fluent-bit.yml (5251B)
1 --- 2 - name: Validate Fluent Bit platform and configuration 3 ansible.builtin.assert: 4 that: 5 - ansible_facts['distribution'] == 'Debian' 6 - ansible_facts['distribution_major_version'] == '13' 7 - ansible_facts['architecture'] in ['x86_64', 'aarch64'] 8 - monitoring_fluent_bit_version is match('^[0-9]+\.[0-9]+\.[0-9]+$') 9 - monitoring_fluent_bit_queue_limit is match('^[1-9][0-9]*[KMG]$') 10 - monitoring_fluent_bit_url is match('^https://[A-Za-z0-9][A-Za-z0-9.-]*(?::[0-9]{1,5})?/jsonline$') 11 - >- 12 (monitoring_fluent_bit_url | urlsplit('port')) is none 13 or (monitoring_fluent_bit_url | urlsplit('port')) | int > 0 14 - ((monitoring_fluent_bit_url | urlsplit('port')) or 443) | int < 65536 15 - "'fluent-bit.service' in monitoring_fluent_bit_excluded_units" 16 - >- 17 (monitoring_fluent_bit_excluded_units + monitoring_fluent_bit_receiver_units) 18 | select('match', '^[A-Za-z0-9_.@-]+\.service$') | list | length 19 == (monitoring_fluent_bit_excluded_units + monitoring_fluent_bit_receiver_units) | length 20 fail_msg: Fluent Bit requires Debian 13 amd64/arm64 and valid HTTPS, buffer and exclusion settings. 21 22 - name: Discover installed packages for check mode 23 ansible.builtin.package_facts: 24 manager: auto 25 26 - name: Install Fluent Bit repository prerequisites 27 ansible.builtin.apt: 28 name: ca-certificates 29 state: present 30 update_cache: true 31 cache_valid_time: 3600 32 policy_rc_d: 101 33 34 - name: Install the Fluent Bit repository signing key 35 ansible.builtin.get_url: 36 url: https://packages.fluentbit.io/fluentbit.key 37 dest: /usr/share/keyrings/fluentbit.asc 38 checksum: sha256:df248e2d7103ca62cb683c20a077198d0fb0a7f79dbf53a604af0317de3b4711 39 owner: root 40 group: root 41 mode: "0644" 42 43 - name: Configure the signed Fluent Bit repository 44 ansible.builtin.copy: 45 content: >- 46 deb [signed-by=/usr/share/keyrings/fluentbit.asc] 47 https://packages.fluentbit.io/debian/trixie trixie main 48 dest: /etc/apt/sources.list.d/fluent-bit.list 49 owner: root 50 group: root 51 mode: "0644" 52 register: monitoring_fluent_bit_repository 53 54 - name: Pin Fluent Bit to the tested release 55 ansible.builtin.copy: 56 content: | 57 Package: fluent-bit 58 Pin: version {{ monitoring_fluent_bit_version }} 59 Pin-Priority: 1001 60 dest: /etc/apt/preferences.d/taler-fluent-bit 61 owner: root 62 group: root 63 mode: "0644" 64 65 - name: Install Fluent Bit without starting the package configuration 66 ansible.builtin.apt: 67 name: "fluent-bit={{ monitoring_fluent_bit_version }}" 68 state: present 69 allow_downgrade: true 70 update_cache: "{{ monitoring_fluent_bit_repository.changed }}" 71 install_recommends: false 72 policy_rc_d: 101 73 notify: Restart monitoring Fluent Bit 74 when: not ansible_check_mode or 'fluent-bit' in ansible_facts.packages 75 76 - name: Create private Fluent Bit state and systemd configuration directories 77 ansible.builtin.file: 78 path: "{{ item.path }}" 79 state: directory 80 owner: root 81 group: root 82 mode: "{{ item.mode }}" 83 loop: 84 - { path: /var/lib/fluent-bit, mode: "0700" } 85 - { path: /var/lib/fluent-bit/buffer, mode: "0700" } 86 - { path: /etc/systemd/journald.conf.d, mode: "0755" } 87 - { path: /etc/systemd/system/fluent-bit.service.d, mode: "0755" } 88 89 - name: Configure persistent journald storage without syslog forwarding 90 ansible.builtin.copy: 91 content: | 92 # Managed by Ansible. Keep host-specific journal retention settings. 93 [Journal] 94 Storage=persistent 95 ForwardToSyslog=no 96 dest: /etc/systemd/journald.conf.d/60-taler-monitoring.conf 97 owner: root 98 group: root 99 mode: "0644" 100 notify: Restart monitoring journal 101 102 - name: Configure Fluent Bit service recovery and private state 103 ansible.builtin.copy: 104 content: | 105 [Service] 106 Restart=on-failure 107 RestartSec=5s 108 UMask=0077 109 TimeoutStopSec=45s 110 dest: /etc/systemd/system/fluent-bit.service.d/monitoring.conf 111 owner: root 112 group: root 113 mode: "0644" 114 notify: Restart monitoring Fluent Bit 115 116 - name: Configure buffered JSON Lines forwarding 117 ansible.builtin.template: 118 src: fluent-bit.conf.j2 119 dest: /etc/fluent-bit/fluent-bit.conf 120 owner: root 121 group: root 122 mode: "0600" 123 validate: /opt/fluent-bit/bin/fluent-bit --dry-run -c %s 124 notify: Restart monitoring Fluent Bit 125 126 - name: Discover legacy logging services 127 ansible.builtin.service_facts: 128 129 - name: Stop and disable rsyslog before removing its packages 130 ansible.builtin.systemd_service: 131 name: rsyslog 132 state: stopped 133 enabled: false 134 when: "ansible_facts.services.get('rsyslog.service', {}).get('status', 'not-found') != 'not-found'" 135 136 - name: Remove rsyslog and RELP packages while preserving historical files 137 ansible.builtin.apt: 138 name: 139 - rsyslog-relp 140 - rsyslog 141 state: absent 142 purge: false 143 autoremove: false 144 145 - name: Remove obsolete managed RELP forwarding configuration and TLS copies 146 ansible.builtin.file: 147 path: "{{ item }}" 148 state: absent 149 loop: 150 - /etc/rsyslog.d/60-sentol-forward.conf 151 - /etc/rsyslog.d/tls/relp-ca.cert.pem 152 - /etc/rsyslog.d/tls/relp-client.cert.pem 153 - /etc/rsyslog.d/tls/relp-client.key.pem