feat: install packages with pip; grafana env vars

README.md

@@ -109,7 +109,7 @@ List of all available Ansible roles.
 | [odoo](roles/odoo/README.md)                                           | Deploy Odoo container.                                           |
 | [onlyoffice_documentserver](roles/onlyoffice_documentserver/README.md) | Deploy OnlyOffice Document Server container.                     |
 | [openldap](roles/openldap/README.md)                                   | Deploy OpenLDAP Docker container.                                |
-| [packages](roles/packages/README.md)                                   | Set env vars and install packages and scripts.                   |
+| [packages](roles/packages/README.md)                                   | Set env vars and install packages.                               |
 | [pgadmin](roles/pgadmin/README.md)                                     | Deploy pgAdmin container.                                        |
 | [php_fpm](roles/php_fpm/README.md)                                     | Deploy PHP-FPM container.                                        |
 | [postfix](roles/postfix/README.md)                                     | Deploy Postfix relay host.                                       |

roles/docker/README.md

@@ -16,8 +16,6 @@ Configure all depending roles.
 docker_dns: "[\"172.17.4.1\", \"8.8.8.8\"]"
 docker_data_dir: /mnt/server-disk2/docker # defaults: /var/lib/docker
 docker_build_dir: /tmp/build # defaults: /srv/build
-docker_pip_packages:
-  - name: docker==4.2.0  # defaults: "docker"
 docker_log_driver: "local" # defaults: "json-file
 docker_log_max_size: "50m" # defaults: "10m"
 docker_log_max_file: "5" # defaults: "3"

roles/grafana/README.md

@@ -10,30 +10,23 @@ Configure the role.
 
 ```yml
 # https://hub.docker.com/r/grafana/grafana/
-grafana_image: grafana/grafana:9.5.21
-grafana_hostname: graf01
+grafana_image: grafana/grafana:11.2.0
+grafana_hostname: grafana01
 grafana_description: Prometheus dashboard # default: Grafana
 grafana_data_dir: /usr/share/graf # default: "/usr/share/{{ grafana_hostname }}"
-grafana_volume_name: grafana_data01
+grafana_volume_name: grafana_data01 # default: "{{ grafana_hostname }}"
 grafana_admin_user: admin
 grafana_admin_password: "{{ vault_grafana_admin_password }}"
 grafana_prometheus_hostname: prom01
-grafana_mail_hostname: mail.example.com:587
-grafana_mail_from: grafana@example.com
-grafana_mail_from_name: Grafana
-grafana_mail_username: bot@example.com
-grafana_mail_password: "{{ vault_grafana_mail_password }}"
 grafana_server_domain: "monitor.example.com"
 grafana_server_root_url: "https://monitor.example.com"
-grafana_generic_oauth_enabled: "true"
-grafana_generic_oauth_name: "Login Example"
-grafana_generic_oauth_sign_up: "true"
-grafana_generic_oauth_client_id: "monitor.example.com"
-grafana_generic_oauth_client_secret: "{{ vault_grafana_generic_oauth_client_secret }}"
-grafana_generic_oauth_scopes: email # default: profile
-grafana_generic_oauth_auth_url: "https://login.example.com/auth/realms/example.com/protocol/openid-connect/auth"
-grafana_generic_oauth_token_url: "https://login.example.com/auth/realms/example.com/protocol/openid-connect/token"
-grafana_generic_oauth_api_url: "https://login.example.com/auth/realms/example.com/protocol/openid-connect/userinfo"
+
+grafana_mail_enabled: "true" # default: "false"
+grafana_mail_hostname: mail.example.com:587
+grafana_mail_from: grafana@example.com
+grafana_mail_from_name: Monitoring # default: Grafana
+grafana_mail_username: bot@example.com
+grafana_mail_password: "{{ vault_grafana_mail_password }}"
 ```
 
 And include it in your playbook.
