302 lines
14 KiB
YAML
Executable File
302 lines
14 KiB
YAML
Executable File
#!/usr/bin/env ansible-playbook
|
|
# vim:ft=ansible:
|
|
# Webservers
|
|
---
|
|
- hosts: web1.dallas.mgmt.desu.ltd
|
|
module_defaults:
|
|
docker_container:
|
|
state: started
|
|
restart_policy: unless-stopped
|
|
pull: yes
|
|
tasks:
|
|
- name: ensure docker network
|
|
docker_network: name=web
|
|
tags: [ docker ]
|
|
- name: include tasks for applications
|
|
include_tasks: tasks/{{ item }}
|
|
with_items:
|
|
- app/redis.yml
|
|
- web/9iron.yml
|
|
- web/desultd.yml
|
|
- web/gitea.yml
|
|
- web/nextcloud.yml
|
|
- web/srv.yml
|
|
tags: [ always ]
|
|
roles:
|
|
- role: backup
|
|
vars:
|
|
backup_s3backup_list_extra:
|
|
- /app/gitea/gitea
|
|
- /data
|
|
- /srv/desu.ltd
|
|
backup_s3backup_exclude_list_extra:
|
|
- /var/lib/gitea/log
|
|
- /data/gitea/data/gitea/log
|
|
tags: [ backup ]
|
|
- role: git
|
|
vars:
|
|
git_repos:
|
|
- repo: https://git.desu.ltd/salt/gitea-custom
|
|
dest: /data/gitea/data/gitea/custom
|
|
tags: [ web, git ]
|
|
- role: ingress
|
|
vars:
|
|
ingress_servers:
|
|
# desu.ltd
|
|
- name: desu.ltd
|
|
proxy_pass: http://desultd:80
|
|
locations:
|
|
- location: /.well-known/matrix/server
|
|
contents: |
|
|
default_type application/json;
|
|
return 200 '{"m.server":"matrix.desu.ltd:443"}';
|
|
- location: /.well-known/matrix/client
|
|
contents: |
|
|
default_type application/json;
|
|
return 200 '{"m.homeserver":{"base_url":"https://matrix.desu.ltd"}}';
|
|
- name: git.desu.ltd
|
|
proxy_pass: http://gitea:3000
|
|
- name: nc.desu.ltd
|
|
directives:
|
|
- "add_header Strict-Transport-Security \"max-age=31536000\""
|
|
- "client_max_body_size 0"
|
|
proxy_pass: http://nextcloud:80
|
|
locations:
|
|
- location: "^~ /.well-known"
|
|
contents: |
|
|
location = /.well-known/carddav { return 301 /remote.php/dav/; }
|
|
location = /.well-known/caldav { return 301 /remote.php/dav/; }
|
|
location ^~ /.well-known { return 301 /index.php$uri; }
|
|
try_files $uri $uri/ =404;
|
|
# 9iron
|
|
- name: www.9iron.club
|
|
directives:
|
|
- "return 301 $scheme://9iron.club$request_uri"
|
|
- name: 9iron.club
|
|
proxy_pass: http://9iron:80
|
|
- name: srv.9iron.club
|
|
proxy_pass: http://srv:80
|
|
tags: [ web, docker, ingress ]
|
|
- hosts: web2.dallas.mgmt.desu.ltd
|
|
module_defaults:
|
|
docker_container:
|
|
state: started
|
|
restart_policy: unless-stopped
|
|
pull: yes
|
|
pre_tasks:
|
|
- name: ensure docker network
|
|
docker_network: name=web
|
|
tags: [ docker ]
|
|
- name: include tasks for applications
|
|
include_tasks: tasks/{{ item }}
|
|
with_items:
|
|
- app/redis.yml
|
|
- web/libreddit.yml
|
|
- web/peertube.yml
|
|
- web/pleroma.yml
|
|
tags: [ always ]
|
|
roles:
|
|
- role: backup
|
|
vars:
|
|
backup_s3backup_list_extra:
|
|
- /data
|
|
tags: [ backup ]
|
|
