ app_domain }}/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/{{ app_domain }}/privkey.pem; + + # Add headers to serve security related headers + # Before enabling Strict-Transport-Security headers please read into this + # topic first. + # add_header Strict-Transport-Security "max-age=15768000; + # includeSubDomains; preload;"; + # + # WARNING: Only add the preload option once you read about + # the consequences in https://hstspreload.org/. This option + # will add the domain to a hardcoded list that is shipped + # in all major browsers and getting removed from this list + # could take several months. + + add_header X-Content-Type-Options nosniff; + add_header X-XSS-Protection "1; mode=block"; + add_header X-Robots-Tag all; # https://developers.google.com/search/docs/advanced/robots/robots_meta_tag + add_header X-Download-Options noopen; + add_header X-Permitted-Cross-Domain-Policies none; + add_header Strict-Transport-Security "max-age=15768000"; + + # Enable gzip but do not remove ETag headers + gzip on; + gzip_vary on; + gzip_comp_level 4; + gzip_min_length 256; + gzip_proxied expired no-cache no-store private no_last_modified no_etag auth; + gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy; + + + access_log {{ www_log }}/{{ app_instance_id }}/access.log combined if=$log_ua; + error_log {{ www_log }}/{{ app_instance_id }}/error.log; + + # set max upload size + client_max_body_size 512M; + fastcgi_buffers 64 4K; + + + location / { + proxy_set_header HOST $host; + proxy_set_header X-Forwarded-Proto https; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Host $server_name; + proxy_pass http://localhost:{{ app_main_port }}; + } + +} diff --git a/roles/prometheus/templates/prometheus.yml.j2 b/roles/prometheus/templates/prometheus.yml.j2 new file mode 100644 index 00000000..8cc1782f --- /dev/null +++ b/roles/prometheus/templates/prometheus.yml.j2 @@ -0,0 +1,12 @@ +global: + scrape_interval: 15s + evaluation_interval: 15s + +rule_files: + # - "first.rules" + # - "second.rules" + +scrape_configs: + - job_name: prometheus + static_configs: + - targets: ['localhost:{{ app_main_port }}'] diff --git a/roles/prometheus/tests/inventory b/roles/prometheus/tests/inventory new file mode 100644 index 00000000..878877b0 --- /dev/null +++ b/roles/prometheus/tests/inventory @@ -0,0 +1,2 @@ +localhost + diff --git a/roles/prometheus/tests/test.yml b/roles/prometheus/tests/test.yml new file mode 100644 index 00000000..87930df3 --- /dev/null +++ b/roles/prometheus/tests/test.yml @@ -0,0 +1,5 @@ +--- +- hosts: localhost + remote_user: root + roles: + - prometheus diff --git a/roles/prometheus/vars/main.yml b/roles/prometheus/vars/main.yml new file mode 100644 index 00000000..d4163308 --- /dev/null +++ b/roles/prometheus/vars/main.yml @@ -0,0 +1,2 @@ +--- +# vars file for prometheus -- GitLab From a18c3a3a03cdc614e44036589b12ce8c439ac92a Mon Sep 17 00:00:00 2001 From: Admin paquerette Date: Mon, 14 Mar 2022 16:04:50 +0100 Subject: [PATCH 02/19] [fix] Correction dans les fichier --- roles/prometheus/defaults/main.yml | 2 ++ ...docker-composer.yml => docker-compose.yml} | 0 roles/prometheus/handlers/main.yml | 2 +- roles/prometheus/tasks/install.yml | 32 ++++++++++--------- roles/prometheus/tasks/main.yml | 21 +++++++++++- 5 files changed, 40 insertions(+), 17 deletions(-) rename roles/prometheus/files/{docker-composer.yml => docker-compose.yml} (100%) diff --git a/roles/prometheus/defaults/main.yml b/roles/prometheus/defaults/main.yml index 4d2f9861..68271de0 100644 --- a/roles/prometheus/defaults/main.yml +++ b/roles/prometheus/defaults/main.yml @@ -1,2 +1,4 @@ --- # defaults file for prometheus +app_main_port: "9090" +app_group: "{{ app_user }}" diff --git a/roles/prometheus/files/docker-composer.yml b/roles/prometheus/files/docker-compose.yml similarity index 100% rename from roles/prometheus/files/docker-composer.yml rename to roles/prometheus/files/docker-compose.yml diff --git a/roles/prometheus/handlers/main.yml b/roles/prometheus/handlers/main.yml index 0113ea54..33a89a74 100644 --- a/roles/prometheus/handlers/main.yml +++ b/roles/prometheus/handlers/main.yml @@ -1,4 +1,4 @@ --- -- name: reload nginx weblate +- name: reload nginx prometheus service: name=nginx state=reloaded diff --git a/roles/prometheus/tasks/install.yml b/roles/prometheus/tasks/install.yml index a1d2bd4b..14cca4c8 100644 --- a/roles/prometheus/tasks/install.yml +++ b/roles/prometheus/tasks/install.yml @@ -1,11 +1,5 @@ --- -- name: update or check inventory - import_role: - name: _app_log_inventory - vars: - log_type: "install" - - name: Create of update let'encrypt certificate import_role: name: _letsencrypt_certificate @@ -19,19 +13,27 @@ user_password: "{{ app_user_password }}" when: app_user is defined -- import_tasks: nginx.yml - -- name: "/opt/prometheus_grafana directory" +- name: "directory for www logs mounted in jail" file: - path: "{{ app_instance_root }}" - state: present + state: directory + path: "{{ app_instance_root }}/../logs" + mode: 0711 + owner: "{{ app_user }}" + group: "{{ app_group }}" + when: app_user is defined + +- name: "template nginx_app.j2 {{ app_instance_id }}" + template: + src: "nginx_app.j2" + dest: "/etc/nginx/sites-available/{{ app_instance_id }}.conf" + notify: reload nginx weblate tags: - - prometheus_installation + - rev_proxy -- name: "/opt/prometheus_grafana directory" +- name: "Prometheus conf directory" file: path: "{{ app_instance_root }}/prometheus" - state: present + state: directory tags: - prometheus_installation @@ -66,7 +68,7 @@ state: link path: "/etc/nginx/sites-enabled/{{ app_instance_id }}.conf" src: "/etc/nginx/sites-available/{{ app_instance_id }}.conf" - notify: reload nginx weblate + notify: reload nginx prometheus - name: Add monit import_role: diff --git a/roles/prometheus/tasks/main.yml b/roles/prometheus/tasks/main.yml index f118b22a..c5e910b1 100644 --- a/roles/prometheus/tasks/main.yml +++ b/roles/prometheus/tasks/main.yml @@ -1,6 +1,25 @@ --- + +- name: "set user home var " + set_fact: + app_user_home: "/home/{{ app_user }}" + tags: + - setpath + +- name: "set instance root" + set_fact: + app_instance_root: "{{ app_user_home }}/{{ app_instance_id }}" + tags: + - setpath + +- name: "set instance root" + set_fact: + run_user: "{{ app_user }}" + tags: + - setpath + - import_tasks: install.yml when: app_run in ['install', 'reinstall'] - import_tasks: uninstall.yml - when: app_run == 'uninstall' \ No newline at end of file + when: app_run == 'uninstall' -- GitLab From 0dca3766963b8f54b8d5081aba6d0138118b17dc Mon Sep 17 00:00:00 2001 From: Julien Gomes Dias Date: Mon, 14 Mar 2022 16:11:09 +0100 Subject: [PATCH 03/19] [fix] grafana correction --- roles/grafana/defaults/main.yml | 3 ++ ...docker-composer.yml => docker-compose.yml} | 0 roles/grafana/handlers/main.yml | 2 +- roles/grafana/tasks/install.yml | 30 ++++++++++--------- roles/grafana/tasks/main.yml | 18 +++++++++++ roles/grafana/vars/main.yml | 2 ++ 6 files changed, 40 insertions(+), 15 deletions(-) create mode 100644 roles/grafana/defaults/main.yml rename roles/grafana/files/{docker-composer.yml => docker-compose.yml} (100%) create mode 100644 roles/grafana/vars/main.yml diff --git a/roles/grafana/defaults/main.yml b/roles/grafana/defaults/main.yml new file mode 100644 index 00000000..cafa5542 --- /dev/null +++ b/roles/grafana/defaults/main.yml @@ -0,0 +1,3 @@ +--- +app_main_port: "3000" +app_group: "{{ app_user }}" \ No newline at end of file diff --git a/roles/grafana/files/docker-composer.yml b/roles/grafana/files/docker-compose.yml similarity index 100% rename from roles/grafana/files/docker-composer.yml rename to roles/grafana/files/docker-compose.yml diff --git a/roles/grafana/handlers/main.yml b/roles/grafana/handlers/main.yml index 0113ea54..42209d7c 100644 --- a/roles/grafana/handlers/main.yml +++ b/roles/grafana/handlers/main.yml @@ -1,4 +1,4 @@ --- -- name: reload nginx weblate +- name: reload nginx grafana service: name=nginx state=reloaded diff --git a/roles/grafana/tasks/install.yml b/roles/grafana/tasks/install.yml index c00790d1..ab9fc513 100644 --- a/roles/grafana/tasks/install.yml +++ b/roles/grafana/tasks/install.yml @@ -1,11 +1,5 @@ --- -- name: update or check inventory - import_role: - name: _app_log_inventory - vars: - log_type: "install" - - name: Create of update let'encrypt certificate import_role: name: _letsencrypt_certificate @@ -19,14 +13,22 @@ user_password: "{{ app_user_password }}" when: app_user is defined -- import_tasks: nginx.yml - -- name: "{{ app_instance_root }} directory" +- name: "directory for www logs mounted in jail" file: - path: "{{ app_instance_root }}" - state: present + state: directory + path: "{{ app_instance_root }}/../logs" + mode: 0711 + owner: "{{ app_user }}" + group: "{{ app_group }}" + when: app_user is defined + +- name: "template nginx_app.j2 {{ app_instance_id }}" + template: + src: "nginx_app.j2" + dest: "/etc/nginx/sites-available/{{ app_instance_id }}.conf" + notify: reload nginx weblate tags: - - grafana_installation + - rev_proxy - name: "copy docker-compose {{ app_instance_id }}" copy: @@ -35,7 +37,7 @@ tags: - grafana_installation -- name: "start prometheus environment" +- name: "start grafana environment" docker_compose: project_src: "{{ app_instance_root }}" state: present @@ -51,7 +53,7 @@ state: link path: "/etc/nginx/sites-enabled/{{ app_instance_id }}.conf" src: "/etc/nginx/sites-available/{{ app_instance_id }}.conf" - notify: reload nginx weblate + notify: reload nginx grafana - name: Add monit import_role: diff --git a/roles/grafana/tasks/main.yml b/roles/grafana/tasks/main.yml index f118b22a..de873777 100644 --- a/roles/grafana/tasks/main.yml +++ b/roles/grafana/tasks/main.yml @@ -1,4 +1,22 @@ --- +- name: "set user home var " + set_fact: + app_user_home: "/home/{{ app_user }}" + tags: + - setpath + +- name: "set instance root" + set_fact: + app_instance_root: "{{ app_user_home }}/{{ app_instance_id }}" + tags: + - setpath + +- name: "set instance root" + set_fact: + run_user: "{{ app_user }}" + tags: + - setpath + - import_tasks: install.yml when: app_run in ['install', 'reinstall'] diff --git a/roles/grafana/vars/main.yml b/roles/grafana/vars/main.yml new file mode 100644 index 00000000..d4163308 --- /dev/null +++ b/roles/grafana/vars/main.yml @@ -0,0 +1,2 @@ +--- +# vars file for prometheus -- GitLab From e92a7c0280e36f6c42933570c4a114efc44bf7c6 Mon Sep 17 00:00:00 2001 From: Julien Gomes Dias Date: Mon, 14 Mar 2022 16:13:43 +0100 Subject: [PATCH 04/19] [fix] grafana correction --- roles/grafana/tasks/install.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/grafana/tasks/install.yml b/roles/grafana/tasks/install.yml index ab9fc513..91e0170f 100644 --- a/roles/grafana/tasks/install.yml +++ b/roles/grafana/tasks/install.yml @@ -26,7 +26,7 @@ template: src: "nginx_app.j2" dest: "/etc/nginx/sites-available/{{ app_instance_id }}.conf" - notify: reload nginx weblate + notify: reload nginx grafana tags: - rev_proxy -- GitLab From a70dbf92e5c60b6df6c798c57cde5db80986e169 Mon Sep 17 00:00:00 2001 From: Julien Gomes Dias Date: Mon, 14 Mar 2022 18:51:41 +0100 Subject: [PATCH 05/19] [feat@sec] Add basic auth with admin --- roles/prometheus/files/docker-compose.yml | 1 + roles/prometheus/templates/web.yml.j2 | 2 ++ 2 files changed, 3 insertions(+) create mode 100644 roles/prometheus/templates/web.yml.j2 diff --git a/roles/prometheus/files/docker-compose.yml b/roles/prometheus/files/docker-compose.yml index 896be177..7597da41 100644 --- a/roles/prometheus/files/docker-compose.yml +++ b/roles/prometheus/files/docker-compose.yml @@ -12,6 +12,7 @@ services: - prometheus_data:/prometheus command: - '--config.file=/etc/prometheus/prometheus.yml' + - '--web.config.file=/etc/prometheus/web.yml' ports: - 127.0.0.1:${APP_MAIN_PORT:-9090}:9090 restart: always diff --git a/roles/prometheus/templates/web.yml.j2 b/roles/prometheus/templates/web.yml.j2 new file mode 100644 index 00000000..e37944de --- /dev/null +++ b/roles/prometheus/templates/web.yml.j2 @@ -0,0 +1,2 @@ +basic_auth_users: + admin: {{ admin_pwd }} \ No newline at end of file -- GitLab From 14b0454d0426106f26dcdd258978a36954ba3a9a Mon Sep 17 00:00:00 2001 From: Julien Gomes Dias Date: Tue, 15 Mar 2022 09:42:16 +0100 Subject: [PATCH 06/19] [fix] basic auth --- roles/prometheus/tasks/install.