feat(monitoring): add grafana, prometheus, node_exporter roles

- grafana: postgres backend, provisioning (prometheus datasource + node/NUT dashboards) - prometheus: native service, scrape config via host_vars, localhost bind - node_exporter: host metrics exporter (localhost:9100)
2026-09-05 17:24:08 +02:00
parent b94743567f
commit 12b81919c3
29 changed files with 1288 additions and 0 deletions
@@ -0,0 +1,89 @@
+# Prometheus Role
+
+Installs and configures Prometheus monitoring system as a native system service.
+
+## Supported Distributions
+
+- Arch Linux
+- Debian/Ubuntu
+
+## Features
+
+- Native system installation (no containers)
+- Configurable scrape targets and intervals
+- Optional Nginx reverse proxy with SSL
+- Retention policy configuration
+- Alert manager integration support
+- Rule files support
+
+## Configuration
+
+See [defaults/main.yml](defaults/main.yml) for all available variables.
+
+### Basic Configuration
+
+```yaml
+prometheus_scrape_interval: 15s
+prometheus_retention_time: 15d
+prometheus_web_listen_address: "127.0.0.1:9090"
+```
+
+### Scrape Targets
+
+```yaml
+prometheus_scrape_configs:
+  - job_name: 'prometheus'
+    static_configs:
+      - targets: ['localhost:9090']
+  - job_name: 'node_exporter'
+    static_configs:
+      - targets: ['localhost:9100']
+```
+
+### Nginx Reverse Proxy
+
+```yaml
+prometheus_nginx_enabled: true
+prometheus_nginx_server_name: prometheus.example.com
+prometheus_nginx_ssl_certificate: /path/to/cert.pem
+prometheus_nginx_ssl_certificate_key: /path/to/key.pem
+```
+
+## Usage
+
+```yaml
+- hosts: monitoring
+  roles:
+    - prometheus
+```
+
+With custom configuration:
+
+```yaml
+- hosts: monitoring
+  vars:
+    prometheus_retention_time: 30d
+    prometheus_scrape_configs:
+      - job_name: 'prometheus'
+        static_configs:
+          - targets: ['localhost:9090']
+      - job_name: 'node_exporter'
+        static_configs:
+          - targets: ['localhost:9100']
+  roles:
+    - prometheus
+```
+
+## Architecture
+
+- **Installation**: Native package from distribution repositories
+- **Service**: System systemd service
+- **Configuration**: `/etc/prometheus/prometheus.yml`
+- **Data**: `/var/lib/prometheus`
+- **Listen**: `127.0.0.1:9090` (localhost only by default)
+
+## Security
+
+- Binds to localhost by default
+- Optional SSL-enabled reverse proxy via Nginx
+- Data directory restricted to prometheus user (mode 0750)
@@ -0,0 +1,49 @@
+---
+# Prometheus configuration
+# See: https://prometheus.io/docs/prometheus/latest/configuration/configuration/
+
+# Scrape interval
+prometheus_scrape_interval: 15s
+prometheus_evaluation_interval: 15s
+
+# Retention settings
+prometheus_retention_time: 15d
+prometheus_retention_size: 0
+
+# Web interface settings
+prometheus_web_listen_address: "127.0.0.1:9090"
+prometheus_web_external_url: ""
+
+# Storage settings (uses prometheus_data_dir from vars/)
+prometheus_storage_tsdb_path: "{{ prometheus_data_dir }}"
+
+# Scrape targets configuration
+# Example:
+# prometheus_scrape_configs:
+#   - job_name: 'prometheus'
+#     static_configs:
+#       - targets: ['localhost:9090']
+#   - job_name: 'node_exporter'
+#     static_configs:
+#       - targets: ['localhost:9100']
+prometheus_scrape_configs:
+  - job_name: 'prometheus'
