main.yml (3798B)
1 --- 2 - name: Validate the external monitoring bundle 3 ansible.builtin.include_tasks: preflight.yml 4 5 - name: Discover existing monitoring services for check mode 6 ansible.builtin.service_facts: 7 when: ansible_check_mode 8 9 - name: Install monitoring client packages without starting default listeners 10 ansible.builtin.apt: 11 name: 12 - nginx 13 - prometheus-node-exporter 14 state: present 15 update_cache: true 16 cache_valid_time: 3600 17 install_recommends: false 18 policy_rc_d: 101 19 20 - name: Create monitoring configuration and TLS directories 21 ansible.builtin.file: 22 path: "{{ item.path }}" 23 state: directory 24 owner: root 25 group: root 26 mode: "{{ item.mode }}" 27 loop: 28 - { path: /etc/taler-monitoring, mode: '0755' } 29 - { path: /etc/taler-monitoring/tls, mode: '0700' } 30 31 - name: Install monitoring TLS material 32 ansible.builtin.copy: 33 content: "{{ item.content | trim }}\n" 34 dest: "/etc/taler-monitoring/tls/{{ item.name }}" 35 owner: root 36 group: root 37 mode: "{{ item.mode }}" 38 loop: 39 - name: ca.cert.pem 40 content: "{{ monitoring_public_bundle.monitoring_client.monitoring_ca_certificate }}" 41 mode: '0644' 42 - name: client.cert.pem 43 content: "{{ monitoring_public_bundle.monitoring_client.client_certificate }}" 44 mode: '0644' 45 - name: client.key.pem 46 content: "{{ monitoring_secret_bundle.monitoring_client_secrets.client_private_key }}" 47 mode: '0600' 48 - name: server.cert.pem 49 content: "{{ monitoring_public_bundle.monitoring_client.server_certificate }}" 50 mode: '0644' 51 - name: server.key.pem 52 content: "{{ monitoring_secret_bundle.monitoring_client_secrets.server_private_key }}" 53 mode: '0600' 54 no_log: true 55 diff: false 56 notify: 57 - Reload monitoring proxy 58 - Restart monitoring Fluent Bit 59 60 - name: Create the node_exporter textfile directory 61 ansible.builtin.file: 62 path: /var/lib/prometheus/node-exporter 63 state: directory 64 owner: prometheus 65 group: prometheus 66 mode: '0755' 67 when: not ansible_check_mode or 'prometheus-node-exporter.service' in ansible_facts['services'] 68 69 - name: Configure the private node_exporter listener and systemd collector 70 ansible.builtin.template: 71 src: node-exporter-default.j2 72 dest: /etc/default/prometheus-node-exporter 73 owner: root 74 group: root 75 mode: '0644' 76 notify: Restart monitoring node_exporter 77 78 - name: Configure the dedicated monitoring proxy 79 ansible.builtin.template: 80 src: nginx.conf.j2 81 dest: /etc/taler-monitoring/nginx.conf 82 owner: root 83 group: root 84 mode: '0644' 85 validate: /usr/sbin/nginx -t -c %s 86 # Changing between a specific and wildcard listener needs the old socket closed. 87 notify: Restart monitoring proxy 88 89 - name: Install the dedicated monitoring proxy unit 90 ansible.builtin.copy: 91 src: node-exporter-proxy.service 92 dest: /etc/systemd/system/node-exporter-proxy.service 93 owner: root 94 group: root 95 mode: '0644' 96 notify: Restart monitoring proxy 97 98 - name: Install and configure Fluent Bit 99 ansible.builtin.import_tasks: fluent-bit.yml 100 101 - name: Load the configured monitoring units 102 ansible.builtin.systemd_service: 103 daemon_reload: true 104 when: not ansible_check_mode 105 106 # Move an existing legacy exporter off port 9100 before starting the proxy. 107 # This also loads renewed certificate pairs before reporting success. 108 - name: Apply monitoring configuration before enabling services 109 ansible.builtin.meta: flush_handlers 110 111 - name: Enable monitoring services after configuration 112 ansible.builtin.systemd_service: 113 name: "{{ item }}" 114 state: started 115 enabled: true 116 loop: 117 - prometheus-node-exporter 118 - node-exporter-proxy 119 - fluent-bit 120 when: not ansible_check_mode or (item ~ '.service') in ansible_facts['services']