- role: ingress
|
|
vars:
|
|
ingress_servers:
|
|
- name: cowfee.moe
|
|
proxy_pass: http://pleroma:4000
|
|
- name: tube.cowfee.moe
|
|
proxy_pass: http://peertube:9000
|
|
- name: lr.cowfee.moe
|
|
directives:
|
|
- "access_log /dev/null"
|
|
- "error_log /dev/null"
|
|
proxy_pass: http://libreddit:8080
|
|
tags: [ web, docker, ingress ]
|
|
- hosts: web3.dallas.mgmt.desu.ltd
|
|
module_defaults:
|
|
docker_container:
|
|
state: started
|
|
restart_policy: unless-stopped
|
|
pull: yes
|
|
tasks:
|
|
- name: ensure docker network
|
|
docker_network: name=web
|
|
tags: [ docker ]
|
|
- name: include tasks for applications
|
|
include_tasks: tasks/{{ item }}
|
|
with_items:
|
|
- app/redis.yml
|
|
- web/movienight.yml
|
|
- web/netbox.yml
|
|
tags: [ always ]
|
|
roles:
|
|
- role: backup
|
|
vars:
|
|
backup_s3backup_list_extra:
|
|
- /data
|
|
tags: [ backup ]
|
|
# TODO: Replace this with Naemon(?)
|
|
- role: nagios
|
|
vars:
|
|
nagios_matrix_server: "https://matrix.desu.ltd"
|
|
nagios_matrix_room: "!QJpSrEHPWSAHwdUMgy:desu.ltd"
|
|
nagios_matrix_token: "{{ secret_nagios_matrix_token }}"
|
|
nagios_data_dir: /data/nagios
|
|
nagios_admin_pass: "{{ secret_nagios_admin_pass }}"
|
|
nagios_contacts:
|
|
- name: matrix
|
|
host_notification_commands: notify-host-by-matrix
|
|
service_notification_commands: notify-service-by-matrix
|
|
host_notification_period: ansible-not-late-at-night
|
|
service_notification_period: ansible-not-late-at-night
|
|
extra:
|
|
- key: contactgroups
|
|
value: ansible
|
|
- name: salt
|
|
host_notification_commands: notify-host-by-email
|
|
service_notification_commands: notify-service-by-email
|
|
extra:
|
|
- key: email
|
|
value: alerts@babor.tech
|
|
nagios_commands:
|
|
# This command is included in the container image
|
|
- name: check_nrpe
|
|
command: "$USER1$/check_nrpe -H $HOSTADDRESS$ -c $ARG1$"
|
|
- name: check_by_ssh
|
|
command: "$USER1$/check_by_ssh -H $HOSTADDRESS$ -F /opt/nagios/etc/ssh_config -t 30 -q -i /opt/nagios/etc/id_ed25519 -l nagios-checker -C \"$ARG1$\""
|
|
- name: notify-host-by-matrix
|
|
command: "/usr/bin/printf \"%b\" \"$NOTIFICATIONTYPE$ - $HOSTNAME$ is $HOSTSTATE$\\nAddress: $HOSTADDRESS$\\nInfo: $HOSTOUTPUT$\\nDate/Time: $LONGDATETIME$\" | /opt/Custom-Nagios-Plugins/notify-by-matrix"
|
|
- name: notify-service-by-matrix
|
|
command: "/usr/bin/printf \"%b\" \"$NOTIFICATIONTYPE$ - Service $HOSTALIAS$ - $SERVICEDESC$ is $SERVICESTATE$\\nInfo: $SERVICEOUTPUT$\\nDate/Time: $LONGDATETIME$\" | /opt/Custom-Nagios-Plugins/notify-by-matrix"
|
|
nagios_services:
|
|
# Agentless checks
|
|
- name: HTTP
|
|
command: check_http
|
|
hostgroup: tag-nagios-checkhttp
|
|
- name: HTTPS
|
|
command: check_http!--ssl
|
|
hostgroup: tag-nagios-checkhttp
|
|
- name: SSH
|
|
command: check_ssh
|
|
# check_by_ssh checks
|
|
- name: CPU Load
|
