-
Notifications
You must be signed in to change notification settings - Fork 3
/
shields-io-metrics.yml
330 lines (330 loc) · 11 KB
/
shields-io-metrics.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
---
- name: Setup Node exporter
hosts: metrics
roles:
- prometheus.prometheus.node_exporter
vars:
node_exporter_web_listen_address: 127.0.0.1:9100
tags:
- prometheus
- node-exporter
- name: Setup Blackbox exporter
hosts: metrics
roles:
- prometheus.prometheus.blackbox_exporter
vars:
blackbox_exporter_web_listen_address: 127.0.0.1:9115
blackbox_exporter_configuration_modules:
http_2xx:
prober: http
timeout: 10s
http:
preferred_ip_protocol: "ip4"
tags:
- prometheus
- blackbox-exporter
- name: Setup Prometheus (using prometheus.prometheus collection)
hosts: metrics
become: true
tags:
- prometheus
roles:
- prometheus.prometheus.prometheus
vars:
- prometheus_version: "{{ metrics_prometheus_version }}"
# override extra labels added by cloudalchemy.prometheus role
prometheus_external_labels: {}
prometheus_web_external_url: "http://{{ metrics_domain }}/prometheus/"
prometheus_web_listen_address: 127.0.0.1:9090
prometheus_config_flags_extra:
web.route-prefix: /
prometheus_global:
scrape_interval: 15s
prometheus_scrape_configs:
- job_name: "telegraf"
honor_labels: true
static_configs:
- targets: ["localhost:9273"]
metric_relabel_configs:
- source_labels: [service]
target_label: exported_service
- action: labeldrop
regex: service
- job_name: "prometheus"
static_configs:
- targets: ["localhost:9090"]
- job_name: "node"
static_configs:
- targets: ["localhost:9100"]
scrape_interval: 60s
- job_name: "blackbox"
metrics_path: /probe
params:
module: [http_2xx]
static_configs:
- targets:
- https://raster.shields.io/badge/foo-bar-blue.png
- https://shields.io/
- https://img.shields.io/badge/foo-bar-blue
- https://img.shields.io/npm/v/gh-badges
- https://img.shields.io/travis/rust-lang/rust
- https://img.shields.io/npm/dt/gh-badges
- https://img.shields.io/github/stars/badges/shields
relabel_configs:
- source_labels: [__address__]
target_label: __param_target
- source_labels: [__param_target]
target_label: instance
- target_label: __address__
replacement: 127.0.0.1:9115
- name: Setup grafana
hosts: metrics
roles:
- cloudalchemy.grafana
vars:
grafana_version: '{{ metrics_grafana_version }}'
grafana_security:
admin_user: admin
admin_password: "{{mertics_grafana_admin_password}}"
grafana_url: "https://{{ metrics_domain }}"
grafana_datasources:
- name: Prometheus-default
type: prometheus
access: proxy
url: 'http://localhost:9090/'
basicAuth: false
isDefault: true
orgId: 1
editable: true
grafana_dashboards:
- dashboard_id: 1860
revision_id: 37
datasource: Prometheus-default
- dashboard_id: 7587
revision_id: 3
datasource: Prometheus-default
grafana_dashboards_dir: grafana/dashboards
grafana_users:
auto_assign_org_id: 1
auto_assign_org_role: Editor
grafana_auth:
github:
enabled: true
allow_sign_up: true
client_id: "{{ metrics_grafana_github_client_id }}"
client_secret: "{{ metrics_grafana_github_client_secret }}"
scopes: 'user:email,read:org'
auth_url: https://github.com/login/oauth/authorize
token_url: https://github.com/login/oauth/access_token
api_url: https://api.github.com/user
# 3047484 is an id of the https://github.com/orgs/badges/teams/shields-core team
# How to get an id?
# curl https://api.github.com/orgs/badges/teams -H "Authorization: token XXX" -s | jq '.[] | select(.name=="shields-core").id'
team_ids: 3047484
anonymous:
enabled: true
org_name: Main Org.
