commit 8376543cdb8b786565a3499d2837f430f5f56ec6
parent 1a04dd028b39c37995877428870fbc1348688ca7
Author: Florian Dold <dold@taler.net>
Date: Mon, 7 Sep 2026 21:37:14 +0200
monitoring: remove completed legacy cleanup
Diffstat:
7 files changed, 3 insertions(+), 270 deletions(-)
diff --git a/README b/README
@@ -212,23 +212,6 @@ and `/etc/taler-monitoring` (including its private keys) and run
exports. This does not revoke previously issued certificates; complete
the Sentol offboarding steps as well.
-### remove-monitoring
-
-The legacy monitoring stack is no longer deployed by this repository. To
-permanently remove its services, packages, configuration, local metrics data,
-nginx site, certificate, and database user from an existing deployment, run:
-
-```
-$ ./remove-monitoring $DEPLOYMENT
-```
-
-This is destructive. It does not back up the local Prometheus or Alloy data.
-When the external monitoring proxy unit is installed, cleanup preserves
-its exporter service, package, configuration, and exporter textfile directory,
-independently of `enable_monitoring`. Other legacy Prometheus data is removed.
-It does not offboard the external monitoring client.
-
-
### Setting up backups (TOPS-only for now)
First run:
@@ -326,10 +309,6 @@ pixel still needs to be setup to send the backups.
Safely reboots the system by first stopping all Taler services,
then making a backup and only then actually rebooting it.
-### remove-monitoring
-
-Permanently removes the legacy monitoring infrastructure and its local data.
-
### sanctionlist-check
Imports the latest sanction list and checks all records against
@@ -411,7 +390,6 @@ Deploys libeufin-nexus which connects us to the bank.
### monitoring
Provisions external node monitoring when `enable_monitoring` is true.
-Also contains the legacy cleanup tasks used by the remove-monitoring playbook.
### pixel_borg
@@ -496,4 +474,4 @@ devtesting revocation, preservation of unrelated configuration, failed deploymen
and recovery. All fixtures run in the disposable container, never an inventory
production host. Monitoring regressions also cover Vault-encrypted onboarding
bundles, preflight failures before application shutdown, authenticated metrics,
-RELP delivery, certificate renewal, idempotence, check mode, and legacy cleanup.
+RELP delivery, certificate renewal, idempotence, and check mode.
diff --git a/contrib/tests/test_monitoring.py b/contrib/tests/test_monitoring.py
@@ -267,18 +267,11 @@ input(type="imrelp" address="127.0.0.1" port="12514" ruleset="received"
# Exercise the real setup entrypoint with monitoring enabled.
invoke(REPO / 'playbooks/setup.yml')
verify_metrics()
- container('mkdir', '-p', '/var/lib/prometheus/metrics2')
- container('touch', '/var/lib/prometheus/metrics2/legacy-data',
- '/var/lib/prometheus/node-exporter/keep.prom')
- invoke(REPO / 'playbooks/remove-monitoring.yml', enabled=False)
- assert container('test', '-e', '/var/lib/prometheus/metrics2', check=False).returncode != 0
- container('test', '-f', '/var/lib/prometheus/node-exporter/keep.prom')
- verify_metrics()
- log_delivery('monitoring-survives-legacy-removal')
+ log_delivery('monitoring-survives-deployment')
container('curl', '--fail', '--silent', '--show-error', '--unix-socket',
'/var/run/taler-exchange/httpd/exchange-http.sock', 'http://localhost/config')