@@ -58,7 +51,7 @@ nginx_http_options: |
   }
 nginx_proxies:
   - src_hostname: monitor.example.com
-    dest_hostname: graf01
+    dest_hostname: grafana01
     dest_port: 3000
     ssl: true
     monitor: /
@@ -66,13 +59,44 @@ nginx_proxies:
       include /etc/nginx/conf.d/proxies/loki.nginx;
     locations:
       - path: '~ /(api/datasources/proxy/\d+/loki/api/v1/tail)'
-        dest_hostname: graf01
+        dest_hostname: grafana01
         dest_port: 3000
         options: |
           proxy_set_header Connection $connection_upgrade;
           proxy_set_header Upgrade $http_upgrade;
 ```
 
+### OAuth-Login with Keycloak
+
+Create a client for your Grafana instance in Keycloak and define these vars:
+
+```yml
+grafana_generic_oauth_enabled: "true" # default: "false"
+grafana_generic_oauth_name: "Example" # default: "Keycloak"
+grafana_generic_oauth_sign_up: "false" # default: "true"
+grafana_generic_oauth_client_id: "monitor.example.com"
+grafana_generic_oauth_client_secret: "{{ vault_grafana_generic_oauth_client_secret }}"
+grafana_generic_oauth_scopes: email # default: profile
+grafana_generic_oauth_auth_url: "https://login.example.com/auth/realms/example.com/protocol/openid-connect/auth"
+grafana_generic_oauth_token_url: "https://login.example.com/auth/realms/example.com/protocol/openid-connect/token"
+grafana_generic_oauth_api_url: "https://login.example.com/auth/realms/example.com/protocol/openid-connect/userinfo"
+```
+
+### OAuth-Login with Azure
+
+Create a client for your Grafana instance in Keycloak and define these vars:
+
+```yml
+grafana_azuread_enabled: "true" # default: "false"
+grafana_azuread_name: Microsoft # default: Azure AD
+grafana_azuread_tenant_id: $TENANT_ID
+grafana_azuread_sign_up: "false" # default:  "true"
+grafana_azuread_auto_login: "true" # default: "false"
+grafana_azuread_client_id: $CLIENT_ID
+grafana_azuread_client_secret: # default: "{{ vault_grafana_azuread_client_secret }}"
+grafana_azuread_scopes: openid # default: openid email profile
+```
+
 ### Install command line tools
 
 The installation script requires that you have sudo access to root.

roles/grafana/defaults/main.yml

@@ -1,4 +1,27 @@
 ---
 grafana_description: Grafana
 grafana_data_dir: /usr/share/{{ grafana_hostname }}
+grafana_volume_name: "{{ grafana_hostname }}"
+
+grafana_mail_enabled: "false"
+grafana_mail_from_name: Grafana
+grafana_mail_password: "{{ vault_grafana_mail_password }}"
+
+grafana_generic_oauth_enabled: "false"
+grafana_generic_oauth_name: Kecyloak
+grafana_generic_oauth_sign_up: "true"
 grafana_generic_oauth_scopes: profile
+
+grafana_azuread_enabled: "false"
+grafana_azuread_name: Azure AD
+grafana_azuread_sign_up: "true"
+grafana_azuread_auto_login: "false"
+grafana_azuread_client_secret: "{{ vault_grafana_azuread_client_secret }}"
+grafana_azuread_scopes: openid email profile
+grafana_azuread_auth_url: https://login.microsoftonline.com/{{ grafana_azuread_tenant_id }}/oauth2/v2.0/authorize
+grafana_azuread_token_url: https://login.microsoftonline.com/{{ grafana_azuread_tenant_id }}/oauth2/v2.0/token
+grafana_azuread_allowed_organizations: "{{ grafana_azuread_tenant_id }}"
+grafana_azuread_role_attribute_strict: "false"
+grafana_azuread_allow_assign_grafana_admin: "false"
+grafana_azuread_skip_org_role_sync: "false"
+grafana_azuread_use_pkce: "true"

roles/grafana/tasks/grafana.yml

@@ -25,6 +25,63 @@
     - dashboard.yml
   notify: Restart {{ role_name }} container
 
+- name: Init {{ role_name }} env vars
+  ansible.builtin.set_fact:
+    grafana_env:
+      GF_SECURITY_ADMIN_USER: "{{ grafana_admin_user }}"
+      GF_SECURITY_ADMIN_PASSWORD: "{{ grafana_admin_password }}"
+      GF_USERS_ALLOW_SIGN_UP: "false"