|
command: check_by_ssh!/usr/lib/nagios/plugins/check_load -r -w 5,4,3 -c 7,6,5
|
|
- name: CPU Utilization
|
|
command: check_by_ssh!/usr/local/bin/monitoring-scripts/check_cpu_stats -w 75 -c 90
|
|
- name: DNS Resolution
|
|
command: check_by_ssh!/usr/lib/nagios/plugins/check_etc_resolv
|
|
- name: Last Ansible Play
|
|
command: check_by_ssh!/usr/local/bin/monitoring-scripts/check_file_age /var/lib/ansible-last-run -w 176400 -c 216000
|
|
- name: Memory Usage
|
|
command: check_by_ssh!/usr/lib/nagios/plugins/check_memory -w 20% -c 10%
|
|
hostgroup: "ansible,!tag-prov-zfs"
|
|
- name: Ping Self over DNS
|
|
command: check_by_ssh!/usr/local/bin/monitoring-scripts/check_ping_by_hostname
|
|
- name: Reboot Required
|
|
command: check_by_ssh!/usr/local/bin/monitoring-scripts/check_reboot_required
|
|
- name: Unit atd.service
|
|
command: check_by_ssh!/usr/local/bin/monitoring-scripts/check_systemd_unit atd.service
|
|
- name: Unit backup.service
|
|
command: check_by_ssh!/usr/local/bin/monitoring-scripts/check_systemd_unit backup.service
|
|
hostgroup: "ansible,!role-hypervisor"
|
|
- name: Unit backup.timer
|
|
command: check_by_ssh!/usr/local/bin/monitoring-scripts/check_systemd_unit backup.timer
|
|
hostgroup: "ansible,!role-hypervisor"
|
|
- name: Unit cron.service
|
|
command: check_by_ssh!/usr/local/bin/monitoring-scripts/check_systemd_unit cron.service
|
|
- name: Unit dbus.service
|
|
command: check_by_ssh!/usr/local/bin/monitoring-scripts/check_systemd_unit dbus.service
|
|
- name: Unit docker.service
|
|
command: check_by_ssh!/usr/local/bin/monitoring-scripts/check_systemd_unit docker.service
|
|
hostgroup: "ansible,!tag-no-docker"
|
|
- name: Unit ssh.service
|
|
command: check_by_ssh!/usr/local/bin/monitoring-scripts/check_systemd_unit ssh.service
|
|
- name: Unit systemd-resolved.service
|
|
command: check_by_ssh!/usr/local/bin/monitoring-scripts/check_systemd_unit systemd-resolved.service
|
|
hostgroup: "ansible,!role-hypervisor"
|
|
- name: Users
|
|
command: check_by_ssh!/usr/lib/nagios/plugins/check_users -w 3 -c 5
|
|
# Privileged checks
|
|
# Required because check_disk may attempt to get the free space of
|
|
# restricted mountpoints
|
|
- name: Disk Usage
|
|
command: check_by_ssh!/usr/bin/sudo /usr/lib/nagios/plugins/check_disk -M -u GB -X nfs -X tracefs -X cgroup -X tmpfs -X overlay -X shm -w 15% -c 10% -W 15% -K 10% -A -I '^/run/' -I '^udev$' -I '^/var/lib/kubelet/' -I'^/tmp/.mount_'
|
|
# Device type checks
|
|
# R720
|
|
- name: CPU0 Temperature
|
|
command: check_by_ssh!/usr/bin/sudo /usr/local/bin/monitoring-scripts/check_temp -w 65 -c 75 --sensor coretemp-isa-0000
|
|
- name: CPU1 Temperature
|
|
command: check_by_ssh!/usr/bin/sudo /usr/local/bin/monitoring-scripts/check_temp -w 65 -c 75 --sensor coretemp-isa-0001
|
|
# Device role checks
|
|