container('curl', '--fail', '--silent', '--show-error', 'http://127.0.0.1:8098/')
- print('PASS: normal deployment and legacy cleanup preserve monitoring and exchange endpoints', flush=True)
+ print('PASS: normal deployment preserves monitoring and exchange endpoints', flush=True)
finally:
container('systemctl', 'stop', 'monitoring-test-receiver', check=False)
container('rm', '-rf', remote)
diff --git a/playbooks/remove-monitoring.yml b/playbooks/remove-monitoring.yml
@@ -1,15 +0,0 @@
----
-- name: Remove the legacy monitoring infrastructure
- hosts: all
- gather_facts: false
- any_errors_fatal: true
- pre_tasks:
- - name: Gather host facts without logging stored local secrets
- ansible.builtin.setup:
- no_log: true
-
- tasks:
- - name: Remove the legacy monitoring infrastructure
- ansible.builtin.include_role:
- name: monitoring
- tasks_from: remove
diff --git a/remove-monitoring b/remove-monitoring
@@ -1,19 +0,0 @@
-#!/bin/sh
-set -eu
-
-if [ -z "${1:-}" ]
-then
- echo "Usage: $0 <host/group> [ansible-playbook options...]" >&2
- exit 1
-fi
-
-target=$1
-shift
-
-ansible-playbook \
- --inventory inventories/default \
- --limit "$target" \
- playbooks/remove-monitoring.yml \
- "$@"
-
-exit 0
diff --git a/roles/monitoring/handlers/main.yml b/roles/monitoring/handlers/main.yml
@@ -40,15 +40,3 @@
state: restarted
listen: Restart monitoring rsyslog
when: not ansible_check_mode
-
-- name: Validate nginx before restart
- ansible.builtin.command: nginx -c /etc/nginx/nginx.conf -t
- changed_when: false
- check_mode: false
- listen: Restart nginx
-
-- name: Restart validated nginx
- ansible.builtin.service:
- name: nginx
- state: restarted
- listen: Restart nginx
diff --git a/roles/monitoring/tasks/disable.yml b/roles/monitoring/tasks/disable.yml
@@ -1,24 +0,0 @@
----
-- name: Detect the external monitoring installation independently of inventory
- ansible.builtin.stat:
- path: /etc/systemd/system/node-exporter-proxy.service
- register: monitoring_external_installation
-
-- name: Get the list of services
- service_facts:
-
-- name: Stop and disable existing monitoring services
- service:
- name: "{{ item }}"
- state: stopped
- enabled: false
- loop:
- - alloy.service
- - prometheus-node-exporter.service
- - prometheus-nginx-exporter.service
- - prometheus-postgres-exporter.service
- - prometheus-alertmanager.service
- - prometheus.service
- when:
- - item in ansible_facts["services"]
- - item != 'prometheus-node-exporter.service' or not monitoring_external_installation.stat.exists
diff --git a/roles/monitoring/tasks/remove.yml b/roles/monitoring/tasks/remove.yml
@@ -1,168 +0,0 @@
----
-- name: Stop the legacy monitoring services
- ansible.builtin.include_tasks: disable.yml
-
-- name: Remove legacy monitoring nginx sites
- ansible.builtin.file:
- path: "{{ item }}"
- state: absent
- loop:
- - /etc/nginx/sites-enabled/monitoring-nginx.conf
- - /etc/nginx/sites-enabled/monitoring-http.conf
- - /etc/nginx/sites-available/monitoring-nginx.conf
- - /etc/nginx/sites-available/monitoring-http.conf
- notify: Restart nginx
-
-# Reload nginx while the monitoring certificate still exists. This keeps a
-# pending handler from trying to load a configuration that references a
-# certificate which has already been removed.