+      GF_SERVER_DOMAIN: "{{ grafana_server_domain }}"
+      GF_SERVER_ROOT_URL: "{{ grafana_server_root_url }}"
+
+- name: Append SMTP env vars
+  ansible.builtin.set_fact:
+    grafana_env: "{{ grafana_env | combine(item) }}"
+  with_items:
+    - GF_SMTP_ENABLED: "{{ grafana_mail_enabled }}"
+    - GF_SMTP_HOST: "{{ grafana_mail_hostname }}"
+    - GF_SMTP_USER: "{{ grafana_mail_username }}"
+    - GF_SMTP_PASSWORD: "{{ grafana_mail_password }}"
+    - GF_SMTP_FROM_ADDRESS: "{{ grafana_mail_from }}"
+    - GF_SMTP_FROM_NAME: "{{ grafana_mail_from_name }}"
+  when: grafana_mail_enabled == "true"
+
+- name: Append OAuth env vars
+  ansible.builtin.set_fact:
+    grafana_env: "{{ grafana_env | combine(item) }}"
+  with_items:
+    - GF_AUTH_GENERIC_OAUTH_ENABLED: "{{ grafana_generic_oauth_enabled }}"
+    - GF_AUTH_GENERIC_OAUTH_NAME: "{{ grafana_generic_oauth_name }}"
+    - GF_AUTH_GENERIC_OAUTH_ALLOW_SIGN_UP: "{{ grafana_generic_oauth_sign_up }}"
+    - GF_AUTH_GENERIC_OAUTH_CLIENT_ID: "{{ grafana_generic_oauth_client_id }}"
+    - GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: "{{ grafana_generic_oauth_client_secret }}"
+    - GF_AUTH_GENERIC_OAUTH_SCOPES: "{{ grafana_generic_oauth_scopes }}"
+    - GF_AUTH_GENERIC_OAUTH_AUTH_URL: "{{ grafana_generic_oauth_auth_url }}"
+    - GF_AUTH_GENERIC_OAUTH_TOKEN_URL: "{{ grafana_generic_oauth_token_url }}"
+    - GF_AUTH_GENERIC_OAUTH_API_URL: "{{ grafana_generic_oauth_api_url or '' }}"
+    - GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH: contains(roles[*], 'admin') && 'Admin' || contains(roles[*], 'editor') && 'Editor' || 'Viewer'
+  when: grafana_generic_oauth_enabled == "true"
+
+- name: Append OAuth env vars
+  ansible.builtin.set_fact:
+    grafana_env: "{{ grafana_env | combine(item) }}"
+  with_items:
+    - GF_AUTH_AZUREAD_ENABLED: "{{ grafana_azuread_enabled }}"
+    - GF_AUTH_AZUREAD_NAME: "{{ grafana_azuread_name }}"
+    - GF_AUTH_AZUREAD_ALLOW_SIGN_UP: "{{ grafana_azuread_sign_up }}"
+    - GF_AUTH_AZUREAD_AUTO_LOGIN: "{{ grafana_azuread_auto_login }}"
+    - GF_AUTH_AZUREAD_CLIENT_ID: "{{ grafana_azuread_client_id }}"
+    - GF_AUTH_AZUREAD_CLIENT_SECRET: "{{ grafana_azuread_client_secret }}"
+    - GF_AUTH_AZUREAD_SCOPES: "{{ grafana_azuread_scopes }}"
+    - GF_AUTH_AZUREAD_AUTH_URL: "{{ grafana_azuread_auth_url }}"
+    - GF_AUTH_AZUREAD_TOKEN_URL: "{{ grafana_azuread_token_url }}"
+    - GF_AUTH_AZUREAD_ALLOWED_ORGANIZATIONS: "{{ grafana_azuread_allowed_organizations }}"
+    - GF_AUTH_AZUREAD_ROLE_ATTRIBUTE_STRICT: "{{ grafana_azuread_role_attribute_strict }}"
+    - GF_AUTH_AZUREAD_ALLOW_ASSIGN_GRAFANA_ADMIN: "{{ grafana_azuread_allow_assign_grafana_admin }}"
+    - GF_AUTH_AZUREAD_SKIP_ORG_ROLE_SYNC: "{{ grafana_azuread_skip_org_role_sync }}"
+    - GF_AUTH_AZUREAD_USE_PKCE: "{{ grafana_azuread_use_pkce }}"
+  when: grafana_azuread_enabled == "true"
+
 - name: Start {{ role_name }} container {{ grafana_hostname }}
   community.docker.docker_container:
     name: "{{ grafana_hostname }}"
@@ -33,28 +90,7 @@
     image: "{{ grafana_image }}"
     restart_policy: unless-stopped
     recreate: false
-    env:
-      GF_SECURITY_ADMIN_USER: "{{ grafana_admin_user }}"
-      GF_SECURITY_ADMIN_PASSWORD: "{{ grafana_admin_password }}"
-      GF_USERS_ALLOW_SIGN_UP: "false"
-      GF_SMTP_ENABLED: "true"
-      GF_SMTP_HOST: "{{ grafana_mail_hostname }}"
-      GF_SMTP_USER: "{{ grafana_mail_username }}"
-      GF_SMTP_PASSWORD: "{{ grafana_mail_password }}"
-      GF_SMTP_FROM_ADDRESS: "{{ grafana_mail_from }}"
-      GF_SMTP_FROM_NAME: "{{ grafana_mail_from_name }}"
-      GF_SERVER_DOMAIN: "{{ grafana_server_domain }}"
-      GF_SERVER_ROOT_URL: "{{ grafana_server_root_url }}"
