remove.yml (4410B)
1 --- 2 - name: Stop the legacy monitoring services 3 ansible.builtin.include_tasks: disable.yml 4 5 - name: Remove legacy monitoring nginx sites 6 ansible.builtin.file: 7 path: "{{ item }}" 8 state: absent 9 loop: 10 - /etc/nginx/sites-enabled/monitoring-nginx.conf 11 - /etc/nginx/sites-enabled/monitoring-http.conf 12 - /etc/nginx/sites-available/monitoring-nginx.conf 13 - /etc/nginx/sites-available/monitoring-http.conf 14 notify: Restart nginx 15 16 # Reload nginx while the monitoring certificate still exists. This keeps a 17 # pending handler from trying to load a configuration that references a 18 # certificate which has already been removed. 19 - name: Apply removal of legacy monitoring nginx sites 20 ansible.builtin.meta: flush_handlers 21 22 - name: Delete the legacy monitoring certificate with certbot 23 ansible.builtin.command: 24 argv: 25 - certbot 26 - delete 27 - --cert-name 28 - monitoring 29 - --non-interactive 30 removes: /etc/letsencrypt/renewal/monitoring.conf 31 32 - name: Remove leftover legacy monitoring certificate files 33 ansible.builtin.file: 34 path: "{{ item }}" 35 state: absent 36 loop: 37 - /etc/letsencrypt/live/monitoring 38 - /etc/letsencrypt/archive/monitoring 39 - /etc/letsencrypt/renewal/monitoring.conf 40 41 - name: Remove the Grafana package repository 42 ansible.builtin.deb822_repository: 43 name: Grafana 44 state: absent 45 when: ansible_facts["os_family"] == 'Debian' 46 47 - name: Remove the Grafana package repository signing key 48 ansible.builtin.file: 49 path: /etc/apt/keyrings/grafana.gpg 50 state: absent 51 52 - name: Purge legacy monitoring packages 53 ansible.builtin.apt: 54 name: 55 - alloy 56 - prometheus 57 - prometheus-alertmanager 58 - prometheus-nginx-exporter 59 - prometheus-node-exporter 60 - prometheus-postgres-exporter 61 state: absent 62 purge: true 63 autoremove: true 64 when: ansible_facts["os_family"] == 'Debian' 65 66 - name: Remove legacy monitoring configuration and data 67 ansible.builtin.file: 68 path: "{{ item }}" 69 state: absent 70 loop: 71 - /etc/default/alloy 72 - /etc/default/prometheus 73 - /etc/default/prometheus-alertmanager 74 - /etc/default/prometheus-nginx-exporter 75 - /etc/default/prometheus-node-exporter 76 - /etc/default/prometheus-postgres-exporter 77 - /etc/alloy 78 - /etc/prometheus 79 - /var/lib/alloy 80 - /var/lib/prometheus 81 82 - name: Find legacy monitoring nginx logs 83 ansible.builtin.find: 84 paths: /var/log/nginx 85 patterns: monitoring.* 86 file_type: file 87 register: monitoring_nginx_logs 88 89 - name: Remove legacy monitoring nginx logs 90 ansible.builtin.file: 91 path: "{{ item.path }}" 92 state: absent 93 loop: "{{ monitoring_nginx_logs.files }}" 94 loop_control: 95 label: "{{ item.path }}" 96 97 - name: Check for the legacy Prometheus database user 98 become: true 99 become_user: postgres 100 community.postgresql.postgresql_query: 101 login_user: postgres 102 login_db: postgres 103 query: SELECT 1 FROM pg_roles WHERE rolname = 'prometheus' 104 register: monitoring_prometheus_role 105 changed_when: false 106 107 - name: Find all databases in the PostgreSQL cluster 108 become: true 109 become_user: postgres 110 community.postgresql.postgresql_query: 111 login_user: postgres 112 login_db: postgres 113 query: SELECT datname FROM pg_database 114 register: monitoring_databases 115 changed_when: false 116 117 - name: Revoke all database privileges granted to the Prometheus user 118 become: true 119 become_user: postgres 120 community.postgresql.postgresql_privs: 121 login_user: postgres 122 login_db: postgres 123 type: database 124 objs: "{{ item }}" 125 roles: prometheus 126 privs: ALL 127 state: absent 128 loop: >- 129 {{ monitoring_databases.query_result | map(attribute='datname') | list }} 130 when: monitoring_prometheus_role.rowcount > 0 131 132 - name: Revoke PostgreSQL catalog access granted to the Prometheus user 133 become: true 134 become_user: postgres 135 community.postgresql.postgresql_query: 136 login_user: postgres 137 login_db: postgres 138 query: >- 139 REVOKE USAGE ON SCHEMA pg_catalog FROM prometheus; 140 REVOKE SELECT ON ALL TABLES IN SCHEMA pg_catalog FROM prometheus 141 when: monitoring_prometheus_role.rowcount > 0 142 143 - name: Remove the legacy Prometheus database user 144 become: true 145 become_user: postgres 146 community.postgresql.postgresql_user: 147 login_user: postgres 148 login_db: postgres 149 name: prometheus 150 state: absent 151 when: monitoring_prometheus_role.rowcount > 0