Dev/add monitoring
Description
Add monitoring tools:
- node-exporter on both backup and docker hosts as systemd units
- Prometheus and Grafana as containers
Manual steps
Some manual steps are required.
New secrets
New secrets must be generated.
Here is the related documentation from the README file
ansible/host_vars/_backup_node.yml
Name | Type | Description |
---|---|---|
secret_backup_node_monitor_pwd | String | Monitoring user password |
secret_backup_node_monitor_pwd_bcrypt | String | Previous password encrypted with bcrypt |
ansible/host_vars/_docker_node.yml
Name | Type | Description |
---|---|---|
secret_docker_node_monitor_pwd | String | Monitoring user password |
secret_docker_node_monitor_pwd_bcrypt | String | Previous password encrypted with bcrypt |
In order to encrypt the password with bcrypt, you should use htpasswd
command:
htpasswd -BbnC 10 "" <clear-text password> | tr -d ":"
ansible/secrets/_ldap-users.yml
Add admin group with your user in it:
secret_ldap_groups:
- name: admin
members:
- user1
Install ansible dependencies
We introduce some ansible roles as dependencies. You must install them with ansible-galaxy
:
ansible-galaxy install -r ansible/requirements.yml
Add new sub-domains to your DNS zone
You may add these sub-domains to your zone in order to access services:
-
backup-node
redirecting to your backup host -
docker-node
,prometheus
andmonitor
redirecting to your docker host
Create "admin" group in LDAP
We use admin
group in ldap to define which user has access to monitoring services. You may add the group and add yourself in it.
Here is the related documentation from the README file
Modifying LDAP entries is not an easy task. The add_ldap_group
playbook simplifies the process of adding a group in LDAP.
The playbook will ask for the group name and its members:
$ ansible-playbook -bK ansible/add_ldap_group.yml --ask-vault-pass
BECOME password:
Vault password:
Enter a group name: group1
Enter a comma-separated list of group members: user1,user2
...
Note that the playbook runs on all hosts but you still need to pass it an inventory. You may limit the execution to a particular host.
If you want to execute it on the vagrant host, the full command will be:
ansible-playbook -bKl docker_node ansible/add_ldap_group.yml --ask-vault-pass -i .vagrant/provisioners/ansible/inventory/vagrant_ansible_inventory --extra-vars traefik_domain=local.domain --ssh-extra-args="-o StrictHostKeyChecking=no"
Note: If you are already logged in Authelia, you must log out and in again to refresh the list of groups associated with your session.
Play both docker_nodes
and backup_nodes
playbooks