-      GF_AUTH_GENERIC_OAUTH_ENABLED: "{{ grafana_generic_oauth_enabled }}"
-      GF_AUTH_GENERIC_OAUTH_NAME: "{{ grafana_generic_oauth_name }}"
-      GF_AUTH_GENERIC_OAUTH_ALLOW_SIGN_UP: "{{ grafana_generic_oauth_sign_up }}"
-      GF_AUTH_GENERIC_OAUTH_CLIENT_ID: "{{ grafana_generic_oauth_client_id }}"
-      GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: "{{ grafana_generic_oauth_client_secret }}"
-      GF_AUTH_GENERIC_OAUTH_SCOPES: "{{ grafana_generic_oauth_scopes }}"
-      GF_AUTH_GENERIC_OAUTH_AUTH_URL: "{{ grafana_generic_oauth_auth_url }}"
-      GF_AUTH_GENERIC_OAUTH_TOKEN_URL: "{{ grafana_generic_oauth_token_url }}"
-      GF_AUTH_GENERIC_OAUTH_API_URL: "{{ grafana_generic_oauth_api_url }}"
-      GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH: contains(roles[*], 'admin') && 'Admin' || contains(roles[*], 'editor') && 'Editor' || 'Viewer'
+    env: "{{ grafana_env }}"
     volumes:
       - "{{ grafana_volume_name }}:/var/lib/grafana"
       - "{{ grafana_data_dir }}/datasource.yml:/etc/grafana/provisioning/datasources/datasource.yml"

roles/packages/README.md

@@ -1,6 +1,6 @@
 # Packages role
 
-Set env vars and install packages and scripts.
+Set env vars and install packages.
 
 ## Usage
 
@@ -21,9 +21,11 @@ packages:
     version: 2:8.0.1453-1ubuntu1.3
 host_packages:
   - name: cifs_utils
-packages_snap:
+snap_packages:
   - name: ripgrep
-scripts:
+pip_packages:
+  - name: docker
+script_packages:
   - path: /usr/local/bin/hello-mom
     content: |
       echo "Hello Mom!"

roles/packages/tasks/main.yml

@@ -22,7 +22,7 @@
 
 - name: Include {{ role_name }} snap tasks
   ansible.builtin.include_tasks: "{{ role_name }}_snap.yml"
-  when: packages_snap is defined and ansible_distribution == 'Ubuntu'
+  when: snap_packages is defined and ansible_distribution == 'Ubuntu'
   tags:
     - packages
 
@@ -44,8 +44,14 @@
   tags:
     - packages
 
-- name: Include scripts tasks
-  ansible.builtin.include_tasks: scripts.yml
-  when: scripts is defined
+- name: Include {{ role_name }} scripts tasks
+  ansible.builtin.include_tasks: "{{ role_name }}_scrips.yml"
+  when: packages_script is defined
+  tags:
+    - packages
+
+- name: Include {{ role_name }} scripts tasks
+  ansible.builtin.include_tasks: "{{ role_name }}_pip.yml"
+  when: pip_packages is defined
   tags:
     - packages

roles/packages/tasks/packages_pip.yml

@@ -0,0 +1,7 @@
+---
+- name: Install pip packages
+  ansible.builtin.pip:
+    name: "{{ item.name }}"
+    state: present
+    break_system_packages: true
+  loop: "{{ pip_packages }}"

roles/packages/tasks/packages_snap.yml

@@ -10,7 +10,7 @@
     name: "{{ item.name }}"
     classic: "{{ item.classic | default(false) }}"
     state: present
-  loop: "{{ packages_snap }}"
+  loop: "{{ snap_packages }}"
   when: item.version is not defined
 
 - name: Install versioned packages
@@ -18,5 +18,5 @@
     name: "{{ item.name }}={{ item.version }}"
     classic: "{{ item.classic | default(false) }}"
     state: present
-  loop: "{{ packages_snap }}"
+  loop: "{{ snap_packages }}"
   when: item.version is defined

roles/prometheus/README.md

@@ -15,6 +15,10 @@ prometheus_hostname: prom01
 prometheus_description: Monitoring # default: Prometheus
 prometheus_volume_name: prom_data01 # default: "{{ prometheus_hostname }}"
 prometheus_data_dir: /usr/share/prom # default: "/usr/share/{{ prometheus_hostname }}"
+prometheus_hosts: # default: groups['all']
+  - server1.example.com
+  - server2.example.com
+  - server3.example.com
 prometheus_port: 127.0.0.1:9999 # default: 127.0.0.1:9090
 prometheus_retention_time: "30d" # default: "15d"
 prometheus_etc_hosts: # defaults: {}
@@ -66,7 +70,7 @@ And include it in your playbook.
