Skip to content

Dev/add monitoring

Aurélien Bertron requested to merge dev/add-monitoring into master

Description

Add monitoring tools:

  • node-exporter on both backup and docker hosts as systemd units
  • Prometheus and Grafana as containers

Manual steps

Some manual steps are required.

New secrets

New secrets must be generated.

Here is the related documentation from the README file

ansible/host_vars/_backup_node.yml

Name Type Description
secret_backup_node_monitor_pwd String Monitoring user password
secret_backup_node_monitor_pwd_bcrypt String Previous password encrypted with bcrypt

ansible/host_vars/_docker_node.yml

Name Type Description
secret_docker_node_monitor_pwd String Monitoring user password
secret_docker_node_monitor_pwd_bcrypt String Previous password encrypted with bcrypt

In order to encrypt the password with bcrypt, you should use htpasswd command:

htpasswd -BbnC 10 "" <clear-text password> | tr -d ":"

ansible/secrets/_ldap-users.yml

Add admin group with your user in it:

secret_ldap_groups:
  - name: admin
    members:
      - user1

Install ansible dependencies

We introduce some ansible roles as dependencies. You must install them with ansible-galaxy:

ansible-galaxy install -r ansible/requirements.yml

Add new sub-domains to your DNS zone

You may add these sub-domains to your zone in order to access services:

  • backup-node redirecting to your backup host
  • docker-node, prometheus and monitor redirecting to your docker host

Create "admin" group in LDAP

We use admin group in ldap to define which user has access to monitoring services. You may add the group and add yourself in it.

Here is the related documentation from the README file

Modifying LDAP entries is not an easy task. The add_ldap_group playbook simplifies the process of adding a group in LDAP.

The playbook will ask for the group name and its members:

$ ansible-playbook -bK ansible/add_ldap_group.yml --ask-vault-pass
BECOME password:
Vault password:
Enter a group name: group1
Enter a comma-separated list of group members: user1,user2
...

Note that the playbook runs on all hosts but you still need to pass it an inventory. You may limit the execution to a particular host.

If you want to execute it on the vagrant host, the full command will be:

ansible-playbook -bKl docker_node ansible/add_ldap_group.yml --ask-vault-pass -i .vagrant/provisioners/ansible/inventory/vagrant_ansible_inventory --extra-vars traefik_domain=local.domain --ssh-extra-args="-o StrictHostKeyChecking=no"

Note: If you are already logged in Authelia, you must log out and in again to refresh the list of groups associated with your session.

Play both docker_nodes and backup_nodes playbooks

Edited by Aurélien Bertron

Merge request reports