+    static_configs:
+      - targets: ['localhost:9090']
+
+# Alertmanager configuration (optional)
+# prometheus_alertmanager_configs:
+#   - static_configs:
+#       - targets: ['localhost:9093']
+prometheus_alertmanager_configs: []
+
+# Rule files (optional)
+# prometheus_rule_files:
+#   - '/etc/prometheus/rules/*.yml'
+prometheus_rule_files: []
+
+# Nginx reverse proxy (optional)
+prometheus_nginx_enabled: false
+prometheus_nginx_server_name: prometheus.example.com
+prometheus_nginx_ssl_certificate: /etc/letsencrypt/live/prometheus.example.com/fullchain.pem
+prometheus_nginx_ssl_certificate_key: /etc/letsencrypt/live/prometheus.example.com/privkey.pem
@@ -0,0 +1,10 @@
+---
+- name: Restart Prometheus
+  ansible.builtin.systemd:
+      name: "{{ prometheus_service }}"
+      state: restarted
+
+- name: Reload Nginx
+  ansible.builtin.systemd:
+      name: nginx
+      state: reloaded
@@ -0,0 +1,78 @@
+---
+- name: Load OS-specific variables
+  ansible.builtin.include_vars: "{{ item }}"
+  with_first_found:
+      - "{{ ansible_facts['os_family'] }}.yml"
+      - "debian.yml"
+
+- name: Install Prometheus
+  ansible.builtin.package:
+      name: "{{ prometheus_package }}"
+      state: present
+
+- name: Create Prometheus configuration directory
+  ansible.builtin.file:
+      path: "{{ prometheus_config_dir }}"
+      state: directory
+      owner: "{{ prometheus_user }}"
+      group: "{{ prometheus_group }}"
+      mode: "0755"
+
+- name: Create Prometheus data directory
+  ansible.builtin.file:
+      path: "{{ prometheus_data_dir }}"
+      state: directory
+      owner: "{{ prometheus_user }}"
+      group: "{{ prometheus_group }}"
+      mode: "0750"
+
+- name: Create Prometheus rules directory
+  ansible.builtin.file:
+      path: "{{ prometheus_config_dir }}/rules"
+      state: directory
+      owner: "{{ prometheus_user }}"
+      group: "{{ prometheus_group }}"
+      mode: "0755"
+  when: prometheus_rule_files | length > 0
+
+- name: Deploy Prometheus configuration
+  ansible.builtin.template:
+      src: prometheus.yml.j2
+      dest: "{{ prometheus_config_dir }}/prometheus.yml"
+      owner: "{{ prometheus_user }}"
+      group: "{{ prometheus_group }}"
+      mode: "0644"
+      validate: "promtool check config %s"
+  notify: Restart Prometheus
+
+- name: Deploy Prometheus environment file
+  ansible.builtin.template:
+      src: prometheus-env.conf.j2
+      dest: "{{ prometheus_args_file }}"
+      owner: root
+      group: root
+      mode: "0644"
+  notify: Restart Prometheus
+
+- name: Enable and start Prometheus service
+  ansible.builtin.systemd:
+      name: "{{ prometheus_service }}"
+      enabled: true
+      state: started
+
+- name: Deploy Nginx vhost configuration
+  ansible.builtin.template:
+      src: nginx-vhost.conf.j2
+      dest: "{{ nginx_conf_dir }}/prometheus.conf"
+      owner: root
+      group: root
+      mode: "0644"
+  when: prometheus_nginx_enabled
+  notify: Reload Nginx
+
+- name: Remove Nginx vhost configuration
+  ansible.builtin.file:
+      path: "{{ nginx_conf_dir }}/prometheus.conf"
+      state: absent
+  when: not prometheus_nginx_enabled
+  notify: Reload Nginx
@@ -0,0 +1,30 @@
+server {
+    listen 80;
+    listen [::]:80;
+    server_name {{ prometheus_nginx_server_name }};
