Clément Désiles
8756eb1183
- smartctl_exporter (disks), fail2ban exporter, wireguard exporter - grafana dashboards for each exporter - prometheus: firewall source rules, honor_labels/params scrape config - node_exporter: zfs collector - wireguard: nftables dep, resolvconf wrapper, reload fix - remove superseded monitoring role
84 lines
2.7 KiB
YAML
84 lines
2.7 KiB
YAML
---
|
|
# Prometheus fail2ban exporter (optional, gated by fail2ban_exporter_enabled).
|
|
# Downloads the checksum-verified hectorjsmith/fail2ban-prometheus-exporter
|
|
# static binary and runs it as a hardened root systemd service (required to
|
|
# read the root-owned fail2ban socket).
|
|
|
|
- name: Map CPU architecture to release asset
|
|
ansible.builtin.set_fact:
|
|
fail2ban_exporter_arch: >-
|
|
{{ {
|
|
'x86_64': 'amd64',
|
|
'aarch64': 'arm64',
|
|
'armv7l': 'armv7',
|
|
'armv6l': 'armv6',
|
|
'i386': '386',
|
|
'i686': '386'
|
|
}[ansible_architecture] }}
|
|
|
|
- name: Set release filenames
|
|
ansible.builtin.set_fact:
|
|
fail2ban_exporter_archive: "fail2ban_exporter_{{ fail2ban_exporter_version }}_linux_{{ fail2ban_exporter_arch }}.tar.gz"
|
|
fail2ban_exporter_checksums: "fail2ban_exporter_{{ fail2ban_exporter_version }}_checksums.txt"
|
|
fail2ban_exporter_release_base: "https://gitlab.com/hectorjsmith/fail2ban-prometheus-exporter/-/releases/v{{ fail2ban_exporter_version }}/downloads"
|
|
|
|
- name: Download fail2ban_exporter release
|
|
ansible.builtin.get_url:
|
|
url: "{{ fail2ban_exporter_release_base }}/{{ fail2ban_exporter_archive }}"
|
|
dest: "/tmp/{{ fail2ban_exporter_archive }}"
|
|
mode: "0644"
|
|
|
|
- name: Download release checksums
|
|
ansible.builtin.get_url:
|
|
url: "{{ fail2ban_exporter_release_base }}/{{ fail2ban_exporter_checksums }}"
|
|
dest: "/tmp/{{ fail2ban_exporter_checksums }}"
|
|
mode: "0644"
|
|
|
|
- name: Verify release archive checksum
|
|
ansible.builtin.command: "sha256sum -c --ignore-missing {{ fail2ban_exporter_checksums }}"
|
|
args:
|
|
chdir: /tmp
|
|
changed_when: false
|
|
|
|
- name: Extract fail2ban_exporter binary
|
|
ansible.builtin.unarchive:
|
|
src: "/tmp/{{ fail2ban_exporter_archive }}"
|
|
dest: /tmp
|
|
remote_src: true
|
|
extra_opts:
|
|
- fail2ban_exporter
|
|
|
|
- name: Install fail2ban_exporter binary
|
|
ansible.builtin.copy:
|
|
src: /tmp/fail2ban_exporter
|
|
dest: "{{ fail2ban_exporter_binary_dir }}/fail2ban_exporter"
|
|
remote_src: true
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
|
|
- name: Clean up temporary files
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
state: absent
|
|
loop:
|
|
- "/tmp/{{ fail2ban_exporter_archive }}"
|
|
- "/tmp/{{ fail2ban_exporter_checksums }}"
|
|
- /tmp/fail2ban_exporter
|
|
|
|
- name: Deploy fail2ban_exporter systemd unit
|
|
ansible.builtin.template:
|
|
src: fail2ban_exporter.service.j2
|
|
dest: /etc/systemd/system/fail2ban_exporter.service
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: Restart fail2ban_exporter
|
|
|
|
- name: Enable and start fail2ban_exporter
|
|
ansible.builtin.systemd:
|
|
name: fail2ban_exporter
|
|
enabled: true
|
|
state: started
|
|
daemon_reload: true
|