org_role: Viewer
tasks:
- name: Install worldPing plugin
become: yes
grafana_plugin:
name: raintank-worldping-app
version: latest
notify:
- restart grafana
- name: Install Pie Chart plugin
become: yes
grafana_plugin:
name: grafana-piechart-panel
version: latest
notify:
- restart grafana
handlers:
- name: restart grafana
become: yes
service:
name: grafana-server
state: restarted
tags:
- grafana
- name: Setup nginx
hosts: metrics
become: true
roles:
- role: nginxinc.nginx
tags: [nginx-role]
vars:
# 1.18.0 is not available in nginx repository: https://nginx.org/en/linux_packages.html#Ubuntu
# the next available version after 1.17.x is 1.19.x
nginx_version: "={{ metrics_nginx_version }}-1~focal"
tags:
- nginx
- nginx_install
tasks:
- name: Install package required by htpasswd
apt:
name: python3-passlib
tags:
- nginx-htpasswd
- name: Create a password file for prometheus
htpasswd:
path: /etc/nginx/.htpasswd.{{ metrics_domain }}-prometheus
name: prometheus
password: '{{ mertics_prometheus_password }}'
owner: nginx
group: root
mode: 0640
tags:
- nginx-htpasswd
- name: Create a password file for telegraf
htpasswd:
path: /etc/nginx/.htpasswd.{{ metrics_domain }}-telegraf
name: '{{ item.name }}'
password: '{{ item.password }}'
owner: nginx
group: root
mode: 0640
with_items:
- { name: 'telegraf', password: '{{ mertics_telegraf_password }}' }
- { name: 'telegraf-staging', password: '{{ mertics_telegraf_staging_password }}' }
- { name: 'telegraf-production', password: '{{ mertics_telegraf_production_password }}' }
tags:
- nginx-htpasswd
- name: Configure nginx
hosts: metrics
become: true
roles:
- role: nginxinc.nginx_config
tags: [nginx-role]
vars:
nginx_config_http_template_enable: true
nginx_config_http_template:
default:
template_file: http/default.conf.j2
conf_file_name: default.conf
conf_file_location: /etc/nginx/conf.d/
servers:
server1:
listen:
listen_localhost:
port: "{{ metrics_port }}"
server_name: "{{ mertics_domains }}"
reverse_proxy:
locations:
grafana:
location: /
proxy_connect_timeout: 300
proxy_pass: http://localhost:3000/
proxy_read_timeout: 300
proxy_set_header:
header_host:
name: Host
value: $host
header_x_real_ip:
name: X-Real-IP
value: $remote_addr
header_x_forwarded_for:
name: X-Forwarded-For
value: $proxy_add_x_forwarded_for
header_x_forwarded_proto:
name: X-Forwarded-Proto
value: $scheme
prometheus:
location: /prometheus/
proxy_connect_timeout: 300
proxy_pass: http://localhost:9090/
proxy_read_timeout: 300
proxy_set_header:
header_host:
name: Host
value: $host
header_x_real_ip:
name: X-Real-IP
value: $remote_addr
header_x_forwarded_for:
name: X-Forwarded-For
value: $proxy_add_x_forwarded_for
header_x_forwarded_proto:
name: X-Forwarded-Proto
value: $scheme
auth_basic: "Restricted Content"
# this role creates 'nginx' user and installs nginx
# this htpasswd file will be created in the next task, because it have to be owned by 'nginx' user
auth_basic_user_file: /etc/nginx/.htpasswd.{{ metrics_domain }}-prometheus
telegraf:
location: /telegraf
proxy_connect_timeout: 5
proxy_pass: http://localhost:8082
proxy_read_timeout: 5
proxy_set_header:
header_host:
name: Host
value: $host
header_x_real_ip:
name: X-Real-IP
value: $remote_addr
header_x_forwarded_for:
name: X-Forwarded-For
value: $proxy_add_x_forwarded_for
header_x_forwarded_proto:
name: X-Forwarded-Proto
value: $scheme
auth_basic: "Restricted Content"
# this role creates 'nginx' user and installs nginx
# this htpasswd file will be created in the next task, because it have to be owned by 'nginx' user
auth_basic_user_file: /etc/nginx/.htpasswd.{{ metrics_domain }}-telegraf
tags:
- nginx
- name: Install Let's Encrypt certificate and enable HTTPS in nginx
hosts: metrics
tasks:
- name: Install python3-certbot-nginx package
become: yes
apt:
name: python3-certbot-nginx
tags: certbot-package
- name: Obtain a certificate
become: yes
shell: certbot certonly -d {{ metrics_domain }} --agree-tos -m {{ metrics_certbot_email }} --nginx --keep-until-expiring
tags: certbot-obtain
- name: Add the certificate to nginx configuration
become: yes
shell: certbot install --nginx --cert-name {{ metrics_domain }} --redirect -n
tags: certbot-nginx
tags: certbot
- name: Setup Telegraf
hosts: metrics
roles:
- dj-wasabi.telegraf
vars:
# apt repository contains only the latest version:
# https://github.com/dj-wasabi/ansible-telegraf/issues/95#issuecomment-480397359, https://github.com/influxdata/telegraf/issues/5685
telegraf_agent_version: '{{ metrics_telegraf_version }}'
telegraf_agent_package_method: repo
telegraf_agent_package_state: present
telegraf_agent_omit_hostname: true
telegraf_plugins_default: []
telegraf_plugins_extra:
http_listener_v2:
config:
- service_address = ":8082"
- data_format = "influx"
- max_body_size = "1MB"
telegraf_agent_output:
- type: prometheus_client
config:
- listen = ":9273"
- metric_version = 2
- expiration_interval = "20s"
- collectors_exclude = ["gocollector", "process"]
# seems that 'export_timestamp = true' does not work
# - export_timestamp = true
- type: file
config:
- files = ["/tmp/metrics.out"]
- data_format = "influx"
- rotation_max_size = "10MB"
- rotation_max_archives = 10
tags:
- telegraf