 
 ### Predefined srape configs
 
-The `prometheus.yml` template contains predefined srcape jobs that lookup proxy configurations in the Ansible inventory.
+The `prometheus.yml` template contains predefined srcape jobs that lookup proxy configurations of `prometheus_hosts` in the Ansible inventory.
 
 * **prometheus**: Target is `localhost:9090`.
 * **node-exporter https**: Targets are `nginx_proxies` with exporter `node`.

roles/prometheus/defaults/main.yml

@@ -3,5 +3,6 @@ prometheus_port: 127.0.0.1:9090
 prometheus_description: Prometheus
 prometheus_volume_name: "{{ prometheus_hostname }}"
 prometheus_data_dir: /usr/share/{{ prometheus_hostname }}
+prometheus_hosts: "{{ groups['all'] }}"
 prometheus_etc_hosts: {}
 prometheus_retention_time: 15d

roles/prometheus/tasks/prometheus.yml

@@ -10,11 +10,11 @@
 
 - name: Extract and filter blackbox target hostnames
   ansible.builtin.set_fact:
-    src_hostnames: "{{ groups['all'] | map('extract', hostvars) | json_query('[*].nginx_proxies[?monitor!=`false` && monitor!=null].src_hostname') | flatten }}"
+    src_hostnames: "{{ prometheus_hosts | map('extract', hostvars) | json_query('[*].nginx_proxies[?monitor!=`false` && monitor!=null].src_hostname') | flatten }}"
 
 - name: Extract and filter blackbox target paths
   ansible.builtin.set_fact:
-    paths: "{{ groups['all'] | map('extract', hostvars) | json_query('[*].nginx_proxies[?monitor!=`false` && monitor!=null].monitor') | flatten }}"
+    paths: "{{ prometheus_hosts | map('extract', hostvars) | json_query('[*].nginx_proxies[?monitor!=`false` && monitor!=null].monitor') | flatten }}"
 
 - name: Generate blackbox target urls
   ansible.builtin.set_fact:

roles/prometheus/templates/prometheus.yml

@@ -1,12 +1,12 @@
+---
 scrape_configs:
-
   - job_name: prometheus
     scrape_interval: 30s
     honor_labels: true
     static_configs:
       - targets:
           - localhost:9090
-
+{% if prometheus_node_exporter_basic_auth_username is defined %}
   - job_name: node-exporter https
     metrics_path: "/node-exporter/metrics"
     scrape_interval: 30s
@@ -16,8 +16,9 @@ scrape_configs:
       username: {{ prometheus_node_exporter_basic_auth_username }}
       password: {{ prometheus_node_exporter_basic_auth_password }}
     static_configs:
-      - targets: {{ groups['all'] | map('extract', hostvars) | json_query('[*].nginx_proxies[?exporter!=null && contains(exporter, `node`)].src_hostname') | flatten }}
-  
+      - targets: {{ prometheus_hosts | map('extract', hostvars) | json_query('[*].nginx_proxies[?exporter!=null && contains(exporter, `node`)].src_hostname') | flatten }}
+{% endif %}
+{% if prometheus_cadvisor_basic_auth_username is defined %}
   - job_name: cadvisor https
     metrics_path: "/cadvisor/metrics"
     scrape_interval: 30s
@@ -27,8 +28,9 @@ scrape_configs:
       username: {{ prometheus_cadvisor_basic_auth_username }}
       password: {{ prometheus_cadvisor_basic_auth_password }}
     static_configs:
-      - targets: {{ groups['all'] | map('extract', hostvars) | json_query('[*].nginx_proxies[?exporter!=null && contains(exporter, `cadvisor`)].src_hostname') | flatten }}
-
+      - targets: {{ prometheus_hosts | map('extract', hostvars) | json_query('[*].nginx_proxies[?exporter!=null && contains(exporter, `cadvisor`)].src_hostname') | flatten }}
+{% endif %}
+{% if prometheus_nextcloud_exporter_basic_auth_username is defined %}