-- name: Apply removal of legacy monitoring nginx sites
- ansible.builtin.meta: flush_handlers
-
-- name: Delete the legacy monitoring certificate with certbot
- ansible.builtin.command:
- argv:
- - certbot
- - delete
- - --cert-name
- - monitoring
- - --non-interactive
- removes: /etc/letsencrypt/renewal/monitoring.conf
-
-- name: Remove leftover legacy monitoring certificate files
- ansible.builtin.file:
- path: "{{ item }}"
- state: absent
- loop:
- - /etc/letsencrypt/live/monitoring
- - /etc/letsencrypt/archive/monitoring
- - /etc/letsencrypt/renewal/monitoring.conf
-
-- name: Remove the Grafana package repository
- ansible.builtin.deb822_repository:
- name: Grafana
- state: absent
- when: ansible_facts["os_family"] == 'Debian'
-
-- name: Remove the Grafana package repository signing key
- ansible.builtin.file:
- path: /etc/apt/keyrings/grafana.gpg
- state: absent
-
-- name: Purge legacy monitoring packages
- ansible.builtin.apt:
- name: >-
- {{ ['alloy', 'prometheus', 'prometheus-alertmanager',
- 'prometheus-nginx-exporter', 'prometheus-postgres-exporter']
- + ([] if monitoring_external_installation.stat.exists else ['prometheus-node-exporter']) }}
- state: absent
- purge: true
- autoremove: true
- when: ansible_facts["os_family"] == 'Debian'
-
-- name: Remove legacy monitoring configuration and data
- ansible.builtin.file:
- path: "{{ item }}"
- state: absent
- loop:
- - /etc/default/alloy
- - /etc/default/prometheus
- - /etc/default/prometheus-alertmanager
- - /etc/default/prometheus-nginx-exporter
- - /etc/default/prometheus-node-exporter
- - /etc/default/prometheus-postgres-exporter
- - /etc/alloy
- - /etc/prometheus
- - /var/lib/alloy
- - /var/lib/prometheus
- when: >-
- not monitoring_external_installation.stat.exists or
- item not in ['/etc/default/prometheus-node-exporter', '/var/lib/prometheus']
-
-- name: Find legacy Prometheus data alongside the retained exporter directory
- ansible.builtin.find:
- paths: /var/lib/prometheus
- file_type: any
- hidden: true
- excludes: node-exporter
- register: monitoring_legacy_prometheus_data
- when: monitoring_external_installation.stat.exists
-
-- name: Remove legacy Prometheus data without removing exporter textfiles
- ansible.builtin.file:
- path: "{{ item.path }}"
- state: absent
- loop: "{{ monitoring_legacy_prometheus_data.files | default([]) }}"
- loop_control:
- label: "{{ item.path }}"
-
-- name: Find legacy monitoring nginx logs
- ansible.builtin.find:
- paths: /var/log/nginx
- patterns: monitoring.*
- file_type: file
- register: monitoring_nginx_logs
-
-- name: Remove legacy monitoring nginx logs
- ansible.builtin.file:
- path: "{{ item.path }}"
- state: absent
- loop: "{{ monitoring_nginx_logs.files }}"
- loop_control:
- label: "{{ item.path }}"
-
-- name: Check for the legacy Prometheus database user
- become: true
- become_user: postgres
- community.postgresql.postgresql_query:
- login_user: postgres
- login_db: postgres
- query: SELECT 1 FROM pg_roles WHERE rolname = 'prometheus'
- register: monitoring_prometheus_role
- changed_when: false
-
-- name: Find all databases in the PostgreSQL cluster
- become: true
- become_user: postgres
- community.postgresql.postgresql_query:
- login_user: postgres
- login_db: postgres
- query: SELECT datname FROM pg_database
- register: monitoring_databases
- changed_when: false
-
-- name: Revoke all database privileges granted to the Prometheus user
- become: true
- become_user: postgres
- community.postgresql.postgresql_privs:
- login_user: postgres
- login_db: postgres
- type: database
- objs: "{{ item }}"
- roles: prometheus
- privs: ALL
- state: absent
- loop: >-
- {{ monitoring_databases.query_result | map(attribute='datname') | list }}
- when: monitoring_prometheus_role.rowcount > 0
-
-- name: Revoke PostgreSQL catalog access granted to the Prometheus user
- become: true
- become_user: postgres
- community.postgresql.postgresql_query:
- login_user: postgres
- login_db: postgres
- query: >-
- REVOKE USAGE ON SCHEMA pg_catalog FROM prometheus;
- REVOKE SELECT ON ALL TABLES IN SCHEMA pg_catalog FROM prometheus
- when: monitoring_prometheus_role.rowcount > 0
-
-- name: Remove the legacy Prometheus database user
- become: true
- become_user: postgres
- community.postgresql.postgresql_user:
- login_user: postgres
- login_db: postgres
- name: prometheus
- state: absent
- when: monitoring_prometheus_role.rowcount > 0
