Files

T

Clément Désiles f6c4d36bbe feat(monitoring): add backup and systemd metrics, alerts, and dashboards

- backup role emits last-success/run metrics into node_exporter's textfile collector
- node_exporter enables systemd and textfile collectors
- prometheus deploys BackupStale/BackupTimerSilent/SystemdUnitFailed alert rules
- grafana gains Backups - Restic and Systemd dashboards
- fix prometheus.yml params rendering (quote values so {job=...} stays a string)

2026-09-09 12:07:50 +02:00

2.5 KiB

Raw Blame History

Prometheus Role

Installs and configures Prometheus monitoring system as a native system service.

Supported Distributions

Arch Linux
Debian/Ubuntu

Features

Native system installation (no containers)
Configurable scrape targets and intervals
Optional Nginx reverse proxy with SSL
Retention policy configuration
Alert manager integration support
Rule files support

Configuration

See defaults/main.yml for all available variables.

Basic Configuration

prometheus_scrape_interval: 15s
prometheus_retention_time: 15d
prometheus_web_listen_address: "127.0.0.1:9090"

Scrape Targets

prometheus_scrape_configs:
  - job_name: 'prometheus'
    static_configs:
      - targets: ['localhost:9090']
  - job_name: 'node_exporter'
    static_configs:
      - targets: ['localhost:9100']

Nginx Reverse Proxy

prometheus_nginx_enabled: true
prometheus_nginx_server_name: prometheus.example.com
prometheus_nginx_ssl_certificate: /path/to/cert.pem
prometheus_nginx_ssl_certificate_key: /path/to/key.pem

Alert Rules

The role deploys two rule files into /etc/prometheus/rules/ (loaded via the prometheus_rule_files glob):

backup-alerts.yml — BackupStale (no successful backup in 14 days) and BackupTimerSilent (a backup@*.timer that stopped firing). Metrics come from the backup role via node_exporter's textfile collector.
systemd-alerts.yml — SystemdUnitFailed, fired when any unit is in the failed state.

There is no Alertmanager in this setup: rules evaluate into the ALERTS series (visible in Grafana) but do not page. Push notifications are handled per-service via ntfy (see each role's own notify config).

Usage

- hosts: monitoring
  roles:
    - prometheus

With custom configuration:

- hosts: monitoring
  vars:
    prometheus_retention_time: 30d
    prometheus_scrape_configs:
      - job_name: 'prometheus'
        static_configs:
          - targets: ['localhost:9090']
      - job_name: 'node_exporter'
        static_configs:
          - targets: ['localhost:9100']
  roles:
    - prometheus

Architecture

Installation: Native package from distribution repositories
Service: System systemd service
Configuration: /etc/prometheus/prometheus.yml
Data: /var/lib/prometheus
Listen: 127.0.0.1:9090 (localhost only by default)

Security

Binds to localhost by default
Optional SSL-enabled reverse proxy via Nginx
Data directory restricted to prometheus user (mode 0750)

2.5 KiB Raw Blame History