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/roles/prometheus/tasks/install.yml b/roles/prometheus/tasks/install.yml index 14cca4c8..f8fcb632 100644 --- a/roles/prometheus/tasks/install.yml +++ b/roles/prometheus/tasks/install.yml @@ -45,6 +45,14 @@ tags: - prometheus_installation +- name: "Move configuration file of Prometheus" + template: + src: "web.yml.j2" + dest: "{{ app_instance_root }}/prometheus/web.yml" + backup: yes + tags: + - prometheus_installation + - name: "copy docker-compose {{ app_instance_id }}" copy: src: "docker-compose.yml" -- GitLab From 62df944dfb664ac82307c2e35cd06e12b8d0bdac Mon Sep 17 00:00:00 2001 From: Julien Gomes Dias Date: Tue, 15 Mar 2022 09:42:58 +0100 Subject: [PATCH 07/19] [fix] Handler name --- roles/prometheus/tasks/install.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/prometheus/tasks/install.yml b/roles/prometheus/tasks/install.yml index f8fcb632..5b3ece71 100644 --- a/roles/prometheus/tasks/install.yml +++ b/roles/prometheus/tasks/install.yml @@ -26,7 +26,7 @@ template: src: "nginx_app.j2" dest: "/etc/nginx/sites-available/{{ app_instance_id }}.conf" - notify: reload nginx weblate + notify: reload nginx prometheus tags: - rev_proxy -- GitLab From 9028c69499fb0aba7e5b2eecf7ff0ad3a0cede14 Mon Sep 17 00:00:00 2001 From: Julien Gomes Dias Date: Wed, 16 Mar 2022 11:14:27 +0100 Subject: [PATCH 08/19] [add] node-exporter --- roles/node-exporter/.ansible-lint | 5 + roles/node-exporter/.gitignore | 7 + roles/node-exporter/.mergify.yml | 16 + roles/node-exporter/.yamllint | 14 + roles/node-exporter/CHANGELOG.md | 580 ++++++++++++++++++ roles/node-exporter/CONTRIBUTING.md | 98 +++ roles/node-exporter/LICENSE | 21 + roles/node-exporter/README.md | 108 ++++ roles/node-exporter/TROUBLESHOOTING.md | 43 ++ roles/node-exporter/defaults/main.yml | 29 + roles/node-exporter/handlers/main.yml | 10 + roles/node-exporter/tasks/configure.yml | 37 ++ roles/node-exporter/tasks/install.yml | 96 +++ roles/node-exporter/tasks/main.yml | 35 ++ roles/node-exporter/templates/config.yaml.j2 | 16 + roles/node-exporter/templates/nginx_app.j2 | 67 ++ .../templates/node_exporter.service.j2 | 51 ++ roles/node-exporter/test-requirements.txt | 8 + roles/node-exporter/vars/main.yml | 5 + 19 files changed, 1246 insertions(+) create mode 100644 roles/node-exporter/.ansible-lint create mode 100644 roles/node-exporter/.gitignore create mode 100644 roles/node-exporter/.mergify.yml create mode 100644 roles/node-exporter/.yamllint create mode 100644 roles/node-exporter/CHANGELOG.md create mode 100644 roles/node-exporter/CONTRIBUTING.md create mode 100644 roles/node-exporter/LICENSE create mode 100644 roles/node-exporter/README.md create mode 100644 roles/node-exporter/TROUBLESHOOTING.md create mode 100644 roles/node-exporter/defaults/main.yml create mode 100644 roles/node-exporter/handlers/main.yml create mode 100644 roles/node-exporter/tasks/configure.yml create mode 100644 roles/node-exporter/tasks/install.yml create mode 100644 roles/node-exporter/tasks/main.yml create mode 100644 roles/node-exporter/templates/config.yaml.j2 create mode 100644 roles/node-exporter/templates/nginx_app.j2 create mode 100644 roles/node-exporter/templates/node_exporter.service.j2 create mode 100644 roles/node-exporter/test-requirements.txt create mode 100644 roles/node-exporter/vars/main.yml diff --git a/roles/node-exporter/.ansible-lint b/roles/node-exporter/.ansible-lint new file mode 100644 index 00000000..d1aaa54f --- /dev/null +++ b/roles/node-exporter/.ansible-lint @@ -0,0 +1,5 @@ +--- +skip_list: + - '106' + - '204' + - '208' diff --git a/roles/node-exporter/.gitignore b/roles/node-exporter/.gitignore new file mode 100644 index 00000000..db70ede3 --- /dev/null +++ b/roles/node-exporter/.gitignore @@ -0,0 +1,7 @@ +*.retry +*.log +.molecule +.cache +__pycache__/ +.pytest_cache +.tox diff --git a/roles/node-exporter/.mergify.yml b/roles/node-exporter/.mergify.yml new file mode 100644 index 00000000..b7391058 --- /dev/null +++ b/roles/node-exporter/.mergify.yml @@ -0,0 +1,16 @@ +--- +pull_request_rules: + - name: automatic merge and new release from cloudalchemybot + conditions: + - "status-success=Travis CI - Pull Request" + - status-success=WIP + - head~=autoupdate|skeleton + - author=cloudalchemybot + actions: + merge: + method: squash + strict: true + - name: delete head branch after merge + conditions: [] + actions: + delete_head_branch: {} diff --git a/roles/node-exporter/.yamllint b/roles/node-exporter/.yamllint new file mode 100644 index 00000000..8f2e1fa2 --- /dev/null +++ b/roles/node-exporter/.yamllint @@ -0,0 +1,14 @@ +--- +extends: default +ignore: | + .github/ + meta/ + +rules: + braces: + max-spaces-inside: 1 + level: error + brackets: + max-spaces-inside: 1 + level: error + line-length: disable diff --git a/roles/node-exporter/CHANGELOG.md b/roles/node-exporter/CHANGELOG.md new file mode 100644 index 00000000..654322d2 --- /dev/null +++ b/roles/node-exporter/CHANGELOG.md @@ -0,0 +1,580 @@ +# Change Log + +## [**Next release**](https://galaxy.ansible.com/cloudalchemy/node_exporter) + +## [2.0.0] - 2021-04-19 +**Merged pull requests:** + +- Merge pull request [#219](https://github.com/cloudalchemy/ansible-node-exporter/issues/219) from cloudalchemy/skeleton +- :robot: sync with cloudalchemy/skeleton (SHA: 5ca88c27): Merge pull request [#9](https://github.com/cloudalchemy/ansible-node-exporter/issues/9) from cloudalchemy/superq/more_updates + + +## [1.0.0] - 2021-04-11 +**Merged pull requests:** + +- Merge pull request [#214](https://github.com/cloudalchemy/ansible-node-exporter/issues/214) from cloudalchemy/superq/envs +- Merge pull request [#213](https://github.com/cloudalchemy/ansible-node-exporter/issues/213) from cloudalchemy/superq/chglog +- Merge pull request [#212](https://github.com/cloudalchemy/ansible-node-exporter/issues/212) from cloudalchemy/superq/publisher_image +- Merge pull request [#209](https://github.com/cloudalchemy/ansible-node-exporter/issues/209) from cloudalchemy/autoupdate +- Merge pull request [#208](https://github.com/cloudalchemy/ansible-node-exporter/issues/208) from cloudalchemy/autoupdate +- Merge pull request [#207](https://github.com/cloudalchemy/ansible-node-exporter/issues/207) from nop33/fix-typos +- Merge pull request [#206](https://github.com/cloudalchemy/ansible-node-exporter/issues/206) from cloudalchemy/paulfantom-patch-1 +- Merge pull request [#204](https://github.com/cloudalchemy/ansible-node-exporter/issues/204) from cloudalchemy/bjk/update_requirements +- Merge pull request [#202](https://github.com/cloudalchemy/ansible-node-exporter/issues/202) from cloudalchemy/autoupdate +- Merge pull request [#197](https://github.com/cloudalchemy/ansible-node-exporter/issues/197) from cloudalchemy/paulfantom/fix-release +- Merge pull request [#196](https://github.com/cloudalchemy/ansible-node-exporter/issues/196) from kmille/master +- Merge pull request [#195](https://github.com/cloudalchemy/ansible-node-exporter/issues/195) from cloudalchemy/paulfantom/scenario-latest +- Merge pull request [#182](https://github.com/cloudalchemy/ansible-node-exporter/issues/182) from parmsib/patch-1 +- Merge pull request [#187](https://github.com/cloudalchemy/ansible-node-exporter/issues/187) from cloudalchemy/superq/internal_defaults +- Merge pull request [#193](https://github.com/cloudalchemy/ansible-node-exporter/issues/193) from cloudalchemy/paulfantom-patch-1 +- Merge pull request [#188](https://github.com/cloudalchemy/ansible-node-exporter/issues/188) from ctrlaltdel/master +- Merge pull request [#191](https://github.com/cloudalchemy/ansible-node-exporter/issues/191) from cloudalchemy/superq/circle_release +- Merge pull request [#190](https://github.com/cloudalchemy/ansible-node-exporter/issues/190) from cloudalchemy/superq/circleci +- Merge pull request [#189](https://github.com/cloudalchemy/ansible-node-exporter/issues/189) from cloudalchemy/moleculev3 +- Merge pull request [#184](https://github.com/cloudalchemy/ansible-node-exporter/issues/184) from thdhondt/patch-1 + + +## [0.22.0] - 2020-10-02 +### Chore +- troubleshooting document + +**Merged pull requests:** + +- Merge pull request [#179](https://github.com/cloudalchemy/ansible-node-exporter/issues/179) from kklimonda/master +- Merge pull request [#178](https://github.com/cloudalchemy/ansible-node-exporter/issues/178) from FilippoProjetto/patch-1 +- Merge pull request [#172](https://github.com/cloudalchemy/ansible-node-exporter/issues/172) from pngmbh/troubleshooting + + +## [0.21.5] - 2020-07-21 +**Merged pull requests:** + +- Merge pull request [#170](https://github.com/cloudalchemy/ansible-node-exporter/issues/170) from bittopaz/patch-1 + + +## [0.21.4] - 2020-07-20 +**Merged pull requests:** + +- Merge pull request [#169](https://github.com/cloudalchemy/ansible-node-exporter/issues/169) from cloudalchemy/superq/localhost_checksums + + +## [0.21.3] - 2020-06-18 +**Merged pull requests:** + +- Merge pull request [#163](https://github.com/cloudalchemy/ansible-node-exporter/issues/163) from sengel/missing_backslash + + +## [0.21.2] - 2020-06-18 +**Merged pull requests:** + +- always import install.yml when using local dir ([#162](https://github.com/cloudalchemy/ansible-node-exporter/issues/162)) + + +## [0.21.1] - 2020-06-17 +**Merged pull requests:** + +- New prometheus/node_exporter upstream release! ([#159](https://github.com/cloudalchemy/ansible-node-exporter/issues/159)) + + +## [0.21.0] - 2020-05-31 +**Merged pull requests:** + +- *: add support for node_exporter TLS settings ([#156](https://github.com/cloudalchemy/ansible-node-exporter/issues/156)) + + +## [0.20.0] - 2020-04-30 +**Merged pull requests:** + +- Use symbolic permissions for textfile collector dir ([#150](https://github.com/cloudalchemy/ansible-node-exporter/issues/150)) +- :robot: sync with cloudalchemy/skeleton (SHA: 40e7ce18): lock molecule to v2 ([#149](https://github.com/cloudalchemy/ansible-node-exporter/issues/149)) +- always validate GitHub certificate as there is no reason not to… ([#148](https://github.com/cloudalchemy/ansible-node-exporter/issues/148)) +- Install 'policycoreutils-python' on redhat/centos < 8 and fedora… ([#145](https://github.com/cloudalchemy/ansible-node-exporter/issues/145)) +- Add quotes to node_exporter parametrs in systemd service ([#144](https://github.com/cloudalchemy/ansible-node-exporter/issues/144)) + + +## [0.19.0] - 2020-01-31 +**Merged pull requests:** + +- remove system user management and convert variables to internal ones ([#142](https://github.com/cloudalchemy/ansible-node-exporter/issues/142)) +- Do not manage system directories ([#140](https://github.com/cloudalchemy/ansible-node-exporter/issues/140)) +- Add binary install directory ([#137](https://github.com/cloudalchemy/ansible-node-exporter/issues/137)) + + +## [0.18.0] - 2020-01-16 +**Merged pull requests:** + +- :robot: sync with cloudalchemy/skeleton (SHA: 69fc5be8): Merge pull request [#4](https://github.com/cloudalchemy/ansible-node-exporter/issues/4) from cloudalchemy/travis_fix ([#138](https://github.com/cloudalchemy/ansible-node-exporter/issues/138)) +- :robot: sync with cloudalchemy/skeleton (SHA: f4521f6a): use latest available python ([#136](https://github.com/cloudalchemy/ansible-node-exporter/issues/136)) +- Fix syntax on SELinux installation for clearlinux ([#134](https://github.com/cloudalchemy/ansible-node-exporter/issues/134)) +- tasks,vars: move selinux package dependencies into separate tasks to allow potential ootb support for more OSes ([#132](https://github.com/cloudalchemy/ansible-node-exporter/issues/132)) +- :robot: sync with cloudalchemy/skeleton (SHA: bb0f0949): remove IRC link ([#133](https://github.com/cloudalchemy/ansible-node-exporter/issues/133)) +- Updated README.md ([#129](https://github.com/cloudalchemy/ansible-node-exporter/issues/129)) +- add option to propagate binaries without access to