Clément Désiles
aa78e238aa
- nginx: nginx-prometheus-exporter gated by nginx_exporter_enabled, deploys loopback-only stub_status (8090), exporter on 9113 - postgres: postgres_exporter gated by postgres_exporter_enabled, creates postgres_exporter role with pg_monitor, exporter on 9187 - valkey: redis_exporter gated by valkey_exporter_enabled, adds read-only ACL user to users.acl, exporter on 9121 Each exporter follows the nut pattern (tasks/exporter.yml included from main.yml, OS vars, 0600 secret env files, password asserts).
59 lines
2.0 KiB
YAML
59 lines
2.0 KiB
YAML
---
|
|
# Valkey bind address(es)
|
|
# Example: "127.0.0.1 10.89.0.1"
|
|
valkey_bind: 127.0.0.1
|
|
|
|
# Valkey port
|
|
valkey_port: 6379
|
|
|
|
# Valkey authentication (REQUIRED - must be set explicitly)
|
|
# Set via inventory, host_vars, or ansible-vault
|
|
# valkey_admin_password: "" # Intentionally undefined - role will fail if not set
|
|
|
|
# Valkey max memory (0 = unlimited)
|
|
valkey_maxmemory: 256mb
|
|
|
|
# Valkey max memory policy
|
|
# noeviction: Return errors when memory limit is reached (recommended for job queues like BullMQ)
|
|
# allkeys-lru: Evict least recently used keys (good for pure caching)
|
|
valkey_maxmemory_policy: noeviction
|
|
|
|
# Valkey data directory (overridden by OS-specific vars)
|
|
valkey_dir: /var/lib/valkey
|
|
|
|
# Valkey ACL file location
|
|
valkey_acl_file: /etc/valkey/users.acl
|
|
|
|
# Valkey ACL users
|
|
# Services can register their users here
|
|
# Each user should have: username, password, keypattern, commands
|
|
valkey_acl_users: []
|
|
# Example:
|
|
# valkey_acl_users:
|
|
# - username: immich
|
|
# password: "secretpassword"
|
|
# keypattern: "*" # Keys this user can access
|
|
# commands: "+@all -@dangerous" # Allowed commands
|
|
|
|
# Prometheus exporter (optional, via redis_exporter). Creates a dedicated
|
|
# read-only ACL user for monitoring.
|
|
valkey_exporter_enabled: false
|
|
valkey_exporter_listen_address: "127.0.0.1:9121"
|
|
valkey_exporter_redis_addr: "redis://127.0.0.1:6379"
|
|
valkey_exporter_user: valkey_exporter
|
|
# valkey_exporter_password: "" # Intentionally undefined - required when enabled
|
|
# Read-only command set recommended by redis_exporter for monitoring.
|
|
valkey_exporter_commands: >-
|
|
-@all +@connection +memory -readonly +strlen +config|get +xinfo +pfcount
|
|
-quit +zcard +type +xlen -readwrite -command +client -wait +scard +llen
|
|
+hlen +arcount +get +eval +slowlog +cluster|info +cluster|slots +cluster|nodes
|
|
-hello -echo +info +latency +scan -reset -auth -asking
|
|
|
|
# Valkey log level (debug, verbose, notice, warning)
|
|
valkey_loglevel: notice
|
|
|
|
# Firewall configuration
|
|
valkey_firewall_allowed_sources:
|
|
- 127.0.0.0/8 # Localhost
|
|
- "{{ podman_subnet | default('10.88.0.0/16') }}" # Podman bridge network
|