From b677f3d301033cd32449bf3fb5bfa3d9cce00be1 Mon Sep 17 00:00:00 2001 From: Janik von Rotz Date: Mon, 16 Sep 2024 15:19:14 +0200 Subject: [PATCH] feat: install packages with pip; grafana env vars --- README.md | 2 +- roles/docker/README.md | 2 - roles/grafana/README.md | 62 +++++++++----- roles/grafana/defaults/main.yml | 23 ++++++ roles/grafana/tasks/grafana.yml | 80 ++++++++++++++----- roles/packages/README.md | 8 +- roles/packages/tasks/main.yml | 14 +++- roles/packages/tasks/packages_pip.yml | 7 ++ .../{scripts.yml => packages_script.yml} | 0 roles/packages/tasks/packages_snap.yml | 4 +- roles/prometheus/README.md | 6 +- roles/prometheus/defaults/main.yml | 1 + roles/prometheus/tasks/prometheus.yml | 4 +- roles/prometheus/templates/prometheus.yml | 57 +++++++------ roles/timezone/tasks/timezone.yml | 2 +- task | 13 ++- 16 files changed, 201 insertions(+), 84 deletions(-) create mode 100644 roles/packages/tasks/packages_pip.yml rename roles/packages/tasks/{scripts.yml => packages_script.yml} (100%) diff --git a/README.md b/README.md index bb0b2d94..6be40a5e 100644 --- a/README.md +++ b/README.md @@ -109,7 +109,7 @@ List of all available Ansible roles. | [odoo](roles/odoo/README.md) | Deploy Odoo container. | | [onlyoffice_documentserver](roles/onlyoffice_documentserver/README.md) | Deploy OnlyOffice Document Server container. | | [openldap](roles/openldap/README.md) | Deploy OpenLDAP Docker container. | -| [packages](roles/packages/README.md) | Set env vars and install packages and scripts. | +| [packages](roles/packages/README.md) | Set env vars and install packages. | | [pgadmin](roles/pgadmin/README.md) | Deploy pgAdmin container. | | [php_fpm](roles/php_fpm/README.md) | Deploy PHP-FPM container. | | [postfix](roles/postfix/README.md) | Deploy Postfix relay host. | diff --git a/roles/docker/README.md b/roles/docker/README.md index 127fdf9c..a892c736 100644 --- a/roles/docker/README.md +++ b/roles/docker/README.md @@ -16,8 +16,6 @@ Configure all depending roles. docker_dns: "[\"172.17.4.1\", \"8.8.8.8\"]" docker_data_dir: /mnt/server-disk2/docker # defaults: /var/lib/docker docker_build_dir: /tmp/build # defaults: /srv/build -docker_pip_packages: - - name: docker==4.2.0 # defaults: "docker" docker_log_driver: "local" # defaults: "json-file docker_log_max_size: "50m" # defaults: "10m" docker_log_max_file: "5" # defaults: "3" diff --git a/roles/grafana/README.md b/roles/grafana/README.md index 90f214ae..82edd583 100644 --- a/roles/grafana/README.md +++ b/roles/grafana/README.md @@ -10,30 +10,23 @@ Configure the role. ```yml # https://hub.docker.com/r/grafana/grafana/ -grafana_image: grafana/grafana:9.5.21 -grafana_hostname: graf01 +grafana_image: grafana/grafana:11.2.0 +grafana_hostname: grafana01 grafana_description: Prometheus dashboard # default: Grafana grafana_data_dir: /usr/share/graf # default: "/usr/share/{{ grafana_hostname }}" -grafana_volume_name: grafana_data01 +grafana_volume_name: grafana_data01 # default: "{{ grafana_hostname }}" grafana_admin_user: admin grafana_admin_password: "{{ vault_grafana_admin_password }}" grafana_prometheus_hostname: prom01 -grafana_mail_hostname: mail.example.com:587 -grafana_mail_from: grafana@example.com -grafana_mail_from_name: Grafana -grafana_mail_username: bot@example.com -grafana_mail_password: "{{ vault_grafana_mail_password }}" grafana_server_domain: "monitor.example.com" grafana_server_root_url: "https://monitor.example.com" -grafana_generic_oauth_enabled: "true" -grafana_generic_oauth_name: "Login Example" -grafana_generic_oauth_sign_up: "true" -grafana_generic_oauth_client_id: "monitor.example.com" -grafana_generic_oauth_client_secret: "{{ vault_grafana_generic_oauth_client_secret }}" -grafana_generic_oauth_scopes: email # default: profile -grafana_generic_oauth_auth_url: "https://login.example.com/auth/realms/example.com/protocol/openid-connect/auth" -grafana_generic_oauth_token_url: "https://login.example.com/auth/realms/example.com/protocol/openid-connect/token" -grafana_generic_oauth_api_url: "https://login.example.com/auth/realms/example.com/protocol/openid-connect/userinfo" + +grafana_mail_enabled: "true" # default: "false" +grafana_mail_hostname: mail.example.com:587 +grafana_mail_from: grafana@example.com +grafana_mail_from_name: Monitoring # default: Grafana +grafana_mail_username: bot@example.com +grafana_mail_password: "{{ vault_grafana_mail_password }}" ``` And include it in your playbook. @@ -58,7 +51,7 @@ nginx_http_options: | } nginx_proxies: - src_hostname: monitor.example.com - dest_hostname: graf01 + dest_hostname: grafana01 dest_port: 3000 ssl: true monitor: / @@ -66,13 +59,44 @@ nginx_proxies: include /etc/nginx/conf.d/proxies/loki.nginx; locations: - path: '~ /(api/datasources/proxy/\d+/loki/api/v1/tail)' - dest_hostname: graf01 + dest_hostname: grafana01 dest_port: 3000 options: | proxy_set_header Connection $connection_upgrade; proxy_set_header Upgrade $http_upgrade; ``` +### OAuth-Login with Keycloak + +Create a client for your Grafana instance in Keycloak and define these vars: + +```yml +grafana_generic_oauth_enabled: "true" # default: "false" +grafana_generic_oauth_name: "Example" # default: "Keycloak" +grafana_generic_oauth_sign_up: "false" # default: "true" +grafana_generic_oauth_client_id: "monitor.example.com" +grafana_generic_oauth_client_secret: "{{ vault_grafana_generic_oauth_client_secret }}" +grafana_generic_oauth_scopes: email # default: profile +grafana_generic_oauth_auth_url: "https://login.example.com/auth/realms/example.com/protocol/openid-connect/auth" +grafana_generic_oauth_token_url: "https://login.example.com/auth/realms/example.com/protocol/openid-connect/token" +grafana_generic_oauth_api_url: "https://login.example.com/auth/realms/example.com/protocol/openid-connect/userinfo" +``` + +### OAuth-Login with Azure + +Create a client for your Grafana instance in Keycloak and define these vars: + +```yml +grafana_azuread_enabled: "true" # default: "false" +grafana_azuread_name: Microsoft # default: Azure AD +grafana_azuread_tenant_id: $TENANT_ID +grafana_azuread_sign_up: "false" # default: "true" +grafana_azuread_auto_login: "true" # default: "false" +grafana_azuread_client_id: $CLIENT_ID +grafana_azuread_client_secret: # default: "{{ vault_grafana_azuread_client_secret }}" +grafana_azuread_scopes: openid # default: openid email profile +``` + ### Install command line tools The installation script requires that you have sudo access to root. diff --git a/roles/grafana/defaults/main.yml b/roles/grafana/defaults/main.yml index ec87bf03..04346309 100644 --- a/roles/grafana/defaults/main.yml +++ b/roles/grafana/defaults/main.yml @@ -1,4 +1,27 @@ --- grafana_description: Grafana grafana_data_dir: /usr/share/{{ grafana_hostname }} +grafana_volume_name: "{{ grafana_hostname }}" + +grafana_mail_enabled: "false" +grafana_mail_from_name: Grafana +grafana_mail_password: "{{ vault_grafana_mail_password }}" + +grafana_generic_oauth_enabled: "false" +grafana_generic_oauth_name: Kecyloak +grafana_generic_oauth_sign_up: "true" grafana_generic_oauth_scopes: profile + +grafana_azuread_enabled: "false" +grafana_azuread_name: Azure AD +grafana_azuread_sign_up: "true" +grafana_azuread_auto_login: "false" +grafana_azuread_client_secret: "{{ vault_grafana_azuread_client_secret }}" +grafana_azuread_scopes: openid email profile +grafana_azuread_auth_url: https://login.microsoftonline.com/{{ grafana_azuread_tenant_id }}/oauth2/v2.0/authorize +grafana_azuread_token_url: https://login.microsoftonline.com/{{ grafana_azuread_tenant_id }}/oauth2/v2.0/token +grafana_azuread_allowed_organizations: "{{ grafana_azuread_tenant_id }}" +grafana_azuread_role_attribute_strict: "false" +grafana_azuread_allow_assign_grafana_admin: "false" +grafana_azuread_skip_org_role_sync: "false" +grafana_azuread_use_pkce: "true" diff --git a/roles/grafana/tasks/grafana.yml b/roles/grafana/tasks/grafana.yml index 7f2db6bf..c028bf2e 100644 --- a/roles/grafana/tasks/grafana.yml +++ b/roles/grafana/tasks/grafana.yml @@ -25,6 +25,63 @@ - dashboard.yml notify: Restart {{ role_name }} container +- name: Init {{ role_name }} env vars + ansible.builtin.set_fact: + grafana_env: + GF_SECURITY_ADMIN_USER: "{{ grafana_admin_user }}" + GF_SECURITY_ADMIN_PASSWORD: "{{ grafana_admin_password }}" + GF_USERS_ALLOW_SIGN_UP: "false" + GF_SERVER_DOMAIN: "{{ grafana_server_domain }}" + GF_SERVER_ROOT_URL: "{{ grafana_server_root_url }}" + +- name: Append SMTP env vars + ansible.builtin.set_fact: + grafana_env: "{{ grafana_env | combine(item) }}" + with_items: + - GF_SMTP_ENABLED: "{{ grafana_mail_enabled }}" + - GF_SMTP_HOST: "{{ grafana_mail_hostname }}" + - GF_SMTP_USER: "{{ grafana_mail_username }}" + - GF_SMTP_PASSWORD: "{{ grafana_mail_password }}" + - GF_SMTP_FROM_ADDRESS: "{{ grafana_mail_from }}" + - GF_SMTP_FROM_NAME: "{{ grafana_mail_from_name }}" + when: grafana_mail_enabled == "true" + +- name: Append OAuth env vars + ansible.builtin.set_fact: + grafana_env: "{{ grafana_env | combine(item) }}" + with_items: + - GF_AUTH_GENERIC_OAUTH_ENABLED: "{{ grafana_generic_oauth_enabled }}" + - GF_AUTH_GENERIC_OAUTH_NAME: "{{ grafana_generic_oauth_name }}" + - GF_AUTH_GENERIC_OAUTH_ALLOW_SIGN_UP: "{{ grafana_generic_oauth_sign_up }}" + - GF_AUTH_GENERIC_OAUTH_CLIENT_ID: "{{ grafana_generic_oauth_client_id }}" + - GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: "{{ grafana_generic_oauth_client_secret }}" + - GF_AUTH_GENERIC_OAUTH_SCOPES: "{{ grafana_generic_oauth_scopes }}" + - GF_AUTH_GENERIC_OAUTH_AUTH_URL: "{{ grafana_generic_oauth_auth_url }}" + - GF_AUTH_GENERIC_OAUTH_TOKEN_URL: "{{ grafana_generic_oauth_token_url }}" + - GF_AUTH_GENERIC_OAUTH_API_URL: "{{ grafana_generic_oauth_api_url or '' }}" + - GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH: contains(roles[*], 'admin') && 'Admin' || contains(roles[*], 'editor') && 'Editor' || 'Viewer' + when: grafana_generic_oauth_enabled == "true" + +- name: Append OAuth env vars + ansible.builtin.set_fact: + grafana_env: "{{ grafana_env | combine(item) }}" + with_items: + - GF_AUTH_AZUREAD_ENABLED: "{{ grafana_azuread_enabled }}" + - GF_AUTH_AZUREAD_NAME: "{{ grafana_azuread_name }}" + - GF_AUTH_AZUREAD_ALLOW_SIGN_UP: "{{ grafana_azuread_sign_up }}" + - GF_AUTH_AZUREAD_AUTO_LOGIN: "{{ grafana_azuread_auto_login }}" + - GF_AUTH_AZUREAD_CLIENT_ID: "{{ grafana_azuread_client_id }}" + - GF_AUTH_AZUREAD_CLIENT_SECRET: "{{ grafana_azuread_client_secret }}" + - GF_AUTH_AZUREAD_SCOPES: "{{ grafana_azuread_scopes }}" + - GF_AUTH_AZUREAD_AUTH_URL: "{{ grafana_azuread_auth_url }}" + - GF_AUTH_AZUREAD_TOKEN_URL: "{{ grafana_azuread_token_url }}" + - GF_AUTH_AZUREAD_ALLOWED_ORGANIZATIONS: "{{ grafana_azuread_allowed_organizations }}" + - GF_AUTH_AZUREAD_ROLE_ATTRIBUTE_STRICT: "{{ grafana_azuread_role_attribute_strict }}" + - GF_AUTH_AZUREAD_ALLOW_ASSIGN_GRAFANA_ADMIN: "{{ grafana_azuread_allow_assign_grafana_admin }}" + - GF_AUTH_AZUREAD_SKIP_ORG_ROLE_SYNC: "{{ grafana_azuread_skip_org_role_sync }}" + - GF_AUTH_AZUREAD_USE_PKCE: "{{ grafana_azuread_use_pkce }}" + when: grafana_azuread_enabled == "true" + - name: Start {{ role_name }} container {{ grafana_hostname }} community.docker.docker_container: name: "{{ grafana_hostname }}" @@ -33,28 +90,7 @@ image: "{{ grafana_image }}" restart_policy: unless-stopped recreate: false - env: - GF_SECURITY_ADMIN_USER: "{{ grafana_admin_user }}" - GF_SECURITY_ADMIN_PASSWORD: "{{ grafana_admin_password }}" - GF_USERS_ALLOW_SIGN_UP: "false" - GF_SMTP_ENABLED: "true" - GF_SMTP_HOST: "{{ grafana_mail_hostname }}" - GF_SMTP_USER: "{{ grafana_mail_username }}" - GF_SMTP_PASSWORD: "{{ grafana_mail_password }}" - GF_SMTP_FROM_ADDRESS: "{{ grafana_mail_from }}" - GF_SMTP_FROM_NAME: "{{ grafana_mail_from_name }}" - GF_SERVER_DOMAIN: "{{ grafana_server_domain }}" - GF_SERVER_ROOT_URL: "{{ grafana_server_root_url }}" - GF_AUTH_GENERIC_OAUTH_ENABLED: "{{ grafana_generic_oauth_enabled }}" - GF_AUTH_GENERIC_OAUTH_NAME: "{{ grafana_generic_oauth_name }}" - GF_AUTH_GENERIC_OAUTH_ALLOW_SIGN_UP: "{{ grafana_generic_oauth_sign_up }}" - GF_AUTH_GENERIC_OAUTH_CLIENT_ID: "{{ grafana_generic_oauth_client_id }}" - GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: "{{ grafana_generic_oauth_client_secret }}" - GF_AUTH_GENERIC_OAUTH_SCOPES: "{{ grafana_generic_oauth_scopes }}" - GF_AUTH_GENERIC_OAUTH_AUTH_URL: "{{ grafana_generic_oauth_auth_url }}" - GF_AUTH_GENERIC_OAUTH_TOKEN_URL: "{{ grafana_generic_oauth_token_url }}" - GF_AUTH_GENERIC_OAUTH_API_URL: "{{ grafana_generic_oauth_api_url }}" - GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH: contains(roles[*], 'admin') && 'Admin' || contains(roles[*], 'editor') && 'Editor' || 'Viewer' + env: "{{ grafana_env }}" volumes: - "{{ grafana_volume_name }}:/var/lib/grafana" - "{{ grafana_data_dir }}/datasource.yml:/etc/grafana/provisioning/datasources/datasource.yml" diff --git a/roles/packages/README.md b/roles/packages/README.md index 299b7af6..3baf4c98 100644 --- a/roles/packages/README.md +++ b/roles/packages/README.md @@ -1,6 +1,6 @@ # Packages role -Set env vars and install packages and scripts. +Set env vars and install packages. ## Usage @@ -21,9 +21,11 @@ packages: version: 2:8.0.1453-1ubuntu1.3 host_packages: - name: cifs_utils -packages_snap: +snap_packages: - name: ripgrep -scripts: +pip_packages: + - name: docker +script_packages: - path: /usr/local/bin/hello-mom content: | echo "Hello Mom!" diff --git a/roles/packages/tasks/main.yml b/roles/packages/tasks/main.yml index 3b076cbe..1e148eb0 100644 --- a/roles/packages/tasks/main.yml +++ b/roles/packages/tasks/main.yml @@ -22,7 +22,7 @@ - name: Include {{ role_name }} snap tasks ansible.builtin.include_tasks: "{{ role_name }}_snap.yml" - when: packages_snap is defined and ansible_distribution == 'Ubuntu' + when: snap_packages is defined and ansible_distribution == 'Ubuntu' tags: - packages @@ -44,8 +44,14 @@ tags: - packages -- name: Include scripts tasks - ansible.builtin.include_tasks: scripts.yml - when: scripts is defined +- name: Include {{ role_name }} scripts tasks + ansible.builtin.include_tasks: "{{ role_name }}_scrips.yml" + when: packages_script is defined + tags: + - packages + +- name: Include {{ role_name }} scripts tasks + ansible.builtin.include_tasks: "{{ role_name }}_pip.yml" + when: pip_packages is defined tags: - packages diff --git a/roles/packages/tasks/packages_pip.yml b/roles/packages/tasks/packages_pip.yml new file mode 100644 index 00000000..71f122ce --- /dev/null +++ b/roles/packages/tasks/packages_pip.yml @@ -0,0 +1,7 @@ +--- +- name: Install pip packages + ansible.builtin.pip: + name: "{{ item.name }}" + state: present + break_system_packages: true + loop: "{{ pip_packages }}" diff --git a/roles/packages/tasks/scripts.yml b/roles/packages/tasks/packages_script.yml similarity index 100% rename from roles/packages/tasks/scripts.yml rename to roles/packages/tasks/packages_script.yml diff --git a/roles/packages/tasks/packages_snap.yml b/roles/packages/tasks/packages_snap.yml index 445289ed..b0c3c849 100644 --- a/roles/packages/tasks/packages_snap.yml +++ b/roles/packages/tasks/packages_snap.yml @@ -10,7 +10,7 @@ name: "{{ item.name }}" classic: "{{ item.classic | default(false) }}" state: present - loop: "{{ packages_snap }}" + loop: "{{ snap_packages }}" when: item.version is not defined - name: Install versioned packages @@ -18,5 +18,5 @@ name: "{{ item.name }}={{ item.version }}" classic: "{{ item.classic | default(false) }}" state: present - loop: "{{ packages_snap }}" + loop: "{{ snap_packages }}" when: item.version is defined diff --git a/roles/prometheus/README.md b/roles/prometheus/README.md index fea584a8..fd1d19a6 100644 --- a/roles/prometheus/README.md +++ b/roles/prometheus/README.md @@ -15,6 +15,10 @@ prometheus_hostname: prom01 prometheus_description: Monitoring # default: Prometheus prometheus_volume_name: prom_data01 # default: "{{ prometheus_hostname }}" prometheus_data_dir: /usr/share/prom # default: "/usr/share/{{ prometheus_hostname }}" +prometheus_hosts: # default: groups['all'] + - server1.example.com + - server2.example.com + - server3.example.com prometheus_port: 127.0.0.1:9999 # default: 127.0.0.1:9090 prometheus_retention_time: "30d" # default: "15d" prometheus_etc_hosts: # defaults: {} @@ -66,7 +70,7 @@ And include it in your playbook. ### Predefined srape configs -The `prometheus.yml` template contains predefined srcape jobs that lookup proxy configurations in the Ansible inventory. +The `prometheus.yml` template contains predefined srcape jobs that lookup proxy configurations of `prometheus_hosts` in the Ansible inventory. * **prometheus**: Target is `localhost:9090`. * **node-exporter https**: Targets are `nginx_proxies` with exporter `node`. diff --git a/roles/prometheus/defaults/main.yml b/roles/prometheus/defaults/main.yml index d4781b1b..012e396e 100644 --- a/roles/prometheus/defaults/main.yml +++ b/roles/prometheus/defaults/main.yml @@ -3,5 +3,6 @@ prometheus_port: 127.0.0.1:9090 prometheus_description: Prometheus prometheus_volume_name: "{{ prometheus_hostname }}" prometheus_data_dir: /usr/share/{{ prometheus_hostname }} +prometheus_hosts: "{{ groups['all'] }}" prometheus_etc_hosts: {} prometheus_retention_time: 15d diff --git a/roles/prometheus/tasks/prometheus.yml b/roles/prometheus/tasks/prometheus.yml index 611f2fe9..ac2d008a 100644 --- a/roles/prometheus/tasks/prometheus.yml +++ b/roles/prometheus/tasks/prometheus.yml @@ -10,11 +10,11 @@ - name: Extract and filter blackbox target hostnames ansible.builtin.set_fact: - src_hostnames: "{{ groups['all'] | map('extract', hostvars) | json_query('[*].nginx_proxies[?monitor!=`false` && monitor!=null].src_hostname') | flatten }}" + src_hostnames: "{{ prometheus_hosts | map('extract', hostvars) | json_query('[*].nginx_proxies[?monitor!=`false` && monitor!=null].src_hostname') | flatten }}" - name: Extract and filter blackbox target paths ansible.builtin.set_fact: - paths: "{{ groups['all'] | map('extract', hostvars) | json_query('[*].nginx_proxies[?monitor!=`false` && monitor!=null].monitor') | flatten }}" + paths: "{{ prometheus_hosts | map('extract', hostvars) | json_query('[*].nginx_proxies[?monitor!=`false` && monitor!=null].monitor') | flatten }}" - name: Generate blackbox target urls ansible.builtin.set_fact: diff --git a/roles/prometheus/templates/prometheus.yml b/roles/prometheus/templates/prometheus.yml index 3e1bcd81..debeb20e 100644 --- a/roles/prometheus/templates/prometheus.yml +++ b/roles/prometheus/templates/prometheus.yml @@ -1,12 +1,12 @@ +--- scrape_configs: - - job_name: prometheus scrape_interval: 30s honor_labels: true static_configs: - targets: - localhost:9090 - +{% if prometheus_node_exporter_basic_auth_username is defined %} - job_name: node-exporter https metrics_path: "/node-exporter/metrics" scrape_interval: 30s @@ -16,8 +16,9 @@ scrape_configs: username: {{ prometheus_node_exporter_basic_auth_username }} password: {{ prometheus_node_exporter_basic_auth_password }} static_configs: - - targets: {{ groups['all'] | map('extract', hostvars) | json_query('[*].nginx_proxies[?exporter!=null && contains(exporter, `node`)].src_hostname') | flatten }} - + - targets: {{ prometheus_hosts | map('extract', hostvars) | json_query('[*].nginx_proxies[?exporter!=null && contains(exporter, `node`)].src_hostname') | flatten }} +{% endif %} +{% if prometheus_cadvisor_basic_auth_username is defined %} - job_name: cadvisor https metrics_path: "/cadvisor/metrics" scrape_interval: 30s @@ -27,8 +28,9 @@ scrape_configs: username: {{ prometheus_cadvisor_basic_auth_username }} password: {{ prometheus_cadvisor_basic_auth_password }} static_configs: - - targets: {{ groups['all'] | map('extract', hostvars) | json_query('[*].nginx_proxies[?exporter!=null && contains(exporter, `cadvisor`)].src_hostname') | flatten }} - + - targets: {{ prometheus_hosts | map('extract', hostvars) | json_query('[*].nginx_proxies[?exporter!