roles: prometheus: scrape-blackbox: Monitor webmail.labolyon.fr

* Use scrape_config_files correctly
 * Do not separate prometheus and blackbox exporter nodes
 * Add a http_2xx_selfsigned module for self-signed certs
 * Monitor missing services
 * Switch from CRLF to LF in prometheus.config.j2

ansible/inventory

@@ -2,24 +2,26 @@ all:
   children:
     debian:
       hosts:
-        reverse-proxy.labolyon.dn42:
-        git.labolyon.dn42:
-        labolyon-fr.labolyon.dn42:
-        matrix.labolyon.dn42:
-        wiki.labolyon.dn42:
-        blogs.labolyon.dn42:
-        mail.labolyon.dn42:
-        radius.labolyon.dn42:
         ansible.labolyon.dn42:
+        blogs.labolyon.dn42:
         dn42-router.labolyon.dn42:
-        lolix-rs1.labolyon.dn42:
-        lolix-ixpman.labolyon.dn42:
         dns.labolyon.dn42:
-        mosquitto.labolyon.dn42:
+        git.labolyon.dn42:
-        monitoring.labolyon.dn42:
+        i2p.labolyon.dn42:
+        labolyon-fr.labolyon.dn42:
+        lolix-ixpman.labolyon.dn42:
+        lolix-rs1.labolyon.dn42:
         lolmox.labolyon.dn42:
         lolmox2.labolyon.dn42:
-        i2p.labolyon.dn42:
+        mail.labolyon.dn42:
-#    blackbox:
+        matrix.labolyon.dn42:
-#      hosts:
+        monitoring.labolyon.dn42:
-#        monitoring:
+        mosquitto.labolyon.dn42:
+        octoprint.labolyon.dn42:
+        radius.labolyon.dn42:
+        reverse-proxy.labolyon.dn42:
+        wiki.labolyon.dn42:
+        zigbee2mqtt.labolyon.dn42:
+    monitoring:
+      hosts:
+        monitoring.labolyon.dn42:

ansible/playbooks/monitoring.yml

@@ -12,21 +12,11 @@
   become: yes
   roles:
     - prometheus
+    - blackbox-exporter
   vars:
-    blackbox: false
     scrape_files:
       - /etc/prometheus/scrape-main.yml
-
+      - /etc/prometheus/scrape-blackbox.yml
-#- name: Install and configure Prometheus node - Blackbox nodes
-#  hosts: blackbox
-#  become: yes
-#  roles:
-#    - prometheus
-#    - blackbox-exporter
-#  vars:
-#    blackbox: true
-#    scrape_files:
-#      - /etc/prometheus/scrape-blackbox.yml
 
 - name: Install and configure nodes
   hosts: all

ansible/roles/blackbox-exporter/templates/blackbox.config.j2

@@ -8,6 +8,11 @@ modules:
       preferred_ip_protocol: "ip4"
       ip_protocol_fallback: true
 {% endif %}
+  http_2xx_selfsigned:
+    prober: http
+    http:
+      tls_config:
+        insecure_skip_verify: true
   http_post_2xx:
     prober: http
 {% if inventory_hostname == 'check.home.arpa' %}

ansible/roles/node-exporter/vars/alpine.yml

@@ -1,6 +0,0 @@
----
-# vars file for node-exporter role
-node_service: node-exporter
-
-node_package:
-  - prometheus-node-exporter

ansible/roles/node-exporter/vars/redhat.yml

@@ -1,6 +0,0 @@
----
-# vars file for node-exporter role
-node_service: prometheus-node-exporter
-
-node_package:
-  - golang-github-prometheus-node-exporter

ansible/roles/node-exporter/vars/suse.yml

@@ -1,6 +0,0 @@
----
-# vars file for node-exporter role
-node_service: prometheus-node_exporter
-
-node_package:
-  - golang-github-prometheus-node_exporter

ansible/roles/prometheus/templates/prometheus.config.j2

@@ -20,52 +20,12 @@ rule_files:
    - "{{ alertmanager_rules }}/hosts.rules.yml"
 
 # A scrape configuration containing exactly one endpoint to scrape:
-
+scrape_config_files:
-#scrape_config_files:
+{% for item in scrape_files %}
-#{% for item in scrape_files %}
+  - "{{ item }}"
-#  - "{{ item }}"
+{% endfor %}
-#{% endfor %}
 
 scrape_configs:
   - job_name: "prometheus"
     static_configs:
       - targets: ["localhost:9090"]
-
-{% if blackbox %}
-  - job_name: "blackbox"
-    metrics_path: /probe
-    params:
-      module: [http_2xx]
-    scrape_interval: 5s
-    static_configs:
-      - targets:
-          - https://labolyon.fr
-          - https://mail.labolyon.fr
-          - https://wiki.labolyon.fr
-          - https://git.labolyon.fr
-    relabel_configs:
-       - source_labels: [__address__]
-         target_label: __param_target
-       - source_labels: [__param_target]
-         target_label: target
-       - target_label: __address__
-         replacement: 127.0.0.1:9115  # The blackbox exporter's real hostname:port.
-{% else %}
-  - job_name: "linux-nodes"
-    static_configs:
-      - targets:
-         - lolmox.labolyon.dn42:9100
-         - lolmox2.labolyon.dn42:9100
-         - blogs.labolyon.dn42:9100
-         - dn42-router.labolyon.dn42:9100
-         - git.labolyon.dn42:9100
-         - labolyon-fr.labolyon.dn42:9100
-         - lolix-rs1.labolyon.dn42:9100
-         - mail.labolyon.dn42:9100
-         - matrix.labolyon.dn42:9100
-         - monitoring.labolyon.dn42:9100
-         - mosquitto.labolyon.dn42:9100
-         - radius.labolyon.dn42:9100
-         - reverse-proxy.labolyon.dn42:9100
-         - wiki.labolyon.dn42:9100
-{% endif %}

