mirror/infrastructure
1
1
Fork 0
mirror of https://gitlab.archlinux.org/archlinux/infrastructure.git synced 2024-09-20 01:21:36 +02:00
Code Issues
54ca51a217
infrastructure/playbooks/monitoring.archlinux.org.yml

21 lines
603 B
YAML
Raw Normal View History

Capitalize the first letter of all task names ansible-lint 6.5.0 complains about: name: All names should start with an uppercase letter. (name[casing])
2022-08-23 04:49:23 +02:00
- name: Setup prometheus server
Add prometheus role for the prometheus/alertmanager server Introduce a new monitoring server with prometheus and alertmanager for monitoring all our boxes.
2020-07-12 22:35:22 +02:00
hosts: monitoring.archlinux.org
remote_user: root
roles:
- { role: firewalld }
WireGuard all hosts This is meant as a internal authenticated and encrypted network which we can use for internal services, we don't want to expose to the internet or when encryption is desired but not easily implementable.
2021-07-06 19:47:22 +02:00
- { role: wireguard }
Add prometheus role for the prometheus/alertmanager server Introduce a new monitoring server with prometheus and alertmanager for monitoring all our boxes.
2020-07-12 22:35:22 +02:00
- { role: common }
- { role: sshd }
- { role: root_ssh }
- { role: hardening }
- { role: borg_client, tags: ["borg"], when: "'borg_clients' in group_names" }
- { role: prometheus }
Split alertmanager into its own role
2021-05-01 02:44:58 +02:00
- { role: alertmanager }
Introduce prometheus exporters role for collection Add a new role called prometheus_exporters which should be run on every machine we have and starts different collectors depending on what group the machine is in. Currently supported our the gitlab runner exporter, rebuilder textcollector, mysqld-exporter, borg textcollector and an node/arch exporter. The arch exporter monitors the security status and pacman out of date packages gauge.
2020-08-31 18:18:53 +02:00
- { role: prometheus_exporters }
Implement centralized logging Fix #263
2021-02-26 22:14:05 +01:00
- { role: loki }
- { role: promtail }
Add prometheus role for the prometheus/alertmanager server Introduce a new monitoring server with prometheus and alertmanager for monitoring all our boxes.
2020-07-12 22:35:22 +02:00
- { role: certbot }
- { role: nginx }
Setup Oauth for Grafana Configure Grafana to use Keycloak OpenID Connect for authentication. For now only DevOps is configured as admin and Arch Staff as general Viewer roles.
2020-07-28 21:46:39 +02:00
- { role: grafana, grafana_domain: 'monitoring.archlinux.org' }
By default enable the sshd jail for fail2ban For all hosts we want to have a working fail2ban for sshd brute force attempts through a group_vars/all. For some hosts an override is required to enable postfix or dovecot jails.
2020-10-16 14:06:23 +02:00
- { role: fail2ban }
Copy Permalink