Clément Désiles
f6c4d36bbe
- backup role emits last-success/run metrics into node_exporter's textfile collector
- node_exporter enables systemd and textfile collectors
- prometheus deploys BackupStale/BackupTimerSilent/SystemdUnitFailed alert rules
- grafana gains Backups - Restic and Systemd dashboards
- fix prometheus.yml params rendering (quote values so {job=...} stays a string)
105 lines
2.5 KiB
Markdown
105 lines
2.5 KiB
Markdown
# Prometheus Role
|
|
|
|
Installs and configures Prometheus monitoring system as a native system service.
|
|
|
|
## Supported Distributions
|
|
|
|
- Arch Linux
|
|
- Debian/Ubuntu
|
|
|
|
## Features
|
|
|
|
- Native system installation (no containers)
|
|
- Configurable scrape targets and intervals
|
|
- Optional Nginx reverse proxy with SSL
|
|
- Retention policy configuration
|
|
- Alert manager integration support
|
|
- Rule files support
|
|
|
|
## Configuration
|
|
|
|
See [defaults/main.yml](defaults/main.yml) for all available variables.
|
|
|
|
### Basic Configuration
|
|
|
|
```yaml
|
|
prometheus_scrape_interval: 15s
|
|
prometheus_retention_time: 15d
|
|
prometheus_web_listen_address: "127.0.0.1:9090"
|
|
```
|
|
|
|
### Scrape Targets
|
|
|
|
```yaml
|
|
prometheus_scrape_configs:
|
|
- job_name: 'prometheus'
|
|
static_configs:
|
|
- targets: ['localhost:9090']
|
|
- job_name: 'node_exporter'
|
|
static_configs:
|
|
- targets: ['localhost:9100']
|
|
```
|
|
|
|
### Nginx Reverse Proxy
|
|
|
|
```yaml
|
|
prometheus_nginx_enabled: true
|
|
prometheus_nginx_server_name: prometheus.example.com
|
|
prometheus_nginx_ssl_certificate: /path/to/cert.pem
|
|
prometheus_nginx_ssl_certificate_key: /path/to/key.pem
|
|
```
|
|
|
|
## Alert Rules
|
|
|
|
The role deploys two rule files into `/etc/prometheus/rules/` (loaded via the
|
|
`prometheus_rule_files` glob):
|
|
|
|
- `backup-alerts.yml` — `BackupStale` (no successful backup in 14 days) and
|
|
`BackupTimerSilent` (a `backup@*.timer` that stopped firing). Metrics come
|
|
from the backup role via node_exporter's textfile collector.
|
|
- `systemd-alerts.yml` — `SystemdUnitFailed`, fired when any unit is in the
|
|
failed state.
|
|
|
|
There is no Alertmanager in this setup: rules evaluate into the `ALERTS`
|
|
series (visible in Grafana) but do not page. Push notifications are handled
|
|
per-service via ntfy (see each role's own notify config).
|
|
|
|
## Usage
|
|
|
|
```yaml
|
|
- hosts: monitoring
|
|
roles:
|
|
- prometheus
|
|
```
|
|
|
|
With custom configuration:
|
|
|
|
```yaml
|
|
- hosts: monitoring
|
|
vars:
|
|
prometheus_retention_time: 30d
|
|
prometheus_scrape_configs:
|
|
- job_name: 'prometheus'
|
|
static_configs:
|
|
- targets: ['localhost:9090']
|
|
- job_name: 'node_exporter'
|
|
static_configs:
|
|
- targets: ['localhost:9100']
|
|
roles:
|
|
- prometheus
|
|
```
|
|
|
|
## Architecture
|
|
|
|
- **Installation**: Native package from distribution repositories
|
|
- **Service**: System systemd service
|
|
- **Configuration**: `/etc/prometheus/prometheus.yml`
|
|
- **Data**: `/var/lib/prometheus`
|
|
- **Listen**: `127.0.0.1:9090` (localhost only by default)
|
|
|
|
## Security
|
|
|
|
- Binds to localhost by default
|
|
- Optional SSL-enabled reverse proxy via Nginx
|
|
- Data directory restricted to prometheus user (mode 0750)
|