mirror of
https://github.com/RWejlgaard/pez-infra.git
synced 2026-10-31 19:11:03 +00:00
Rasmus "Pez" Wejlgaard
7683f8c7ea
* Install Grafana Alloy from Ansible (PESO-158) copenhagen-a came back from its Proxmox repave with no Alloy at all, so it's been unmonitored since. Nothing in this repo installs Alloy — every host got it from Grafana's onboarding one-liner, and the common role only bolted on a resilience drop-in if the unit already happened to exist. A rebuild silently loses monitoring. New alloy role owns the whole thing: the Grafana apt repo, the package, the config, the credentials drop-in and the resilience override. Runs on every host, so this can't happen again on the next repave. Moved the resilience drop-in out of common into the role that owns Alloy. The rendered config is byte-identical to what's on the hosts today apart from the managed-by header, so the only effect on the healthy hosts is one restart. * Pin Alloy to 1.19.2-1 and add the Grafana Cloud key to SOPS Adding the apt repo means the fleet is upgradable for the first time, so pin the version explicitly rather than letting copenhagen-a come up five minor versions ahead of everyone else. All six hosts land on 1.19.2-1. Checked the 1.14 -> 1.19 changelog against what we actually run. Nothing breaking touches the bootstrap config or the fleet pipelines; the only entry that lands anywhere near us is 1.18.0 giving otelcol.receiver.otlp upstream default timeouts, which affects the Caddy tracing pipeline on helsinki-a and sets no timeouts explicitly today.
82 lines
2.1 KiB
YAML
82 lines
2.1 KiB
YAML
---
|
|
- name: Install deb822_repository dependency
|
|
ansible.builtin.apt:
|
|
name: python3-debian
|
|
state: present
|
|
|
|
- name: Configure Grafana apt repository
|
|
ansible.builtin.deb822_repository:
|
|
name: grafana
|
|
types: deb
|
|
uris: https://apt.grafana.com
|
|
suites: stable
|
|
components: main
|
|
signed_by: https://apt.grafana.com/gpg.key
|
|
register: alloy_apt_repository
|
|
|
|
- name: Update apt cache
|
|
ansible.builtin.apt:
|
|
update_cache: true
|
|
cache_valid_time: "{{ 0 if alloy_apt_repository is changed else 3600 }}"
|
|
|
|
- name: Install Alloy
|
|
ansible.builtin.apt:
|
|
name: "alloy={{ alloy_version }}"
|
|
state: present
|
|
|
|
- name: Deploy Alloy configuration
|
|
ansible.builtin.template:
|
|
src: config.alloy.j2
|
|
dest: /etc/alloy/config.alloy
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
notify: Restart alloy
|
|
|
|
- name: Create Alloy systemd drop-in directory
|
|
ansible.builtin.file:
|
|
path: /etc/systemd/system/alloy.service.d
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: '0755'
|
|
|
|
# StartLimitIntervalSec=0 keeps Alloy retrying through transient upstream
|
|
# failures instead of tripping systemd's start rate-limit and staying dead
|
|
# (PESO-149).
|
|
- name: Install Alloy systemd resilience drop-in
|
|
ansible.builtin.copy:
|
|
dest: /etc/systemd/system/alloy.service.d/10-resilience.conf
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
content: |
|
|
# Managed by Ansible (pez-infra) — alloy role.
|
|
[Unit]
|
|
StartLimitIntervalSec=0
|
|
|
|
[Service]
|
|
Restart=always
|
|
RestartSec=30
|
|
notify: Restart alloy
|
|
|
|
- name: Install Alloy credentials drop-in
|
|
ansible.builtin.copy:
|
|
dest: /etc/systemd/system/alloy.service.d/env.conf
|
|
owner: root
|
|
group: root
|
|
mode: '0600'
|
|
content: |
|
|
# Managed by Ansible (pez-infra) — alloy role.
|
|
[Service]
|
|
Environment=GCLOUD_RW_API_KEY={{ alloy_gcloud_rw_api_key }}
|
|
Environment=GCLOUD_FM_COLLECTOR_ID={{ alloy_collector_id }}
|
|
no_log: true
|
|
notify: Restart alloy
|
|
|
|
- name: Enable and start Alloy
|
|
ansible.builtin.systemd:
|
|
name: alloy
|
|
state: started
|
|
enabled: true
|
|
daemon_reload: true
|