=null && contains(exporter, `cadvisor`)].src_hostname') | flatten }} +{% endif %} +{% if prometheus_nextcloud_exporter_basic_auth_username is defined %} - job_name: nextcloud https metrics_path: "/nextcloud-exporter/metrics" scrape_interval: 30s @@ -38,8 +40,9 @@ scrape_configs: username: {{ prometheus_nextcloud_exporter_basic_auth_username }} password: {{ prometheus_nextcloud_exporter_basic_auth_password }} static_configs: - - targets: {{ groups['all'] | map('extract', hostvars) | json_query('[*].nginx_proxies[?exporter!=null && contains(exporter, `nextcloud`)].src_hostname') | flatten }} - + - targets: {{ prometheus_hosts | map('extract', hostvars) | json_query('[*].nginx_proxies[?exporter!=null && contains(exporter, `nextcloud`)].src_hostname') | flatten }} +{% endif %} +{% if prometheus_bigbluebutton_exporter_basic_auth_username is defined %} - job_name: bigbluebutton http metrics_path: "/bigbluebutton-exporter/metrics" scrape_interval: 30s @@ -49,8 +52,9 @@ scrape_configs: username: {{ prometheus_bigbluebutton_exporter_basic_auth_username }} password: {{ prometheus_bigbluebutton_exporter_basic_auth_password }} static_configs: - - targets: {{ groups['all'] | map('extract', hostvars) | json_query('[*].nginx_proxies[?exporter!=null && contains(exporter, `bigbluebutton`)].src_hostname') | flatten }} - + - targets: {{ prometheus_hosts | map('extract', hostvars) | json_query('[*].nginx_proxies[?exporter!=null && contains(exporter, `bigbluebutton`)].src_hostname') | flatten }} +{% endif %} +{% if prometheus_postgres_exporter_basic_auth_username is defined %} - job_name: postgres https metrics_path: "/postgres-exporter/metrics" scrape_interval: 30s @@ -60,8 +64,9 @@ scrape_configs: username: {{ prometheus_postgres_exporter_basic_auth_username }} password: {{ prometheus_postgres_exporter_basic_auth_password }} static_configs: - - targets: {{ groups['all'] | map('extract', hostvars) | json_query('[*].nginx_proxies[?exporter!=null && contains(exporter, `postgres`)].src_hostname') | flatten }} - + - targets: {{ prometheus_hosts | map('extract', hostvars) | json_query('[*].nginx_proxies[?exporter!=null && contains(exporter, `postgres`)].src_hostname') | flatten }} +{% endif %} +{% if prometheus_restic_server_basic_auth_username is defined %} - job_name: restic-server https metrics_path: "/restic-server/metrics" scrape_interval: 30s @@ -71,16 +76,9 @@ scrape_configs: username: {{ prometheus_restic_server_basic_auth_username }} password: {{ prometheus_restic_server_basic_auth_password }} static_configs: - - targets: {{ groups['all'] | map('extract', hostvars) | json_query('[*].nginx_proxies[?exporter!=null && contains(exporter, `restic`)].src_hostname') | flatten }} - - - job_name: odoo https - metrics_path: "/metrics" - scrape_interval: 60s - honor_labels: true - scheme: https - static_configs: - - targets: {{ groups['all'] | map('extract', hostvars) | json_query('[*].nginx_proxies[?exporter!=null && contains(exporter, `odoo`)].src_hostname') | flatten }} - + - targets: {{ prometheus_hosts | map('extract', hostvars) | json_query('[*].nginx_proxies[?exporter!=null && contains(exporter, `restic`)].src_hostname') | flatten }} +{% endif %} +{% if prometheus_mysqld_exporter_basic_auth_username is defined %} - job_name: mysqld https metrics_path: "/mysqld-exporter/metrics" scrape_interval: 30s @@ -90,8 +88,16 @@ scrape_configs: username: {{ prometheus_mysqld_exporter_basic_auth_username }} password: {{ prometheus_mysqld_exporter_basic_auth_password }} static_configs: - - targets: {{ groups['all'] | map('extract', hostvars) | json_query('[*].nginx_proxies[?exporter!