internet ([#126](https://github.com/cloudalchemy/ansible-node-exporter/issues/126)) +- [REPO SYNC] add declarative label sync; add autolabelling PRs ([#123](https://github.com/cloudalchemy/ansible-node-exporter/issues/123)) + + +## [0.17.0] - 2019-11-14 +**Merged pull requests:** + +- [REPO SYNC] molecule: use CI images from quay.io instead of dock… ([#121](https://github.com/cloudalchemy/ansible-node-exporter/issues/121)) +- tasks: remove already covered entries when choosing an OS specific vars ([#118](https://github.com/cloudalchemy/ansible-node-exporter/issues/118)) +- Run preflight tasks to register variables when check_mode is enabled ([#117](https://github.com/cloudalchemy/ansible-node-exporter/issues/117)) +- tasks: do not touch any settings of system directory /usr/local/bin ([#116](https://github.com/cloudalchemy/ansible-node-exporter/issues/116)) +- [REPO SYNC] Update releaser.sh ([#120](https://github.com/cloudalchemy/ansible-node-exporter/issues/120)) +- [REPO SYNC] add support for CentOS8 ([#119](https://github.com/cloudalchemy/ansible-node-exporter/issues/119)) + + +## [0.16.0] - 2019-10-18 +**Merged pull requests:** + +- add official support for CentOS8 ([#114](https://github.com/cloudalchemy/ansible-node-exporter/issues/114)) +- molecule/default/tests: test if permissions of other files are u… ([#112](https://github.com/cloudalchemy/ansible-node-exporter/issues/112)) +- tasks: do not use alias for createhome as it seems to be broken ([#111](https://github.com/cloudalchemy/ansible-node-exporter/issues/111)) + + +## [0.15.0] - 2019-09-11 +**Merged pull requests:** + +- add RHEL8 and debian buster support; remove testing on debian jessie ([#101](https://github.com/cloudalchemy/ansible-node-exporter/issues/101)) +- Synchronize files from cloudalchemy/skeleton ([#102](https://github.com/cloudalchemy/ansible-node-exporter/issues/102)) +- :robot: synchronize with last commit in cloudalchemy/skeleton (SHA: 1f68dc21) ([#100](https://github.com/cloudalchemy/ansible-node-exporter/issues/100)) +- Moving to python 3 and dropping support for python 2.x (on deploy… ([#99](https://github.com/cloudalchemy/ansible-node-exporter/issues/99)) +- :robot: synchronize files from cloudalchemy/skeleton ([#97](https://github.com/cloudalchemy/ansible-node-exporter/issues/97)) +- added restartsec and startlimitinterval configurations ([#96](https://github.com/cloudalchemy/ansible-node-exporter/issues/96)) +- preflight: Fix detection of systemd version for systemd 240+ ([#93](https://github.com/cloudalchemy/ansible-node-exporter/issues/93)) +- Updated README with correct default value ([#92](https://github.com/cloudalchemy/ansible-node-exporter/issues/92)) +- node_exporter version check ([#91](https://github.com/cloudalchemy/ansible-node-exporter/issues/91)) + + +## [0.14.0] - 2019-06-05 +**Merged pull requests:** + +- Fix wrong size of /home shown by node-exporter ([#87](https://github.com/cloudalchemy/ansible-node-exporter/issues/87)) +- :tada: automated upstream release update ([#90](https://github.com/cloudalchemy/ansible-node-exporter/issues/90)) +- make node_exporter executable file root-owned ([#89](https://github.com/cloudalchemy/ansible-node-exporter/issues/89)) +- Add retries to package installs ([#88](https://github.com/cloudalchemy/ansible-node-exporter/issues/88)) +- Create suse.yml ([#86](https://github.com/cloudalchemy/ansible-node-exporter/issues/86)) +- New prometheus/node_exporter upstream release! ([#85](https://github.com/cloudalchemy/ansible-node-exporter/issues/85)) +- Synchronize files from cloudalchemy/skeleton ([#84](https://github.com/cloudalchemy/ansible-node-exporter/issues/84)) + + +## [0.13.1] - 2019-05-04 +**Merged pull requests:** + +- Fix systemd service startup ordering ([#83](https://github.com/cloudalchemy/ansible-node-exporter/issues/83)) + + +## [0.13.0] - 2019-04-01 +**Merged pull requests:** + +- fix preflight check responsible for collector enablement ([#81](https://github.com/cloudalchemy/ansible-node-exporter/issues/81)) +- Refactor preflight checks ([#79](https://github.com/cloudalchemy/ansible-node-exporter/issues/79)) +- make SELinux settings ipv6 compatible ([#78](https://github.com/cloudalchemy/ansible-node-exporter/issues/78)) +- fix(tasks/configure.yml): typo in task name ([#77](https://github.com/cloudalchemy/ansible-node-exporter/issues/77)) +- Add systemd state to started for first run of the role ([#72](https://github.com/cloudalchemy/ansible-node-exporter/issues/72)) +- reintroduce user management into defaults and add testing user creation ([#74](https://github.com/cloudalchemy/ansible-node-exporter/issues/74)) + + +## [0.12.1] - 2019-02-19 +**Merged pull requests:** + +- Correctly enable extra collectors ([#70](https://github.com/cloudalchemy/ansible-node-exporter/issues/70)) +- Lock down systemd service ([#68](https://github.com/cloudalchemy/ansible-node-exporter/issues/68)) + + +## [0.12.0] - 2018-12-17 +**Merged pull requests:** + +- Better tags and configuration handling ([#66](https://github.com/cloudalchemy/ansible-node-exporter/issues/66)) +- simplify automated CPU arch choosing ([#64](https://github.com/cloudalchemy/ansible-node-exporter/issues/64)) +- add alternative tests ([#65](https://github.com/cloudalchemy/ansible-node-exporter/issues/65)) + + +## [0.11.4] - 2018-12-05 +**Merged pull requests:** + +- Add support for multi-line ansible_managed strings ([#63](https://github.com/cloudalchemy/ansible-node-exporter/issues/63)) + + +## [0.11.3] - 2018-12-03 +**Merged pull requests:** + +- New node_exporter upstream release! ([#62](https://github.com/cloudalchemy/ansible-node-exporter/issues/62)) +- Remove setting niceness in systemd service file ([#60](https://github.com/cloudalchemy/ansible-node-exporter/issues/60)) + + +## [0.11.2] - 2018-10-08 +**Merged pull requests:** + +- move to ansible 2.7 ([#58](https://github.com/cloudalchemy/ansible-node-exporter/issues/58)) + + +## [0.11.1] - 2018-10-04 +**Merged pull requests:** + +- do not set specific capabilities ([#57](https://github.com/cloudalchemy/ansible-node-exporter/issues/57)) + + +## [0.11.0] - 2018-09-19 +**Merged pull requests:** + +- Add support for Clear linux ([#55](https://github.com/cloudalchemy/ansible-node-exporter/issues/55)) +- make textfile dir writable by node-exp group ([#56](https://github.com/cloudalchemy/ansible-node-exporter/issues/56)) + + +## [0.10.2] - 2018-09-06 +**Merged pull requests:** + +- reload-daemon on systemd enable ([#53](https://github.com/cloudalchemy/ansible-node-exporter/issues/53)) + + +## [0.10.1] - 2018-08-15 +**Merged pull requests:** + +- download checksum file only once ([#51](https://github.com/cloudalchemy/ansible-node-exporter/issues/51)) + + +## [0.10.0] - 2018-07-15 +**Merged pull requests:** + +- import_tasks instead of include; bringing role up to ansible-prometheus standards; minor changes ([#48](https://github.com/cloudalchemy/ansible-node-exporter/issues/48)) + + +## [0.9.0] - 2018-07-01 +**Merged pull requests:** + +- ansible 2.6 + allow remote docker host ([#46](https://github.com/cloudalchemy/ansible-node-exporter/issues/46)) +- use tox for running test matrix ([#45](https://github.com/cloudalchemy/ansible-node-exporter/issues/45)) + + +## [0.8.0] - 2018-06-10 +**Merged pull requests:** + +- Add support for textfile collector ([#42](https://github.com/cloudalchemy/ansible-node-exporter/issues/42)) + + +## [0.7.0] - 2018-06-10 +**Merged pull requests:** + +- Install newer node_exporter by default ([#36](https://github.com/cloudalchemy/ansible-node-exporter/issues/36)) +- specify file name for dest in get_url call ([#40](https://github.com/cloudalchemy/ansible-node-exporter/issues/40)) + + +## [0.6.20] - 2018-05-27 +**Merged pull requests:** + +- Fix architecture var parsing ([#39](https://github.com/cloudalchemy/ansible-node-exporter/issues/39)) +- Offer a better IRC Web clients to users ([#38](https://github.com/cloudalchemy/ansible-node-exporter/issues/38)) + + +## [0.6.19] - 2018-05-23 +**Merged pull requests:** + +- Fix failing role on non-SELinux RedHat ([#37](https://github.com/cloudalchemy/ansible-node-exporter/issues/37)) +- split download and unarchive and add checksum validation ([#35](https://github.com/cloudalchemy/ansible-node-exporter/issues/35)) +- move to molecule 2.x ([#34](https://github.com/cloudalchemy/ansible-node-exporter/issues/34)) + + +## [0.6.18] - 2018-04-13 +**Merged pull requests:** + +- Merge pull request [#33](https://github.com/cloudalchemy/ansible-node-exporter/issues/33) from nikosgraser/master + + +## [0.6.17] - 2018-04-12 +**Merged pull requests:** + +- Merge pull request [#32](https://github.com/cloudalchemy/ansible-node-exporter/issues/32) from Porkepix/skip_capabilities_check_mode + + +## [0.6.16] - 2018-04-06 +**Merged pull requests:** + +- Merge pull request [#31](https://github.com/cloudalchemy/ansible-node-exporter/issues/31) from Porkepix/fix_tests_as_filter +- Merge pull request [#30](https://github.com/cloudalchemy/ansible-node-exporter/issues/30) from Porkepix/fix_gitignore + + +## [0.6.15] - 2018-04-05 + +## [0.6.14] - 2018-04-02 +**Merged pull requests:** + +- retry downloads ([#29](https://github.com/cloudalchemy/ansible-node-exporter/issues/29)) + + +## [0.6.13] - 2018-03-30 +**Merged pull requests:** + +- Merge pull request [#28](https://github.com/cloudalchemy/ansible-node-exporter/issues/28) from Porkepix/fix-check_mode + + +## [0.6.12] - 2018-03-26 +**Merged pull requests:** + +- Merge pull request [#26](https://github.com/cloudalchemy/ansible-node-exporter/issues/26) from cloudalchemy/bionic + + +## [0.6.11] - 2018-03-24 +**Merged pull requests:** + +- Merge pull request [#27](https://github.com/cloudalchemy/ansible-node-exporter/issues/27) from cloudalchemy/new_ansible + + +## [0.6.10] - 2018-03-05 +**Merged pull requests:** + +- Merge pull request [#25](https://github.com/cloudalchemy/ansible-node-exporter/issues/25) from swesterveld/fix-warning-jinja-templating-delimiters + + +## [0.6.9] - 2018-02-18 +**Merged pull requests:** + +- Merge pull request [#24](https://github.com/cloudalchemy/ansible-node-exporter/issues/24) from cloudalchemy/fedora_support +- resolve [#18](https://github.com/cloudalchemy/ansible-node-exporter/issues/18) + + +## [0.6.8] - 2018-02-14 +**Merged pull requests:** + +- Merge pull request [#23](https://github.com/cloudalchemy/ansible-node-exporter/issues/23) from swesterveld/fix_daemon_reload_for_role_include + + +## [0.6.7] - 2018-01-14 +**Merged pull requests:** + +- custom dockerfiles; support more OSes ([#21](https://github.com/cloudalchemy/ansible-node-exporter/issues/21)) + + +## [0.6.6] - 2018-01-13 +**Merged pull requests:** + +- Add preflight checks ([#22](https://github.com/cloudalchemy/ansible-node-exporter/issues/22)) + + +## [0.6.5] - 2018-01-13 +**Merged pull requests:** + +- Merge pull request [#20](https://github.com/cloudalchemy/ansible-node-exporter/issues/20) from cloudalchemy/paulfantom-patch-1 + + +## [0.6.4] - 2018-01-09 +**Merged pull requests:** + +- Merge pull request [#19](https://github.com/cloudalchemy/ansible-node-exporter/issues/19) from cloudalchemy/issue17 + + +## [0.6.3] - 2018-01-08 + +## [0.6.2] - 2018-01-06 +**Merged pull requests:** + +- Merge pull request [#15](https://github.com/cloudalchemy/ansible-node-exporter/issues/15) from cloudalchemy/minor_fix + + +## [0.6.1] - 2018-01-04 +**Merged pull requests:** + +- Merge pull request [#14](https://github.com/cloudalchemy/ansible-node-exporter/issues/14) from cloudalchemy/paulfantom-patch-1 +- Merge pull request [#13](https://github.com/cloudalchemy/ansible-node-exporter/issues/13) from cloudalchemy/docs + + +## [0.6.0] - 2018-01-02 +**Merged pull requests:** + +- Merge pull request [#12](https://github.com/cloudalchemy/ansible-node-exporter/issues/12) from cloudalchemy/paulfantom-patch-1 + + +## [0.5.11] - 2018-01-02 +**Merged pull requests:** + +- Merge pull request [#11](https://github.com/cloudalchemy/ansible-node-exporter/issues/11) from cloudalchemy/raspberrypi + + +## [0.5.10] - 2018-01-01 +**Merged pull requests:** + +- Merge pull request [#10](https://github.com/cloudalchemy/ansible-node-exporter/issues/10) from cloudalchemy/disabled_collectors + + +## [0.5.9] - 2017-12-27 +**Merged pull requests:** + +- Merge pull request [#9](https://github.com/cloudalchemy/ansible-node-exporter/issues/9) from anisse/patch-1 + + +## [0.5.8] - 2017-12-27 +**Merged pull requests:** + +- Merge pull request [#8](https://github.com/cloudalchemy/ansible-node-exporter/issues/8) from anisse/patch-3 + + +## [0.5.7] - 2017-12-15 +**Merged pull requests:** + +- Merge pull request [#6](https://github.com/cloudalchemy/ansible-node-exporter/issues/6) from cloudalchemy/go_arch +- Merge pull request [#7](https://github.com/cloudalchemy/ansible-node-exporter/issues/7) from cloudalchemy/version + + +## [0.5.6] - 2017-12-06 +**Merged pull requests:** + +- Merge pull request [#4](https://github.com/cloudalchemy/ansible-node-exporter/issues/4) from cloudalchemy/paulfantom-patch-1 + + +## [0.5.5] - 2017-11-30 + +## [0.5.4] - 2017-11-30 + +## [0.5.3] - 2017-11-29 +**Merged pull requests:** + +- Merge pull request [#1](https://github.com/cloudalchemy/ansible-node-exporter/issues/1) from cloudalchemy/ci + + +## [0.5.1] - 2017-11-09 +**Merged pull requests:** + +- Merge pull request [#10](https://github.com/cloudalchemy/ansible-node-exporter/issues/10) from SoInteractive/version_upgrade + + +## [0.5.0] - 2017-10-16 +**Merged pull requests:** + +- Merge pull request [#9](https://github.com/cloudalchemy/ansible-node-exporter/issues/9) from SoInteractive/feature_travis + + +## [0.4.3] - 2017-10-12 +**Merged pull requests:** + +- Merge pull request [#8](https://github.com/cloudalchemy/ansible-node-exporter/issues/8) from SoInteractive/Add_selinux + + +## [0.4.2] - 2017-10-05 +**Merged pull requests:** + +- Merge pull request [#7](https://github.com/cloudalchemy/ansible-node-exporter/issues/7) from SoInteractive/systemd + + +## [0.4.1] - 2017-09-26 +**Merged pull requests:** + +- Merge pull request [#6](https://github.com/cloudalchemy/ansible-node-exporter/issues/6) from SoInteractive/fix_typo + + +## [0.4.0] - 2017-09-20 +**Merged pull requests:** + +- Merge pull request [#5](https://github.com/cloudalchemy/ansible-node-exporter/issues/5) from paulfantom/feature_installation + + +## [0.3.3] - 2017-08-09 + +## [0.3.4] - 2017-08-09 +**Merged pull requests:** + +- Merge pull request [#4](https://github.com/cloudalchemy/ansible-node-exporter/issues/4) from SoInteractive/testing_branch + + +## [0.3.2] - 2017-07-26 + +## [0.3.1] - 2017-07-26 +**Merged pull requests:** + +- Merge pull request [#3](https://github.com/cloudalchemy/ansible-node-exporter/issues/3) from SoInteractive/fix_user_uid + + +## [0.3.0] - 2017-07-21 + +## [0.2.0] - 2017-07-21 +**Merged pull requests:** + +- Merge pull request [#2](https://github.com/cloudalchemy/ansible-node-exporter/issues/2) from SoInteractive/feature_autoupdate_minor + + +## [0.1.2] - 2017-06-14 + +## [0.1.1] - 2017-06-14 + +## [0.1.0] - 2017-06-06 + +## [0.0.2] - 2017-05-18 + +## 0.0.1 - 2017-05-04 + +[Unreleased]: https://github.com/cloudalchemy/ansible-node-exporter/compare/2.0.0...HEAD +[2.0.0]: https://github.com/cloudalchemy/ansible-node-exporter/compare/1.0.0...2.0.0 +[1.0.0]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.22.0...1.0.0 +[0.22.0]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.21.5...0.22.0 +[0.21.5]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.21.4...0.21.5 +[0.21.4]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.21.3...0.21.4 +[0.21.3]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.21.2...0.21.3 +[0.21.2]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.21.1...0.21.2 +[0.21.1]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.21.0...0.21.1 +[0.21.0]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.20.0...0.21.0 +[0.20.0]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.19.0...0.20.0 +[0.19.0]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.18.0...0.19.0 +[0.18.0]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.17.0...0.18.0 +[0.17.0]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.16.0...0.17.0 +[0.16.0]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.15.0...0.16.0 +[0.15.0]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.14.0...0.15.0 +[0.14.0]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.13.1...0.14.0 +[0.13.1]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.13.0...0.13.1 +[0.13.0]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.12.1...0.13.0 +[0.12.1]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.12.0...0.12.1 +[0.12.0]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.11.4...0.12.0 +[0.11.4]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.11.3...0.11.4 +[0.11.3]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.11.2...0.11.3 +[0.11.2]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.11.1...0.11.2 +[0.11.1]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.11.0...0.11.1 +[0.11.0]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.10.2...0.11.0 +[0.10.2]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.10.1...0.10.2 +[0.10.1]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.10.0...0.10.1 +[0.10.0]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.9.0...0.10.0 +[0.9.0]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.8.0...0.9.0 +[0.8.0]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.7.0...0.8.0 +[0.7.0]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.6.20...0.7.0 +[0.6.20]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.6.19...0.6.20 +[0.6.19]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.6.18...0.6.19 +[0.6.18]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.6.17...0.6.18 +[0.6.17]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.6.16...0.6.17 +[0.6.16]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.6.15...0.6.16 +[0.6.15]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.6.14...0.6.15 +[0.6.14]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.6.13...0.6.14 +[0.6.13]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.6.12...0.6.13 +[0.6.12]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.6.11...0.6.12 +[0.6.11]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.6.10...0.6.11 +[0.6.10]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.6.9...0.6.10 +[0.6.9]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.6.8...0.6.9 +[0.6.8]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.6.7...0.6.8 +[0.6.7]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.6.6...0.6.7 +[0.6.6]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.6.5...0.6.6 +[0.6.5]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.6.4...0.6.5 +[0.6.4]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.6.3...0.6.4 +[0.6.3]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.6.2...0.6.3 +[0.6.2]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.6.1...0.6.2 +[0.6.1]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.6.0...0.6.1 +[0.6.0]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.5.11...0.6.0 +[0.5.11]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.5.10...0.5.11 +[0.5.10]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.5.9...0.5.10 +[0.5.9]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.5.8...0.5.9 +[0.5.8]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.5.7...0.5.8 +[0.5.7]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.5.6...0.5.7 +[0.5.6]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.5.5...0.5.6 +[0.5.5]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.5.4...0.5.5 +[0.5.4]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.5.3...0.5.4 +[0.5.3]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.5.1...0.5.3 +[0.5.1]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.5.0...0.5.1 +[0.5.0]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.4.3...0.5.0 +[0.4.3]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.4.2...0.4.3 +[0.4.2]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.4.1...0.4.2 +[0.4.1]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.4.0...0.4.1 +[0.4.0]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.3.3...0.4.0 +[0.3.3]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.3.4...0.3.3 +[0.3.4]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.3.2...0.3.4 +[0.3.2]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.3.1...0.3.2 +[0.3.1]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.3.0...0.3.1 +[0.3.0]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.2.0...0.3.0 +[0.2.0]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.1.2...0.2.0 +[0.1.2]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.1.1...0.1.2 +[0.1.1]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.1.0...0.1.1 +[0.1.0]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.0.2...0.1.0 +[0.0.2]: https://github.com/cloudalchemy/ansible-node-exporter/compare/0.0.1...0.0.2 diff --git a/roles/node-exporter/CONTRIBUTING.md b/roles/node-exporter/CONTRIBUTING.md new file mode 100644 index 00000000..f922673f --- /dev/null +++ b/roles/node-exporter/CONTRIBUTING.md @@ -0,0 +1,98 @@ +# Contributor Guideline + +This document provides an overview of how you can participate in improving this project or extending it. We are +grateful for all your help: bug reports and fixes, code contributions, documentation or ideas. Feel free to join, we +appreciate your support!! + +## Communication + +### GitHub repositories + +Much of the issues, goals and ideas are tracked in the respective projects in GitHub. Please use this channel to report +bugs, ask questions, and request new features . + +## git and GitHub + +In order to contribute code please: + +1. Fork the project on GitHub +2. Clone the project +3. Add changes (and tests) +4. Commit and push +5. Create a merge-request + +To have your code merged, see the expectations listed below. + +You can find a well-written guide [here](https://help.github.com/articles/fork-a-repo). + +Please follow common commit best-practices. Be explicit, have a short summary, a well-written description and +references. This is especially important for the merge-request. + +Some great guidelines can be found [here](https://wiki.openstack.org/wiki/GitCommitMessages) and +[here](http://robots.thoughtbot.com/5-useful-tips-for-a-better-commit-message). + +## Releases + +We try to stick to semantic versioning and our releases are automated. Release is created by assigning a keyword (in a +way similar to circle ci keyword [`[ci skip]`](https://docs.travis-ci.com/user/customizing-the-build#Skipping-a-build)) +to a commit with merge request. Available keywords are (square brackets are important!): + +* `[patch]`, `[fix]`, `[bugfix]` - for PATCH version release +* `[minor]`, `[feature]`, `[feat]` - for MINOR version release +* `[major]`, `[breaking change]` - for MAJOR version release + +## Changelog + +Changelog is generated automatically during release process and all information is taken from github issues, PRs and +labels. + +## Expectations + +### Keep it simple + +We try to provide production ready ansible roles which should be as much zero-conf as possible but this doesn't mean to +overcomplicate things. Just follow [KISS](https://en.wikipedia.org/wiki/KISS_principle). + +### Be explicit + +* Please avoid using nonsensical property and variable names. +* Use self-describing attribute names for user configuration. +* In case of failures, communicate what happened and why a failure occurs to the user. Make it easy to track the code +or action that produced the error. Try to catch and handle errors if possible to provide improved failure messages. + + +### Add tests + +We are striving to use at least two test scenarios located in [/molecule](molecule) directory. First one +([default](molecule/default)) is testing default configuration without any additional variables, second one +([alternative](molecule/alternative)) is testing what happens when many variables from +[/defaults/main.yml](defaults/main.yml) are changed. When adding new functionalities please add tests to proper +scenarios. Tests are written