ansible/roles/prometheus/templates/scrape-blackbox.yml

@@ -1,4 +1,8 @@
-  - job_name: "blackbox"
+# managed by ansible
+
+scrape_configs:
+
+  - job_name: "blackbox-public-https"
     metrics_path: /probe
     params:
       module: [http_2xx]
@@ -6,13 +10,33 @@
     static_configs:
       - targets:
           - https://labolyon.fr
-          - https://mail.labolyon.fr
+          - https://webmail.labolyon.fr
           - https://wiki.labolyon.fr
           - https://git.labolyon.fr
+          - https://sso.labolyon.fr
+          - https://chat.labolyon.fr
+          - https://grafana.labolyon.fr
     relabel_configs:
        - source_labels: [__address__]
          target_label: __param_target
        - source_labels: [__param_target]
-         target_label: target
+         target_label: instance
+       - target_label: __address__
+         replacement: 127.0.0.1:9115  # The blackbox exporter's real hostname:port.
+
+  - job_name: "blackbox-internal-https"
+    metrics_path: /probe
+    params:
+      module: [http_2xx_selfsigned]
+    scrape_interval: 5s
+    static_configs:
+      - targets:
+          - https://octoprint.labolyon.dn42/login/
+          - https://stickers.labolyon.dn42
+    relabel_configs:
+       - source_labels: [__address__]
+         target_label: __param_target
+       - source_labels: [__param_target]
+         target_label: instance
        - target_label: __address__
          replacement: 127.0.0.1:9115  # The blackbox exporter's real hostname:port.

ansible/roles/prometheus/templates/scrape-main.yml

@@ -1,13 +1,17 @@
+scrape_configs:
   - job_name: "linux-nodes"
     static_configs:
       - targets:
+         - ansible.labolyon.dn42:9100
+         - dn42-router.labolyon.dn42:9100
+         - dns.labolyon.dn42:9100
+         - git.labolyon.dn42:9100
+         - i2p.labolyon.dn42:9100
+         - labolyon-fr.labolyon.dn42:9100
+         - lolix-ixpman.labolyon.dn42:9100
+         - lolix-rs1.labolyon.dn42:9100
          - lolmox.labolyon.dn42:9100
          - lolmox2.labolyon.dn42:9100
-         - blogs.labolyon.dn42:9100
-         - dn42-router.labolyon.dn42:9100
-         - git.labolyon.dn42:9100
-         - labolyon-fr.labolyon.dn42:9100
-         - lolix-rs1.labolyon.dn42:9100
          - mail.labolyon.dn42:9100
          - matrix.labolyon.dn42:9100
          - monitoring.labolyon.dn42:9100
@@ -15,3 +19,4 @@
          - radius.labolyon.dn42:9100
          - reverse-proxy.labolyon.dn42:9100
          - wiki.labolyon.dn42:9100
+         - zigbee2mqtt.labolyon.dn42:9100

ansible/roles/tools/vars/debian.yml

@@ -2,7 +2,6 @@
 # vars file for tools role
 common_packages:
   - htop
-  - neofetch
   - curl
   - bash
   - figlet
@@ -10,6 +9,5 @@ common_packages:
   - rsync
   - needrestart
   - lynis
-  - apt-listbugs
   - dnsutils
   - libpam-radius-auth

ansible/roles/users/tasks/main.yml

@@ -1,5 +1,4 @@
 ---
-
 - name: Load variables
   include_vars: "{{ ansible_os_family|lower }}.yml"
 
@@ -50,6 +49,16 @@
     group: root
     mode: 0640
 
+- name: Linux | Install sudoers file for sudo group
+  ansible.builtin.template:
+    src: sudo_sudoers
+    dest: "/etc/sudoers.d/sudo"
+    backup: yes
+    owner: root
+    group: root
+    mode: 0640
+    validate: /usr/sbin/visudo -cf %s
+
 - name: Linux | Define MOTD file
   ansible.builtin.shell:
     cmd: figlet -t {{ inventory_hostname_short | quote }} > /etc/motd

ansible/roles/users/templates/sudo_sudoers

@@ -0,0 +1,2 @@
+# Enable passwordless sudo for sudo members
+%sudo ALL=(ALL) NOPASSWD: ALL

ansible/roles/users/vars/debian.yml

@@ -1,5 +1,5 @@
 ---
-
+## Define custom UIDs to avoid conflicts
 user_details:
      - { name: vinishor, uid: 2000 }
      - { name: mirsal, uid: 2001 }