ansible-playbooks/roles/prometheus

Prometheus Role

Installs and configures Prometheus monitoring system as a native system service.

Supported Distributions

• Arch Linux
• Debian/Ubuntu

Features

• Native system installation (no containers)
• Configurable scrape targets and intervals
• Optional Nginx reverse proxy with SSL
• Retention policy configuration
• Alert manager integration support
• Rule files support

Configuration

See defaults/main.yml for all available variables.

Basic Configuration

prometheus_scrape_interval: 15s
prometheus_retention_time: 15d
prometheus_web_listen_address: "127.0.0.1:9090"

Scrape Targets

prometheus_scrape_configs:
  - job_name: 'prometheus'
    static_configs:
      - targets: ['localhost:9090']
  - job_name: 'node_exporter'
    static_configs:
      - targets: ['localhost:9100']

Nginx Reverse Proxy

prometheus_nginx_enabled: true
prometheus_nginx_server_name: prometheus.example.com
prometheus_nginx_ssl_certificate: /path/to/cert.pem
prometheus_nginx_ssl_certificate_key: /path/to/key.pem

Alert Rules

The role deploys two rule files into /etc/prometheus/rules/ (loaded via the prometheus_rule_files glob):

• backup-alerts.yml — BackupStale (no successful backup in 14 days) and BackupTimerSilent (a backup@*.timer that stopped firing). Metrics come from the backup role via node_exporter's textfile collector.
• systemd-alerts.yml — SystemdUnitFailed, fired when any unit is in the failed state.

There is no Alertmanager in this setup: rules evaluate into the ALERTS series (visible in Grafana) but do not page. Push notifications are handled per-service via ntfy (see each role's own notify config).

Usage

- hosts: monitoring
  roles:
    - prometheus

With custom configuration:

- hosts: monitoring
  vars:
    prometheus_retention_time: 30d
    prometheus_scrape_configs:
      - job_name: 'prometheus'
        static_configs:
          - targets: ['localhost:9090']
      - job_name: 'node_exporter'
        static_configs:
          - targets: ['localhost:9100']
  roles:
    - prometheus

Architecture

• Installation: Native package from distribution repositories
• Service: System systemd service
• Configuration: /etc/prometheus/prometheus.yml
• Data: /var/lib/prometheus
• Listen: 127.0.0.1:9090 (localhost only by default)

Security

• Binds to localhost by default
• Optional SSL-enabled reverse proxy via Nginx
• Data directory restricted to prometheus user (mode 0750)