in testinfra framework and are located in `/tests` subdirectory of scenario directory +(for example default tests are in [/molecule/default/tests](molecule/default/tests)). +More information about: + - [testinfra](http://testinfra.readthedocs.io/en/latest/index.html) + - [molecule](https://molecule.readthedocs.io/en/latest/index.html) + +### Follow best practices + +Please follow [ansible best practices](http://docs.ansible.com/ansible/latest/playbooks_best_practices.html) and +especially provide meaningful names to tasks and even comments where needed. + +Our test framework automatically lints code with [`yamllint`](https://github.com/adrienverge/yamllint), +[`ansible-lint`](https://github.com/willthames/ansible-lint), and [`flake8`](https://gitlab.com/pycqa/flake8) programs +so be sure to follow their rules. + +Remember: Code is generally read much more often than written. + +### Use Markdown + +Wherever possible, please refrain from any other formats and stick to simple markdown. + +## Requirements regarding roles design + +We are trying to create the best and most secure installation method for non-containerized prometheus stack components. +To accomplish this all roles need to support: + +- current and at least one previous ansible version +- systemd as the only available process manager +- at least latest debian and CentOS distributions diff --git a/roles/node-exporter/LICENSE b/roles/node-exporter/LICENSE new file mode 100644 index 00000000..2b1b2c03 --- /dev/null +++ b/roles/node-exporter/LICENSE @@ -0,0 +1,21 @@ +The MIT License (MIT) + +Copyright (c) 2017-2018 Pawel Krupa and Roman Demachkovych + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/roles/node-exporter/README.md b/roles/node-exporter/README.md new file mode 100644 index 00000000..df501076 --- /dev/null +++ b/roles/node-exporter/README.md @@ -0,0 +1,108 @@ + +############# Repris du rôle de Cloud Alchemy https://github.com/cloudalchemy/ansible-node-exporter + + +

graph logo

+ +# Ansible Role: node exporter + +[![Build Status](https://travis-ci.org/cloudalchemy/ansible-node-exporter.svg?branch=master)](https://travis-ci.org/cloudalchemy/ansible-node-exporter) +[![License](https://img.shields.io/badge/license-MIT%20License-brightgreen.svg)](https://opensource.org/licenses/MIT) +[![Ansible Role](https://img.shields.io/badge/ansible%20role-cloudalchemy.node_exporter-blue.svg)](https://galaxy.ansible.com/cloudalchemy/node_exporter/) +[![GitHub tag](https://img.shields.io/github/tag/cloudalchemy/ansible-node-exporter.svg)](https://github.com/cloudalchemy/ansible-node-exporter/tags) + +## Warning + +Due to limitations of galaxy.ansible.com we had to move the role to https://galaxy.ansible.com/cloudalchemy/node_exporter and use `_` instead of `-` in role name. This is a breaking change and unfortunately, it affects all versions of node_exporter role as ansible galaxy doesn't offer any form of redirection. We are sorry for the inconvenience. + +## Description + +Deploy prometheus [node exporter](https://github.com/prometheus/node_exporter) using ansible. + +## Requirements + +- Ansible >= 2.7 (It might work on previous versions, but we cannot guarantee it) +- gnu-tar on Mac deployer host (`brew install gnu-tar`) +- Passlib is required when using the basic authentication feature (`pip install passlib[bcrypt]`) + +## Role Variables + +All variables which can be overridden are stored in [defaults/main.yml](defaults/main.yml) and are listed in the table below. + +| Name | Default Value | Description | +| -------------- | ------------- | -----------------------------------| +| `node_exporter_version` | 1.1.2 | Node exporter package version. Also accepts latest as parameter. | +| `node_exporter_binary_local_dir` | "" | Enables the use of local packages instead of those distributed on github. The parameter may be set to a directory where the `node_exporter` binary is stored on the host where ansible is run. This overrides the `node_exporter_version` parameter | +| `app_main_port` | "9100" | Port on which node exporter will listen | +| `node_exporter_web_telemetry_path` | "/metrics" | Path under which to expose metrics | +| `node_exporter_enabled_collectors` | ```["systemd",{textfile: {directory: "{{node_exporter_textfile_dir}}"}}]``` | List of dicts defining additionally enabled collectors and their configuration. It adds collectors to [those enabled by default](https://github.com/prometheus/node_exporter#enabled-by-default). | +| `node_exporter_disabled_collectors` | [] | List of disabled collectors. By default node_exporter disables collectors listed [here](https://github.com/prometheus/node_exporter#disabled-by-default). | +| `node_exporter_textfile_dir` | "/var/lib/node_exporter" | Directory used by the [Textfile Collector](https://github.com/prometheus/node_exporter#textfile-collector). To get permissions to write metrics in this directory, users must be in `node-exp` system group. __Note__: More information in TROUBLESHOOTING.md guide. +| `node_exporter_tls_server_config` | {} | Configuration for TLS authentication. Keys and values are the same as in [node_exporter docs](https://github.com/prometheus/node_exporter/blob/master/https/README.md#sample-config). | +| `node_exporter_http_server_config` | {} | Config for HTTP/2 support. Keys and values are the same as in [node_exporter docs](https://github.com/prometheus/node_exporter/blob/master/https/README.md#sample-config). | +| `node_exporter_basic_auth_users` | {} | Dictionary of users and password for basic authentication. Passwords are automatically hashed with bcrypt. | + +## Example + +### Playbook + +Use it in a playbook as follows: +```yaml +- hosts: all + roles: + - cloudalchemy.node_exporter +``` + +### TLS config + +Before running node_exporter role, the user needs to provision their own certificate and key. +```yaml +- hosts: all + pre_tasks: + - name: Create node_exporter cert dir + file: + path: "/etc/node_exporter" + state: directory + owner: root + group: root + + - name: Create cert and key + openssl_certificate: + path: /etc/node_exporter/tls.cert + csr_path: /etc/node_exporter/tls.csr + privatekey_path: /etc/node_exporter/tls.key + provider: selfsigned + roles: + - cloudalchemy.node_exporter + vars: + node_exporter_tls_server_config: + cert_file: /etc/node_exporter/tls.cert + key_file: /etc/node_exporter/tls.key + node_exporter_basic_auth_users: + randomuser: examplepassword +``` + + +### Demo site + +We provide an example site that demonstrates a full monitoring solution based on prometheus and grafana. The repository with code and links to running instances is [available on github](https://github.com/cloudalchemy/demo-site) and the site is hosted on [DigitalOcean](https://digitalocean.com). + +## Local Testing + +The preferred way of locally testing the role is to use Docker and [molecule](https://github.com/ansible-community/molecule) (v3.x). You will have to install Docker on your system. See "Get started" for a Docker package suitable for your system. Running your tests is as simple as executing `molecule test`. + +## Continuous Integration + +Combining molecule and circle CI allows us to test how new PRs will behave when used with multiple ansible versions and multiple operating systems. This also allows use to create test scenarios for different role configurations. As a result we have quite a large test matrix which can take more time than local testing, so please be patient. + +## Contributing + +See [contributor guideline](CONTRIBUTING.md). + +## Troubleshooting + +See [troubleshooting](TROUBLESHOOTING.md). + +## License + +This project is licensed under MIT License. See [LICENSE](/LICENSE) for more details. diff --git a/roles/node-exporter/TROUBLESHOOTING.md b/roles/node-exporter/TROUBLESHOOTING.md new file mode 100644 index 00000000..f5653912 --- /dev/null +++ b/roles/node-exporter/TROUBLESHOOTING.md @@ -0,0 +1,43 @@ +# Troubleshooting + +## Bad requests (HTTP 400) + +This role downloads checksums from the Github project to verify the integrity of artifacts installed on your servers. When downloading the checksums, a "bad request" error might occur. + +This happens in environments which (knowningly or unknowling) use the [netrc mechanism](https://www.gnu.org/software/inetutils/manual/html_node/The-_002enetrc-file.html) to auto-login into servers. + +Unless netrc is needed by your playbook and ansible roles, please unset the var like so: + +``` +$ NETRC= ansible-playbook ... +``` + +Or: + +``` +$ export NETRC= +$ ansible-playbook ... +``` + +## node_exporter doesn't report data from textfile collector + +There are 3 potential issues why node_exporter doesn't pick up data: + +1. Duplicated metrics across multiple files. +2. File is not readable by node_exporter process. +3. Textfile collector is not enabled. + +Solving first possibility is out of scope of the role as data is created somewhere else. When creating that data ensure +files are readable by `node-exp` user. To get access to the directory with files your process needs to be in `node-exp` +group. + +Lastly ansible role misconfiguration can also lead to data not being picked up. Check if `node_exporter` textfile +collector is enabled in `node_exporter_enabled_collectors` as follows: + +```yaml +node_exporter_enabled_collectors: + - textfile: + directory: "{{ node_exporter_textfile_dir }}" +``` + +__note___: `node_exporter_textfile_dir` variable is only responsible for creating a directory not enabling a collector. diff --git a/roles/node-exporter/defaults/main.yml b/roles/node-exporter/defaults/main.yml new file mode 100644 index 00000000..9d84bd17 --- /dev/null +++ b/roles/node-exporter/defaults/main.yml @@ -0,0 +1,29 @@ +--- +node_exporter_version: 1.3.1 +node_exporter_binary_local_dir: "" +node_exporter_web_telemetry_path: "/metrics" + +app_main_port: 9100 + +node_exporter_textfile_dir: "/var/lib/node_exporter" + +node_exporter_tls_server_config: {} + +node_exporter_http_server_config: {} + +node_exporter_basic_auth_users: {} + +node_exporter_enabled_collectors: + - systemd + - textfile: + directory: "{{ node_exporter_textfile_dir }}" +# - filesystem: +# ignored-mount-points: "^/(sys|proc|dev)($|/)" +# ignored-fs-types: "^(sys|proc|auto)fs$" + +node_exporter_disabled_collectors: [] + +# Internal variables. +_node_exporter_binary_install_dir: "/usr/local/bin" +_node_exporter_system_group: "node-exp" +_node_exporter_system_user: "{{ _node_exporter_system_group }}" diff --git a/roles/node-exporter/handlers/main.yml b/roles/node-exporter/handlers/main.yml new file mode 100644 index 00000000..225d6edd --- /dev/null +++ b/roles/node-exporter/handlers/main.yml @@ -0,0 +1,10 @@ +--- +- name: restart node_exporter + become: true + systemd: + daemon_reload: true + name: node_exporter + state: restarted + +- name: reload nginx node_exporter + service: name=nginx state=reloaded diff --git a/roles/node-exporter/tasks/configure.yml b/roles/node-exporter/tasks/configure.yml new file mode 100644 index 00000000..70bbedc5 --- /dev/null +++ b/roles/node-exporter/tasks/configure.yml @@ -0,0 +1,37 @@ +--- +- name: Copy the node_exporter systemd service file + template: + src: node_exporter.service.j2 + dest: /etc/systemd/system/node_exporter.service + owner: root + group: root + mode: 0644 + notify: restart node_exporter + +- block: + - name: Create node_exporter config directory + file: + path: "/etc/node_exporter" + state: directory + owner: root + group: root + mode: u+rwX,g+rwX,o=rX + + - name: Copy the node_exporter config file + template: + src: config.yaml.j2 + dest: /etc/node_exporter/config.yaml + owner: root + group: root + mode: 0644 + notify: restart node_exporter + +- name: Create textfile collector dir + file: + path: "{{ node_exporter_textfile_dir }}" + state: directory + owner: "{{ _node_exporter_system_user }}" + group: "{{ _node_exporter_system_group }}" + recurse: true + mode: u+rwX,g+rwX,o=rX + when: node_exporter_textfile_dir | length > 0 diff --git a/roles/node-exporter/tasks/install.yml b/roles/node-exporter/tasks/install.yml new file mode 100644 index 00000000..3462a9c6 --- /dev/null +++ b/roles/node-exporter/tasks/install.yml @@ -0,0 +1,96 @@ +--- +- name: Create the node_exporter group + group: + name: "{{ _node_exporter_system_group }}" + state: present + system: true + when: _node_exporter_system_group != "root" + +- name: Create the node_exporter user + user: + name: "{{ _node_exporter_system_user }}" + groups: "{{ _node_exporter_system_group }}" + append: true + shell: /usr/sbin/nologin + system: true + create_home: false + home: / + when: _node_exporter_system_user != "root" + +- name: "directory for www logs mounted in jail" + file: + state: directory + path: "{{ app_instance_root }}/../logs" + mode: 0711 + owner: "{{ app_user }}" + group: "{{ app_group }}" + when: app_user is defined + +- name: "template nginx_app.j2 {{ app_instance_id }}" + template: + src: "nginx_app.j2" + dest: "/etc/nginx/sites-available/{{ app_instance_id }}.conf" + notify: reload nginx grafana + tags: + - rev_proxy + +- block: + - name: Download node_exporter binary to local folder + become: false + get_url: + url: "https://github.com/prometheus/node_exporter/releases/download/v{{ node_exporter_version }}/node_exporter-{{ node_exporter_version }}.linux-{{ go_arch }}.tar.gz" + dest: "/tmp/node_exporter-{{ node_exporter_version }}.linux-{{ go_arch }}.tar.gz" + checksum: "sha256:{{ node_exporter_checksum }}" + mode: '0644' + register: _download_binary + until: _download_binary is succeeded + retries: 5 + delay: 2 + delegate_to: localhost + check_mode: false + + - name: Unpack node_exporter binary + become: false + unarchive: + src: "/tmp/node_exporter-{{ node_exporter_version }}.linux-{{ go_arch }}.tar.gz" + dest: "/tmp" + creates: "/tmp/node_exporter-{{ node_exporter_version }}.linux-{{ go_arch }}/node_exporter" + delegate_to: localhost + check_mode: false + + - name: Propagate node_exporter binaries + copy: + src: "/tmp/node_exporter-{{ node_exporter_version }}.linux-{{ go_arch }}/node_exporter" + dest: "{{ _node_exporter_binary_install_dir }}/node_exporter" + mode: 0755 + owner: root + group: root + notify: restart node_exporter + when: not ansible_check_mode + when: node_exporter_binary_local_dir | length == 0 + +- name: propagate locally distributed node_exporter binary + copy: + src: "{{ node_exporter_binary_local_dir }}/node_exporter" + dest: "{{ _node_exporter_binary_install_dir }}/node_exporter" + mode: 0755 + owner: root + group: root + when: node_exporter_binary_local_dir | length > 0 + notify: restart node_exporter + +- name: log rotate + import_role: + name: _app_logrotate + +- name: "enable site for {{ app_domain }}" + file: + state: link + path: "/etc/nginx/sites-enabled/{{ app_instance_id }}.conf" + src: "/etc/nginx/sites-available/{{ app_instance_id }}.conf" + notify: reload nginx node_exporter + +- name: Add monit + import_role: + name: _app_monit + when: monit_request is defined and monit_request != '' \ No newline at end of file diff --git a/roles/node-exporter/tasks/main.yml b/roles/node-exporter/tasks/main.yml new file mode 100644 index 00000000..2a4ee706 --- /dev/null +++ b/roles/node-exporter/tasks/main.yml @@ -0,0 +1,35 @@ +--- +- name: Check if node_exporter is installed + stat: + path: "{{ _node_exporter_binary_install_dir }}/node_exporter" + register: __node_exporter_is_installed + check_mode: false + tags: + - node_exporter_install + +- import_tasks: install.yml + become: true + when: + ( not __node_exporter_is_installed.stat.exists ) or + ( (__node_exporter_current_version_output.stderr_lines | length > 0) and (__node_exporter_current_version_output.stderr_lines[0].split(" ")[2] != node_exporter_version) ) or + ( (__node_exporter_current_version_output.stdout_lines | length > 0) and (__node_exporter_current_version_output.stdout_lines[0].split(" ")[2] != node_exporter_version) ) or + ( node_exporter_binary_local_dir | length > 0 ) + tags: + - node_exporter_install + +- import_tasks: configure.yml + become: true + tags: + - node_exporter_configure + +- name: Ensure Node Exporter is enabled on boot + become: true + systemd: + daemon_reload: true + name: node_exporter + enabled: true + state: started + when: + - not ansible_check_mode + tags: + - node_exporter_run diff --git a/roles/node-exporter/templates/config.yaml.j2 b/roles/node-exporter/templates/config.yaml.j2 new file mode 100644 index 00000000..57fc8530 --- /dev/null +++ b/roles/node-exporter/templates/config.yaml.j2 @@ -0,0 +1,16 @@ +--- +{{ ansible_managed | comment }} +{% if node_exporter_tls_server_config | length > 0 %} +tls_server_config: +{{ node_exporter_tls_server_config | to_nice_yaml | indent(2, true) }} +{% endif %} + +{% if node_exporter_http_server_config | length > 0 %} +http_server_config: +{{ node_exporter_http_server_config | to_nice_yaml | indent(2, true) }} +{% endif %} + +{% if admin_pwd is defined %} +basic_auth_users: + - admin: {{ admin_pwd }} +{% endif %} diff --git a/roles/node-exporter/templates/nginx_app.j2 b/roles/node-exporter/templates/nginx_app.j2 new file mode 100644 index 00000000..4b34402a --- /dev/null +++ b/roles/node-exporter/templates/nginx_app.j2 @@ -0,0 +1,67 @@ +map $http_user_agent $log_ua { + ~Monit 0; + default 1; +} + +server { + listen 80; + listen [::]:80; + server_name {{ app_domain | mandatory }}; + # enforce https + return 301 https://$server_name$request_uri; +} + +server { + listen 443 ssl http2; + listen [::]:443 ssl http2; + server_name {{ app_domain }}; + + ssl_certificate /etc/letsencrypt/live/{{ app_domain }}/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/{{ app_domain }}/privkey.pem; + + # Add headers to serve security related headers + # Before enabling Strict-Transport-Security headers please read into this + # topic first. + # add_header Strict-Transport-Security "max-age=15768000; + # includeSubDomains; preload;"; + # + # WARNING: Only add the preload option once you read about + # the consequences in https://hstspreload.org/. This option + # will add the domain to a hardcoded list that is shipped + # in all major browsers and getting removed from this list + # could take several months. + + add_header X-Content-Type-Options nosniff; + add_header X-XSS-Protection "1; mode=block"; + add_header X-Robots-Tag all; # https://developers.google.com/search/docs/advanced/robots/robots_meta_tag + add_header X-Download-Options noopen; + add_header X-Permitted-Cross-Domain-Policies none; + add_header Strict-Transport-Security "max-age=15768000"; + + # Enable gzip but do not remove ETag headers + gzip on; + gzip_vary on; + gzip_comp_level 4; + gzip_min_length 256; + gzip_proxied expired no-cache no-store private no_last_modified no_etag auth; + gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy; + + + access_log {{ www_log }}/{{ app_instance_id }}/access.log combined if=$log_ua; + error_log {{ www_log }}/{{ app_instance_id }}/error.log; + + # set max upload size + client_max_body_size 512M; + fastcgi_buffers 64 4K; + + + location / { + proxy_set_header HOST $host; + proxy_set_header X-Forwarded-Proto https; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Host $server_name; + proxy_pass http://localhost:{{ app_main_port }}; + } + +} diff --git a/roles/node-exporter/templates/node_exporter.service.j2 b/roles/node-exporter/templates/node_exporter.service.j2 new file mode 100644 index 00000000..07d14767 --- /dev/null +++ b/roles/node-exporter/templates/node_exporter.service.j2 @@ -0,0 +1,51 @@ +{{ ansible_managed | comment }} + +[Unit] +Description=Prometheus Node Exporter +After=network-online.target + +[Service] +Type=simple +User={{ _node_exporter_system_user }} +Group={{ _node_exporter_system_group }} +ExecStart={{ _node_exporter_binary_install_dir }}/node_exporter \ +{% for collector in node_exporter_enabled_collectors -%} +{% if not collector is mapping %} + --collector.{{ collector }} \ +{% else -%} +{% set name, options = (collector.items()|list)[0] -%} + --collector.{{ name }} \ +{% for k,v in options|dictsort %} + --collector.{{ name }}.{{ k }}={{ v | quote }} \ +{% endfor -%} +{% endif -%} +{% endfor -%} +{% for collector in node_exporter_disabled_collectors %} + --no-collector.{{ collector }} \ +{% endfor %} +{% if node_exporter_tls_server_config | length > 0 or node_exporter_http_server_config | length > 0 or node_exporter_basic_auth_users | length > 0 %} + --web.config=/etc/node_exporter/config.yaml \ +{% endif %} + --web.listen-address=0.0.0.0:{{ app_main_port }} \ + --web.telemetry-path={{ node_exporter_web_telemetry_path }} + +SyslogIdentifier=node_exporter +Restart=always +RestartSec=1 +StartLimitInterval=0 + +{% for m in ansible_mounts if m.mount == '/home' %} +ProtectHome=read-only +{% else %} +ProtectHome=yes +{% endfor %} +NoNewPrivileges=yes + +ProtectSystem=strict +ProtectControlGroups=true +ProtectKernelModules=true +ProtectKernelTunables=yes + + +[Install] +WantedBy=multi-user.target diff --git a/roles/node-exporter/test-requirements.txt b/roles/node-exporter/test-requirements.txt new file mode 100644 index 00000000..1b6e9a96 --- /dev/null +++ b/roles/node-exporter/test-requirements.txt @@ -0,0 +1,8 @@ +molecule>=3.0.0 +molecule-docker +docker +ansible-lint>=3.4.0 +testinfra>=1.7.0 +jmespath +selinux +passlib diff --git a/roles/node-exporter/vars/main.yml b/roles/node-exporter/vars/main.yml new file mode 100644 index 00000000..1025a878 --- /dev/null +++ b/roles/node-exporter/vars/main.yml @@ -0,0 +1,5 @@ +--- +go_arch_map: + x86_64: 'amd64' + +go_arch: "{{ go_arch_map[ansible_architecture] | default(ansible_architecture) }}" -- GitLab From 17b37517b7e3d08db15e9325ea02c18a5d970cc4 Mon Sep 17 00:00:00 2001 From: Admin paquerette Date: Wed, 16 Mar 2022 16:47:16 +0100 Subject: [PATCH 09/19] [fix] Divers corrections --- roles/node-exporter/defaults/main.yml | 1 + roles/node-exporter/tasks/install.yml | 9 +++++++-- roles/node-exporter/tasks/main.yml | 13 +++++-------- roles/node-exporter/tasks/uninstall.yml | 0 roles/node-exporter/templates/config.yaml.j2 | 2 +- .../templates/node_exporter.service.j2 | 2 +- roles/prometheus/tasks/install.yml | 16 ++++++++++++++++ roles/prometheus/templates/prometheus.yml.j2 | 8 ++++++++ 8 files changed, 39 insertions(+), 12 deletions(-) create mode 100644 roles/node-exporter/tasks/uninstall.yml diff --git a/roles/node-exporter/defaults/main.yml b/roles/node-exporter/defaults/main.yml index 9d84bd17..4b22314b 100644 --- a/roles/node-exporter/defaults/main.yml +++ b/roles/node-exporter/defaults/main.yml @@ -27,3 +27,4 @@ node_exporter_disabled_collectors: [] _node_exporter_binary_install_dir: "/usr/local/bin" _node_exporter_system_group: "node-exp" _node_exporter_system_user: "{{ _node_exporter_system_group }}" +node_exporter_checksum: "68f3802c2dd3980667e4ba65ea2e1fb03f4a4ba026cca375f15a0390ff850949" diff --git a/roles/node-exporter/tasks/install.yml b/roles/node-exporter/tasks/install.yml index 3462a9c6..a9efbaac 100644 --- a/roles/node-exporter/tasks/install.yml +++ b/roles/node-exporter/tasks/install.yml @@ -17,6 +17,11 @@ home: / when: _node_exporter_system_user != "root" +- name: Create of update let'encrypt certificate + import_role: + name: _letsencrypt_certificate + when: app_domain is defined and app_domain != "" + - name: "directory for www logs mounted in jail" file: state: directory @@ -30,7 +35,7 @@ template: src: "nginx_app.j2" dest: "/etc/nginx/sites-available/{{ app_instance_id }}.conf" - notify: reload nginx grafana + notify: reload nginx node_exporter tags: - rev_proxy @@ -93,4 +98,4 @@ - name: Add monit import_role: name: _app_monit - when: monit_request is defined and monit_request != '' \ No newline at end of file + when: monit_request is defined and monit_request != '' diff --git a/roles/node-exporter/tasks/main.yml b/roles/node-exporter/tasks/main.yml index 2a4ee706..17a43705 100644 --- a/roles/node-exporter/tasks/main.yml +++ b/roles/node-exporter/tasks/main.yml @@ -8,19 +8,16 @@ - node_exporter_install - import_tasks: install.yml - become: true - when: - ( not __node_exporter_is_installed.stat.exists ) or - ( (__node_exporter_current_version_output.stderr_lines | length > 0) and (__node_exporter_current_version_output.stderr_lines[0].split(" ")[2] != node_exporter_version) ) or - ( (__node_exporter_current_version_output.stdout_lines | length > 0) and (__node_exporter_current_version_output.stdout_lines[0].split(" ")[2] != node_exporter_version) ) or - ( node_exporter_binary_local_dir | length > 0 ) - tags: - - node_exporter_install + when: app_run in ['install', 'reinstall'] + +- import_tasks: uninstall.yml + when: app_run == 'uninstall' - import_tasks: configure.yml become: true tags: - node_exporter_configure + when: app_run in ['install', 'reinstall', 'upgrade'] - name: Ensure Node Exporter is enabled on boot become: true diff --git a/roles/node-exporter/tasks/uninstall.yml b/roles/node-exporter/tasks/uninstall.yml new file mode 100644 index 00000000..e69de29b diff --git a/roles/node-exporter/templates/config.yaml.j2 b/roles/node-exporter/templates/config.yaml.j2 index 57fc8530..74c70aab 100644 --- a/roles/node-exporter/templates/config.yaml.j2 +++ b/roles/node-exporter/templates/config.yaml.j2 @@ -12,5 +12,5 @@ http_server_config: {% if admin_pwd is defined %} basic_auth_users: - - admin: {{ admin_pwd }} + admin: "{{ admin_pwd }}" {% endif %} diff --git a/roles/node-exporter/templates/node_exporter.service.j2 b/roles/node-exporter/templates/node_exporter.service.j2 index 07d14767..49e5aad5 100644 --- a/roles/node-exporter/templates/node_exporter.service.j2 +++ b/roles/node-exporter/templates/node_exporter.service.j2 @@ -23,7 +23,7 @@ ExecStart={{ _node_exporter_binary_install_dir }}/node_exporter \ {% for collector in node_exporter_disabled_collectors %} --no-collector.