+    return 301 https://$server_name$request_uri;
+}
+
+server {
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
+    server_name {{ prometheus_nginx_server_name }};
+
+    ssl_certificate {{ prometheus_nginx_ssl_certificate }};
+    ssl_certificate_key {{ prometheus_nginx_ssl_certificate_key }};
+
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers HIGH:!aNULL:!MD5;
+    ssl_prefer_server_ciphers on;
+
+    access_log /var/log/nginx/prometheus_access.log;
+    error_log /var/log/nginx/prometheus_error.log;
+
+    location / {
+        proxy_pass http://{{ prometheus_web_listen_address }};
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
@@ -0,0 +1,2 @@
+# Managed by Ansible - DO NOT EDIT MANUALLY
+{{ prometheus_args_var }}="--web.listen-address={{ prometheus_web_listen_address }}"
@@ -0,0 +1,60 @@
+# Prometheus configuration file
+# Managed by Ansible - DO NOT EDIT MANUALLY
+
+global:
+  scrape_interval: {{ prometheus_scrape_interval }}
+  evaluation_interval: {{ prometheus_evaluation_interval }}
+{% if prometheus_web_external_url %}
+  external_labels:
+    monitor: '{{ prometheus_web_external_url }}'
+{% endif %}
+
+{% if prometheus_alertmanager_configs | length > 0 %}
+alerting:
+  alertmanagers:
+{% for alertmanager in prometheus_alertmanager_configs %}
+    - {{ alertmanager | to_nice_yaml(indent=2) | indent(6) }}
+{% endfor %}
+{% endif %}
+
+{% if prometheus_rule_files | length > 0 %}
+rule_files:
+{% for rule_file in prometheus_rule_files %}
+  - {{ rule_file }}
+{% endfor %}
+{% endif %}
+
+scrape_configs:
+{% for scrape_config in prometheus_scrape_configs %}
+  - job_name: '{{ scrape_config.job_name }}'
+{% if scrape_config.scrape_interval is defined %}
+    scrape_interval: {{ scrape_config.scrape_interval }}
+{% endif %}
+{% if scrape_config.scrape_timeout is defined %}
+    scrape_timeout: {{ scrape_config.scrape_timeout }}
+{% endif %}
+{% if scrape_config.metrics_path is defined %}
+    metrics_path: {{ scrape_config.metrics_path }}
+{% endif %}
+{% if scrape_config.static_configs is defined %}
+    static_configs:
+{% for static_config in scrape_config.static_configs %}
+      - targets:
+{% for target in static_config.targets %}
+          - {{ target }}
+{% endfor %}
+{% if static_config.labels is defined %}
+        labels:
+{% for label_key, label_value in static_config.labels.items() %}
+          {{ label_key }}: {{ label_value }}
+{% endfor %}
+{% endif %}
+{% endfor %}
+{% endif %}
+{% if scrape_config.relabel_configs is defined %}
+    relabel_configs:
+{% for relabel_config in scrape_config.relabel_configs %}
+      - {{ relabel_config | to_nice_yaml(indent=2) | indent(8) }}
+{% endfor %}
+{% endif %}
+{% endfor %}
@@ -0,0 +1,9 @@
+---
+prometheus_package: prometheus
+prometheus_user: prometheus
+prometheus_group: prometheus
+prometheus_service: prometheus
+prometheus_config_dir: /etc/prometheus
+prometheus_data_dir: /var/lib/prometheus
+prometheus_args_file: /etc/conf.d/prometheus
+prometheus_args_var: PROMETHEUS_ARGS
@@ -0,0 +1,9 @@
+---
+prometheus_package: prometheus
+prometheus_user: prometheus
+prometheus_group: prometheus
+prometheus_service: prometheus
+prometheus_config_dir: /etc/prometheus
+prometheus_data_dir: /var/lib/prometheus
+prometheus_args_file: /etc/default/prometheus
+prometheus_args_var: ARGS