=null && contains(exporter, `mysqld`)].src_hostname') | flatten }} - + - targets: {{ prometheus_hosts | map('extract', hostvars) | json_query('[*].nginx_proxies[?exporter!=null && contains(exporter, `mysqld`)].src_hostname') | flatten }} +{% endif %} + - job_name: odoo https + metrics_path: "/metrics" + scrape_interval: 60s + honor_labels: true + scheme: https + static_configs: + - targets: {{ prometheus_hosts | map('extract', hostvars) | json_query('[*].nginx_proxies[?exporter!=null && contains(exporter, `odoo`)].src_hostname') | flatten }} +{% if blackbox_exporter_hostname is defined %} - job_name: blackbox metrics_path: "/probe" scrape_interval: 60s @@ -105,4 +111,5 @@ scrape_configs: - source_labels: [__param_target] target_label: instance - target_label: __address__ - replacement: blackbox01:9115 + replacement: {{ blackbox_exporter_hostname }}:9115 +{% endif %} diff --git a/roles/timezone/tasks/timezone.yml b/roles/timezone/tasks/timezone.yml index 7f598e15..6547a174 100644 --- a/roles/timezone/tasks/timezone.yml +++ b/roles/timezone/tasks/timezone.yml @@ -2,7 +2,7 @@ - name: Get {{ role_name }} ansible.builtin.command: timedatectl show --property=Timezone --value changed_when: false - ignore_errors: True + ignore_errors: true register: current_timezone - name: Set {{ role_name }} diff --git a/task b/task index 6d0d4c83..298c3c31 100755 --- a/task +++ b/task @@ -14,6 +14,7 @@ printf "| %-${cmd_width}s | %-${opt_width}s | %-${desc_width}s |\n" "Command" "O echo "|$(printf '%*s' $((cmd_width + 2)) '' | tr ' ' '-')|$(printf '%*s' $((opt_width + 2)) '' | tr ' ' '-')|$(printf '%*s' $((desc_width + 2)) '' | tr ' ' '-')|" printf "| %-${cmd_width}s | %-${opt_width}s | %-${desc_width}s |\n" "generate-passwordfile" "[password]" "Generate a password file for Ansible vault." printf "| %-${cmd_width}s | %-${opt_width}s | %-${desc_width}s |\n" "install" "" "Install Ansible and dependencies with pip." +printf "| %-${cmd_width}s | %-${opt_width}s | %-${desc_width}s |\n" "upgrade" "" "Upgrade Ansible and dependencies with pip." printf "| %-${cmd_width}s | %-${opt_width}s | %-${desc_width}s |\n" "lint" "" "Lint Ansible roles and playbooks." printf "| %-${cmd_width}s | %-${opt_width}s | %-${desc_width}s |\n" "galaxy-build" "" "Create tarball of collection." printf "| %-${cmd_width}s | %-${opt_width}s | %-${desc_width}s |\n" "galaxy-publish" "" "Publish tarball to Ansible Galaxy." @@ -58,20 +59,25 @@ function activate-venv() { } function install() { - echo "Setup Ansible log file." + echo "Setup Ansible log file" sudo touch /var/log/ansible.log sudo chown $USER: /var/log/ansible.log init-venv activate-venv - echo "Install Ansible and Python dependencies." + echo "Install Ansible and Python dependencies" sudo apt install graphviz pip install -r requirements.txt ansible-galaxy collection install community.general } +function upgrade() { + echo "Update Ansible" + pip install --upgrade ansible +} + function update-docs() { activate-venv python3 ./library/graph.py @@ -132,6 +138,9 @@ case "$1" in install) install ;; + upgrade) + upgrade + ;; version) version ;;