{{ collector }} \ {% endfor %} -{% if node_exporter_tls_server_config | length > 0 or node_exporter_http_server_config | length > 0 or node_exporter_basic_auth_users | length > 0 %} +{% if node_exporter_tls_server_config | length > 0 or node_exporter_http_server_config | length > 0 or admin_pwd is defined %} --web.config=/etc/node_exporter/config.yaml \ {% endif %} --web.listen-address=0.0.0.0:{{ app_main_port }} \ diff --git a/roles/prometheus/tasks/install.yml b/roles/prometheus/tasks/install.yml index 5b3ece71..e77bae36 100644 --- a/roles/prometheus/tasks/install.yml +++ b/roles/prometheus/tasks/install.yml @@ -53,6 +53,22 @@ tags: - prometheus_installation +- name: "Copy node_exporter targets file" + copy: + src: "~/.pm_monitoring/node_exporter.json" + dest: "{{ app_instance_root }}/prometheus/node_exporter.json" + mode: 0755 + tags: + - prometheus_installation + +- name: "Copy services targets file" + copy: + src: "~/.pm_monitoring/services.json" + dest: "{{ app_instance_root }}/prometheus/services.json" + mode: 0755 + tags: + - prometheus_installation + - name: "copy docker-compose {{ app_instance_id }}" copy: src: "docker-compose.yml" diff --git a/roles/prometheus/templates/prometheus.yml.j2 b/roles/prometheus/templates/prometheus.yml.j2 index 8cc1782f..b9bb1ac0 100644 --- a/roles/prometheus/templates/prometheus.yml.j2 +++ b/roles/prometheus/templates/prometheus.yml.j2 @@ -10,3 +10,11 @@ scrape_configs: - job_name: prometheus static_configs: - targets: ['localhost:{{ app_main_port }}'] + - job_name: node_exporter + file_sd_configs: + - files: + - node_exporter.json + - job_name: services + file_sd_configs: + - files: + - services.json -- GitLab From fd6a98a1b6f5c9a9f00054a30265343f47cc6f60 Mon Sep 17 00:00:00 2001 From: Admin paquerette Date: Mon, 21 Mar 2022 11:47:09 +0100 Subject: [PATCH 10/19] add basic auth for services --- roles/prometheus/templates/prometheus.yml.j2 | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/roles/prometheus/templates/prometheus.yml.j2 b/roles/prometheus/templates/prometheus.yml.j2 index b9bb1ac0..45d2ceb1 100644 --- a/roles/prometheus/templates/prometheus.yml.j2 +++ b/roles/prometheus/templates/prometheus.yml.j2 @@ -8,13 +8,22 @@ rule_files: scrape_configs: - job_name: prometheus + basic_auth: + username: "admin" + password: "{{ clear_admin_pwd }}" static_configs: - targets: ['localhost:{{ app_main_port }}'] - job_name: node_exporter + basic_auth: + username: "admin" + password: "{{ admin_node_exporter_pwd }}" file_sd_configs: - files: - node_exporter.json - job_name: services + basic_auth: + username: "metrics" + password: "{{ admin_services_pwd }}" file_sd_configs: - files: - services.json -- GitLab From b974d29555e6e52c22600b2b22e0406ad4c3ddbd Mon Sep 17 00:00:00 2001 From: Admin paquerette Date: Mon, 21 Mar 2022 11:47:24 +0100 Subject: [PATCH 11/19] remove domain --- roles/node-exporter/tasks/install.yml | 69 +++++++++++--------- roles/node-exporter/templates/config.yaml.j2 | 2 +- 2 files changed, 38 insertions(+), 33 deletions(-) diff --git a/roles/node-exporter/tasks/install.yml b/roles/node-exporter/tasks/install.yml index a9efbaac..c8d58398 100644 --- a/roles/node-exporter/tasks/install.yml +++ b/roles/node-exporter/tasks/install.yml @@ -17,27 +17,27 @@ home: / when: _node_exporter_system_user != "root" -- name: Create of update let'encrypt certificate - import_role: - name: _letsencrypt_certificate - when: app_domain is defined and app_domain != "" +#- name: Create of update let'encrypt certificate +# import_role: +# name: _letsencrypt_certificate +# when: app_domain is defined and app_domain != "" -- name: "directory for www logs mounted in jail" - file: - state: directory - path: "{{ app_instance_root }}/../logs" - mode: 0711 - owner: "{{ app_user }}" - group: "{{ app_group }}" - when: app_user is defined +#- name: "directory for www logs mounted in jail" +# file: +# state: directory +# path: "{{ app_instance_root }}/../logs" +# mode: 0711 +# owner: "{{ app_user }}" +# group: "{{ app_group }}" +# when: app_user is defined -- name: "template nginx_app.j2 {{ app_instance_id }}" - template: - src: "nginx_app.j2" - dest: "/etc/nginx/sites-available/{{ app_instance_id }}.conf" - notify: reload nginx node_exporter - tags: - - rev_proxy +#- name: "template nginx_app.j2 {{ app_instance_id }}" +# template: +# src: "nginx_app.j2" +# dest: "/etc/nginx/sites-available/{{ app_instance_id }}.conf" +# notify: reload nginx node_exporter +# tags: +# - rev_proxy - block: - name: Download node_exporter binary to local folder @@ -84,18 +84,23 @@ when: node_exporter_binary_local_dir | length > 0 notify: restart node_exporter -- name: log rotate - import_role: - name: _app_logrotate +#- name: log rotate +# import_role: +# name: _app_logrotate -- name: "enable site for {{ app_domain }}" - file: - state: link - path: "/etc/nginx/sites-enabled/{{ app_instance_id }}.conf" - src: "/etc/nginx/sites-available/{{ app_instance_id }}.conf" - notify: reload nginx node_exporter +#- name: "enable site for {{ app_domain }}" +# file: +# state: link +# path: "/etc/nginx/sites-enabled/{{ app_instance_id }}.conf" +# src: "/etc/nginx/sites-available/{{ app_instance_id }}.conf" +# notify: reload nginx node_exporter -- name: Add monit - import_role: - name: _app_monit - when: monit_request is defined and monit_request != '' +#- name: Add monit +# import_role: +# name: _app_monit +# when: monit_request is defined and monit_request != '' +- name: "ufw: Allow port {{ app_main_port }}" + ufw: + rule: allow + port: "{{ app_main_port }}" + proto: tcp diff --git a/roles/node-exporter/templates/config.yaml.j2 b/roles/node-exporter/templates/config.yaml.j2 index 74c70aab..dd60f778 100644 --- a/roles/node-exporter/templates/config.yaml.j2 +++ b/roles/node-exporter/templates/config.yaml.j2 @@ -12,5 +12,5 @@ http_server_config: {% if admin_pwd is defined %} basic_auth_users: - admin: "{{ admin_pwd }}" + admin: "{{ admin_node_exporter_crypt_pwd }}" {% endif %} -- GitLab From 2216922c8028663c5e84f7b0aedeb84a8146af30 Mon Sep 17 00:00:00 2001 From: Admin paquerette Date: Fri, 8 Apr 2022 18:12:23 +0200 Subject: [PATCH 12/19] =?UTF-8?q?Travail=20apr=C3=A8s=20mise=20en=20place?= =?UTF-8?q?=20d'un=20r=C3=A9seau=20interne?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- roles/node-exporter/tasks/install.yml | 38 +-------------------------- roles/node-exporter/tasks/main.yml | 5 ---- 2 files changed, 1 insertion(+), 42 deletions(-) diff --git a/roles/node-exporter/tasks/install.yml b/roles/node-exporter/tasks/install.yml index c8d58398..09be71bf 100644 --- a/roles/node-exporter/tasks/install.yml +++ b/roles/node-exporter/tasks/install.yml @@ -17,28 +17,6 @@ home: / when: _node_exporter_system_user != "root" -#- name: Create of update let'encrypt certificate -# import_role: -# name: _letsencrypt_certificate -# when: app_domain is defined and app_domain != "" - -#- name: "directory for www logs mounted in jail" -# file: -# state: directory -# path: "{{ app_instance_root }}/../logs" -# mode: 0711 -# owner: "{{ app_user }}" -# group: "{{ app_group }}" -# when: app_user is defined - -#- name: "template nginx_app.j2 {{ app_instance_id }}" -# template: -# src: "nginx_app.j2" -# dest: "/etc/nginx/sites-available/{{ app_instance_id }}.conf" -# notify: reload nginx node_exporter -# tags: -# - rev_proxy - - block: - name: Download node_exporter binary to local folder become: false @@ -84,23 +62,9 @@ when: node_exporter_binary_local_dir | length > 0 notify: restart node_exporter -#- name: log rotate -# import_role: -# name: _app_logrotate - -#- name: "enable site for {{ app_domain }}" -# file: -# state: link -# path: "/etc/nginx/sites-enabled/{{ app_instance_id }}.conf" -# src: "/etc/nginx/sites-available/{{ app_instance_id }}.conf" -# notify: reload nginx node_exporter - -#- name: Add monit -# import_role: -# name: _app_monit -# when: monit_request is defined and monit_request != '' - name: "ufw: Allow port {{ app_main_port }}" ufw: rule: allow port: "{{ app_main_port }}" proto: tcp + src: "{{ ip_monitoring_server }}" diff --git a/roles/node-exporter/tasks/main.yml b/roles/node-exporter/tasks/main.yml index 17a43705..dba9a378 100644 --- a/roles/node-exporter/tasks/main.yml +++ b/roles/node-exporter/tasks/main.yml @@ -8,16 +8,11 @@ - node_exporter_install - import_tasks: install.yml - when: app_run in ['install', 'reinstall'] - -- import_tasks: uninstall.yml - when: app_run == 'uninstall' - import_tasks: configure.yml become: true tags: - node_exporter_configure - when: app_run in ['install', 'reinstall', 'upgrade'] - name: Ensure Node Exporter is enabled on boot become: true -- GitLab From 700bc9ac2c28e6d4ff78531eb2b00be289b8ade5 Mon Sep 17 00:00:00 2001 From: Admin paquerette Date: Tue, 12 Apr 2022 21:58:32 +0200 Subject: [PATCH 13/19] Utilise PHP5.6 pour installer composer ds ADM sinon marche plus --- roles/adm_instance/scripts/install_composer.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/adm_instance/scripts/install_composer.sh b/roles/adm_instance/scripts/install_composer.sh index 6f01e38f..ad51c1f6 100644 --- a/roles/adm_instance/scripts/install_composer.sh +++ b/roles/adm_instance/scripts/install_composer.sh @@ -1,7 +1,7 @@ #!