   - job_name: nextcloud https
     metrics_path: "/nextcloud-exporter/metrics"
     scrape_interval: 30s
@@ -38,8 +40,9 @@ scrape_configs:
       username: {{ prometheus_nextcloud_exporter_basic_auth_username }}
       password: {{ prometheus_nextcloud_exporter_basic_auth_password }}
     static_configs:
-      - targets: {{ groups['all'] | map('extract', hostvars) | json_query('[*].nginx_proxies[?exporter!=null && contains(exporter, `nextcloud`)].src_hostname') | flatten }}
-
+      - targets: {{ prometheus_hosts | map('extract', hostvars) | json_query('[*].nginx_proxies[?exporter!=null && contains(exporter, `nextcloud`)].src_hostname') | flatten }}
+{% endif %}
+{% if prometheus_bigbluebutton_exporter_basic_auth_username is defined %}
   - job_name: bigbluebutton http
     metrics_path: "/bigbluebutton-exporter/metrics"
     scrape_interval: 30s
@@ -49,8 +52,9 @@ scrape_configs:
       username: {{ prometheus_bigbluebutton_exporter_basic_auth_username }}
       password: {{ prometheus_bigbluebutton_exporter_basic_auth_password }}
     static_configs:
-      - targets: {{ groups['all'] | map('extract', hostvars) | json_query('[*].nginx_proxies[?exporter!=null && contains(exporter, `bigbluebutton`)].src_hostname') | flatten }}
-
+      - targets: {{ prometheus_hosts | map('extract', hostvars) | json_query('[*].nginx_proxies[?exporter!=null && contains(exporter, `bigbluebutton`)].src_hostname') | flatten }}
+{% endif %}
+{% if prometheus_postgres_exporter_basic_auth_username is defined %}
   - job_name: postgres https
     metrics_path: "/postgres-exporter/metrics"
     scrape_interval: 30s
@@ -60,8 +64,9 @@ scrape_configs:
       username: {{ prometheus_postgres_exporter_basic_auth_username }}
       password: {{ prometheus_postgres_exporter_basic_auth_password }}
     static_configs:
-      - targets: {{ groups['all'] | map('extract', hostvars) | json_query('[*].nginx_proxies[?exporter!=null && contains(exporter, `postgres`)].src_hostname') | flatten }}
-
+      - targets: {{ prometheus_hosts | map('extract', hostvars) | json_query('[*].nginx_proxies[?exporter!=null && contains(exporter, `postgres`)].src_hostname') | flatten }}
+{% endif %}
+{% if prometheus_restic_server_basic_auth_username is defined %}
   - job_name: restic-server https
     metrics_path: "/restic-server/metrics"
     scrape_interval: 30s
@@ -71,16 +76,9 @@ scrape_configs:
       username: {{ prometheus_restic_server_basic_auth_username }}
       password: {{ prometheus_restic_server_basic_auth_password }}
     static_configs:
-      - targets: {{ groups['all'] | map('extract', hostvars) | json_query('[*].nginx_proxies[?exporter!=null && contains(exporter, `restic`)].src_hostname') | flatten }}
-
-  - job_name: odoo https
-    metrics_path: "/metrics"
-    scrape_interval: 60s
-    honor_labels: true
-    scheme: https
-    static_configs:
-      - targets: {{ groups['all'] | map('extract', hostvars) | json_query('[*].nginx_proxies[?exporter!=null && contains(exporter, `odoo`)].src_hostname') | flatten }}
-
+      - targets: {{ prometheus_hosts | map('extract', hostvars) | json_query('[*].nginx_proxies[?exporter!=null && contains(exporter, `restic`)].src_hostname') | flatten }}
+{% endif %}
+{% if prometheus_mysqld_exporter_basic_auth_username is defined %}
   - job_name: mysqld https
     metrics_path: "/mysqld-exporter/metrics"
     scrape_interval: 30s