/bin/sh EXPECTED_SIGNATURE=$(wget -q -O - https://composer.github.io/installer.sig) -php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');" +/usr/bin/php5.6 -r "copy('https://getcomposer.org/installer', 'composer-setup.php');" ACTUAL_SIGNATURE=$(php -r "echo hash_file('SHA384', 'composer-setup.php');") if [ "$EXPECTED_SIGNATURE" != "$ACTUAL_SIGNATURE" ] @@ -11,7 +11,7 @@ then exit 1 fi -php composer-setup.php --quiet +/usr/bin/php5.6 composer-setup.php --quiet RESULT=$? rm composer-setup.php exit $RESULT -- GitLab From 941640a3c99915ebdfee855d7f523984e0453ed2 Mon Sep 17 00:00:00 2001 From: Admin paquerette Date: Fri, 8 Jul 2022 14:27:19 +0200 Subject: [PATCH 14/19] Correction docker, ajout du grafana.ini --- roles/grafana/files/docker-compose.yml | 14 - roles/grafana/tasks/install.yml | 18 +- roles/grafana/templates/docker_compose_yml.j2 | 17 + roles/grafana/templates/grafana_ini.j2 | 1258 +++++++++++++++++ 4 files changed, 1291 insertions(+), 16 deletions(-) delete mode 100644 roles/grafana/files/docker-compose.yml create mode 100644 roles/grafana/templates/docker_compose_yml.j2 create mode 100644 roles/grafana/templates/grafana_ini.j2 diff --git a/roles/grafana/files/docker-compose.yml b/roles/grafana/files/docker-compose.yml deleted file mode 100644 index 1166e509..00000000 --- a/roles/grafana/files/docker-compose.yml +++ /dev/null @@ -1,14 +0,0 @@ -version: '3.7' - -volumes: - grafana_data: {} - -services: - grafana: - image: grafana/grafana-oss - user: "472" - volumes: - - grafana_data:/var/lib/grafana - ports: - - 127.0.0.1:${APP_MAIN_PORT:-3000}:3000 - restart: always diff --git a/roles/grafana/tasks/install.yml b/roles/grafana/tasks/install.yml index 91e0170f..7b74d8b7 100644 --- a/roles/grafana/tasks/install.yml +++ b/roles/grafana/tasks/install.yml @@ -22,6 +22,20 @@ group: "{{ app_group }}" when: app_user is defined +- name: "Create data folder" + file: + state: directory + path: "{{ app_instance_root }}/data" + mode: 0775 + owner: "{{ app_user }}" + group: "{{ app_group }}" + when: app_user is defined + +- name: "template of grafana.ini {{ app_instance_id }}" + template: + src: "grafana_ini.j2" + dest: "{{ app_instance_root }}/data/grafana.ini" + - name: "template nginx_app.j2 {{ app_instance_id }}" template: src: "nginx_app.j2" @@ -31,8 +45,8 @@ - rev_proxy - name: "copy docker-compose {{ app_instance_id }}" - copy: - src: "docker-compose.yml" + template: + src: "docker_compose_yml.j2" dest: "{{ app_instance_root }}/docker-compose.yml" tags: - grafana_installation diff --git a/roles/grafana/templates/docker_compose_yml.j2 b/roles/grafana/templates/docker_compose_yml.j2 new file mode 100644 index 00000000..e29aaded --- /dev/null +++ b/roles/grafana/templates/docker_compose_yml.j2 @@ -0,0 +1,17 @@ +version: '3.7' + +volumes: + grafana_data: {} + +services: + grafana: + image: grafana/grafana-oss + user: "472" + environment: + - GF_PATHS_CONFIG=/home/grafana/grafana.ini + volumes: + - {{ app_instance_root }}/data:/home/grafana/ + ports: + - 127.0.0.1:${APP_MAIN_PORT:-3000}:3000 + restart: always + command: sh -c "/usr/local/bin/init.sh && chown -R root:root /etc/grafana && chmod -R a+r /etc/grafana && chown -R grafana:grafana /var/lib/grafana && chown -R grafana:grafana /usr/share/grafana" diff --git a/roles/grafana/templates/grafana_ini.j2 b/roles/grafana/templates/grafana_ini.j2 new file mode 100644 index 00000000..c52e2c1a --- /dev/null +++ b/roles/grafana/templates/grafana_ini.j2 @@ -0,0 +1,1258 @@ +##################### Grafana Configuration Defaults ##################### +# +# Do not modify this file in grafana installs +# + +# possible values : production, development +app_mode = production + +# instance name, defaults to HOSTNAME environment variable value or hostname if HOSTNAME var is empty +instance_name = ${HOSTNAME} + +# force migration will run migrations that might cause dataloss +force_migration = false + +#################################### Paths ############################### +[paths] +# Path to where grafana can store temp files, sessions, and the sqlite3 db (if that is used) +data = data + +# Temporary files in `data` directory older than given duration will be removed +temp_data_lifetime = 24h + +# Directory where grafana can store logs +logs = data/log + +# Directory where grafana will automatically scan and look for plugins +plugins = data/plugins + +# folder that contains provisioning config files that grafana will apply on startup and while running. +provisioning = conf/provisioning + +#################################### Server ############################## +[server] +# Protocol (http, https, h2, socket) +protocol = http + +# The ip address to bind to, empty will bind to all interfaces +http_addr = + +# The http port to use +http_port = 3000 + +# The public facing domain name used to access grafana from a browser +domain = localhost + +# Redirect to correct domain if host header does not match domain +# Prevents DNS rebinding attacks +enforce_domain = false + +# The full public facing url +root_url = %(protocol)s://%(domain)s:%(http_port)s/ + +# Serve Grafana from subpath specified in `root_url` setting. By default it is set to `false` for compatibility reasons. +serve_from_sub_path = false + +# Log web requests +router_logging = false + +# the path relative working path +static_root_path = public + +# enable gzip +enable_gzip = false + +# https certs & key file +cert_file = +cert_key = + +# Unix socket path +socket = /tmp/grafana.sock + +# CDN Url +cdn_url = + +# Sets the maximum time in minutes before timing out read of an incoming request and closing idle connections. +# `0` means there is no timeout for reading the request. +read_timeout = 0 + +#################################### Database ############################ +[database] +# You can configure the database connection by specifying type, host, name, user and password +# as separate properties or as on string using the url property. + +# Either "mysql", "postgres" or "sqlite3", it's your choice +type = sqlite3 +host = 127.0.0.1:3306 +name = grafana +user = root +# If the password contains # or ; you have to wrap it with triple quotes. Ex """#password;""" +password = +# Use either URL or the previous fields to configure the database +# Example: mysql://user:secret@host:port/database +url = + +# Max idle conn setting default is 2 +max_idle_conn = 2 + +# Max conn setting default is 0 (mean not set) +max_open_conn = + +# Connection Max Lifetime default is 14400 (means 14400 seconds or 4 hours) +conn_max_lifetime = 14400 + +# Set to true to log the sql calls and execution times. +log_queries = + +# For "postgres", use either "disable", "require" or "verify-full" +# For "mysql", use either "true", "false", or "skip-verify". +ssl_mode = disable + +# Database drivers may support different transaction isolation levels. +# Currently, only "mysql" driver supports isolation levels. +# If the value is empty - driver's default isolation level is applied. +# For "mysql" use "READ-UNCOMMITTED", "READ-COMMITTED", "REPEATABLE-READ" or "SERIALIZABLE". +isolation_level = + +ca_cert_path = +client_key_path = +client_cert_path = +server_cert_name = + +# For "sqlite3" only, path relative to data_path setting +path = grafana.db + +# For "sqlite3" only. cache mode setting used for connecting to the database +cache_mode = private + +# For "mysql" only if lockingMigration feature toggle is set. How many seconds to wait before failing to lock the database for the migrations, default is 0. +locking_attempt_timeout_sec = 0 + +#################################### Cache server ############################# +[remote_cache] +# Either "redis", "memcached" or "database" default is "database" +type = database + +# cache connectionstring options +# database: will use Grafana primary database. +# redis: config like redis server e.g. `addr=127.0.0.1:6379,pool_size=100,db=0,ssl=false`. Only addr is required. ssl may be 'true', 'false', or 'insecure'. +# memcache: 127.0.0.1:11211 +connstr = + +#################################### Data proxy ########################### +[dataproxy] + +# This enables data proxy logging, default is false +logging = false + +# How long the data proxy waits to read the headers of the response before timing out, default is 30 seconds. +# This setting also applies to core backend HTTP data sources where query requests use an HTTP client with timeout set. +timeout = 30 + +# How long the data proxy waits to establish a TCP connection before timing out, default is 10 seconds. +dialTimeout = 10 + +# How many seconds the data proxy waits before sending a keepalive request. +keep_alive_seconds = 30 + +# How many seconds the data proxy waits for a successful TLS Handshake before timing out. +tls_handshake_timeout_seconds = 10 + +# How many seconds the data proxy will wait for a server's first response headers after +# fully writing the request headers if the request has an "Expect: 100-continue" +# header. A value of 0 will result in the body being sent immediately, without +# waiting for the server to approve. +expect_continue_timeout_seconds = 1 + +# Optionally limits the total number of connections per host, including connections in the dialing, +# active, and idle states. On limit violation, dials will block. +# A value of zero (0) means no limit. +max_conns_per_host = 0 + +# The maximum number of idle connections that Grafana will keep alive. +max_idle_connections = 100 + +# How many seconds the data proxy keeps an idle connection open before timing out. +idle_conn_timeout_seconds = 90 + +# If enabled and user is not anonymous, data proxy will add X-Grafana-User header with username into the request. +send_user_header = false + +# Limit the amount of bytes that will be read/accepted from responses of outgoing HTTP requests. +response_limit = 0 + +# Limits the number of rows that Grafana will process from SQL data sources. +row_limit = 1000000 + +#################################### Analytics ########################### +[analytics] +# Server reporting, sends usage counters to stats.grafana.org every 24 hours. +# No ip addresses are being tracked, only simple counters to track +# running instances, dashboard and error counts. It is very helpful to us. +# Change this option to false to disable reporting. +reporting_enabled = true + +# The name of the distributor of the Grafana instance. Ex hosted-grafana, grafana-labs +reporting_distributor = grafana-labs + +# Set to false to disable all checks to https://grafana.com +# for new versions of grafana. The check is used +# in some UI views to notify that a grafana update exists. +# This option does not cause any auto updates, nor send any information +# only a GET request to https://raw.githubusercontent.com/grafana/grafana/main/latest.json to get the latest version. +check_for_updates = true + +# Set to false to disable all checks to https://grafana.com +# for new versions of plugins. The check is used +# in some UI views to notify that a plugin update exists. +# This option does not cause any auto updates, nor send any information +# only a GET request to https://grafana.com to get the latest versions. +check_for_plugin_updates = true + +# Google Analytics universal tracking code, only enabled if you specify an id here +google_analytics_ua_id = + +# Google Tag Manager ID, only enabled if you specify an id here +google_tag_manager_id = + +# Rudderstack write key, enabled only if rudderstack_data_plane_url is also set +rudderstack_write_key = + +# Rudderstack data plane url, enabled only if rudderstack_write_key is also set +rudderstack_data_plane_url = + +# Rudderstack SDK url, optional, only valid if rudderstack_write_key and rudderstack_data_plane_url is also set +rudderstack_sdk_url = + +# Rudderstack Config url, optional, used by Rudderstack SDK to fetch source config +rudderstack_config_url = + +# Application Insights connection string. Specify an URL string to enable this feature. +application_insights_connection_string = + +# Optional. Specifies an Application Insights endpoint URL where the endpoint string is wrapped in backticks ``. +application_insights_endpoint_url = + +# Controls if the UI contains any links to user feedback forms +feedback_links_enabled = true + +#################################### Security ############################ +[security] +# disable creation of admin user on first start of grafana +disable_initial_admin_creation = false + +# default admin user, created on startup +admin_user = admin + +# default admin password, can be changed before first start of grafana, or in profile settings +admin_password = admin + +# used for signing +secret_key = {{ secret_key }} + +# current key provider used for envelope encryption, default to static value specified by secret_key +encryption_provider = secretKey.v1 + +# list of configured key providers, space separated (Enterprise only): e.g., awskms.v1 azurekv.v1 +available_encryption_providers = + +# disable gravatar profile images +disable_gravatar = false + +# data source proxy whitelist (ip_or_domain:port separated by spaces) +data_source_proxy_whitelist = + +# disable protection against brute force login attempts +disable_brute_force_login_protection = false + +# set to true if you host Grafana behind HTTPS. default is false. +cookie_secure = false + +# set cookie SameSite attribute. defaults to `lax`. can be set to "lax", "strict", "none" and "disabled" +cookie_samesite = lax + +# set to true if you want to allow browsers to render Grafana in a ,