@@ -90,8 +88,16 @@ scrape_configs:
       username: {{ prometheus_mysqld_exporter_basic_auth_username }}
       password: {{ prometheus_mysqld_exporter_basic_auth_password }}
     static_configs:
-      - targets: {{ groups['all'] | map('extract', hostvars) | json_query('[*].nginx_proxies[?exporter!=null && contains(exporter, `mysqld`)].src_hostname') | flatten }}
-
+      - targets: {{ prometheus_hosts | map('extract', hostvars) | json_query('[*].nginx_proxies[?exporter!=null && contains(exporter, `mysqld`)].src_hostname') | flatten }}
+{% endif %}
+  - job_name: odoo https
+    metrics_path: "/metrics"
+    scrape_interval: 60s
+    honor_labels: true
+    scheme: https
+    static_configs:
+      - targets: {{ prometheus_hosts | map('extract', hostvars) | json_query('[*].nginx_proxies[?exporter!=null && contains(exporter, `odoo`)].src_hostname') | flatten }}
+{% if blackbox_exporter_hostname is defined %}
   - job_name: blackbox
     metrics_path: "/probe"
     scrape_interval: 60s
@@ -105,4 +111,5 @@ scrape_configs:
       - source_labels: [__param_target]
         target_label: instance
       - target_label: __address__
-        replacement: blackbox01:9115
+        replacement: {{ blackbox_exporter_hostname }}:9115
+{% endif %}

roles/timezone/tasks/timezone.yml

@@ -2,7 +2,7 @@
 - name: Get {{ role_name }}
   ansible.builtin.command: timedatectl show --property=Timezone --value
   changed_when: false
-  ignore_errors: True
+  ignore_errors: true
   register: current_timezone
 
 - name: Set {{ role_name }}

task

@@ -14,6 +14,7 @@ printf "| %-${cmd_width}s | %-${opt_width}s | %-${desc_width}s |\n" "Command" "O
 echo "|$(printf '%*s' $((cmd_width + 2)) '' | tr ' ' '-')|$(printf '%*s' $((opt_width + 2)) '' | tr ' ' '-')|$(printf '%*s' $((desc_width + 2)) '' | tr ' ' '-')|"
 printf "| %-${cmd_width}s | %-${opt_width}s | %-${desc_width}s |\n" "generate-passwordfile" "[password]" "Generate a password file for Ansible vault."
 printf "| %-${cmd_width}s | %-${opt_width}s | %-${desc_width}s |\n" "install" "" "Install Ansible and dependencies with pip."
+printf "| %-${cmd_width}s | %-${opt_width}s | %-${desc_width}s |\n" "upgrade" "" "Upgrade Ansible and dependencies with pip."
 printf "| %-${cmd_width}s | %-${opt_width}s | %-${desc_width}s |\n" "lint" "" "Lint Ansible roles and playbooks."
 printf "| %-${cmd_width}s | %-${opt_width}s | %-${desc_width}s |\n" "galaxy-build" "" "Create tarball of collection."
 printf "| %-${cmd_width}s | %-${opt_width}s | %-${desc_width}s |\n" "galaxy-publish" "" "Publish tarball to Ansible Galaxy."
@@ -58,20 +59,25 @@ function activate-venv() {
 }
 
 function install() {
-    echo "Setup Ansible log file."
+    echo "Setup Ansible log file"
     sudo touch /var/log/ansible.log
     sudo chown $USER: /var/log/ansible.log
 
     init-venv
     activate-venv
 
-    echo "Install Ansible and Python dependencies."
+    echo "Install Ansible and Python dependencies"
     sudo apt install graphviz
     pip install -r requirements.txt
 
     ansible-galaxy collection install community.general
 }
 
+function upgrade() {
+    echo "Update Ansible"
+    pip install --upgrade ansible
+}
+
 function update-docs() {
     activate-venv
     python3 ./library/graph.py
@@ -132,6 +138,9 @@ case "$1" in
     install)
         install
         ;;
+    upgrade)
+        upgrade
+        ;;
     version)
         version
         ;;