# hypervisor (which is assumed to be Proxmox)
|
|
- name: PVE Unit pve-firewall.service
|
|
command: check_by_ssh!/usr/local/bin/monitoring-scripts/check_systemd_unit pve-firewall.service
|
|
hostgroup: role-hypervisor
|
|
- name: PVE Unit spiceproxy.service
|
|
command: check_by_ssh!/usr/local/bin/monitoring-scripts/check_systemd_unit spiceproxy.service
|
|
hostgroup: role-hypervisor
|
|
- name: PVE Unit pve-ha-crm.service
|
|
command: check_by_ssh!/usr/local/bin/monitoring-scripts/check_systemd_unit pve-ha-crm.service
|
|
hostgroup: role-hypervisor
|
|
- name: PVE Unit pvedaemon.service
|
|
command: check_by_ssh!/usr/local/bin/monitoring-scripts/check_systemd_unit pvedaemon.service
|
|
hostgroup: role-hypervisor
|
|
- name: PVE Unit pvefw-logger.service
|
|
command: check_by_ssh!/usr/local/bin/monitoring-scripts/check_systemd_unit pvefw-logger.service
|
|
hostgroup: role-hypervisor
|
|
- name: PVE Unit pveproxy.service
|
|
command: check_by_ssh!/usr/local/bin/monitoring-scripts/check_systemd_unit pveproxy.service
|
|
hostgroup: role-hypervisor
|
|
- name: PVE Unit pve-cluster.service
|
|
command: check_by_ssh!/usr/local/bin/monitoring-scripts/check_systemd_unit pve-cluster.service
|
|
hostgroup: role-hypervisor
|
|
- name: PVE Unit pvestatd.service
|
|
command: check_by_ssh!/usr/local/bin/monitoring-scripts/check_systemd_unit pvestatd.service
|
|
hostgroup: role-hypervisor
|
|
# Tag-specific checks
|
|
# ansible-pull
|
|
- name: Unit ansible-pull.service
|
|
command: check_by_ssh!/usr/local/bin/monitoring-scripts/check_systemd_unit ansible-pull.service
|
|
hostgroup: tag-ansible-pull
|
|
- name: Unit ansible-pull.timer
|
|
command: check_by_ssh!/usr/local/bin/monitoring-scripts/check_systemd_unit ansible-pull.timer
|
|
hostgroup: tag-ansible-pull
|
|
# docker
|
|
# Strictly speaking not a tag, but it's best to keep it separated
|
|
# TODO: Figure out how I'm going to implement Docker checks
|
|
# nagios-checkpgsql
|
|
- name: PSQL
|
|
command: "check_by_ssh!/usr/lib/nagios/plugins/check_pgsql -H localhost -l nagios -p {{ secret_postgresql_monitoring_password }} -w 2 -c 5"
|
|
hostgroup: tag-nagios-checkpgsql
|
|
- name: PSQL Connections
|
|
command: "check_by_ssh!/usr/lib/nagios/plugins/check_pgsql -H localhost -l nagios -p {{ secret_postgresql_monitoring_password }} -w 2 -c 5 -q 'select (select count(*)::float used from pg_stat_activity) / (select setting::int max_conn from pg_settings where name=\\$\\$max_connections\\$\\$)' -W 0.7-0.8 -C 0.8-1.0"
|
|
hostgroup: tag-nagios-checkpgsql
|
|
# https://rhaas.blogspot.com/2020/02/useless-vacuuming.html
|
|
- name: PSQL Old Xacts
|
|
command: "check_by_ssh!/usr/lib/nagios/plugins/check_pgsql -H localhost -l nagios -p {{ secret_postgresql_monitoring_password }} -w 2 -c 5 -q 'select count(*)::float from pg_prepared_xacts where age(transaction) > 5000000' -W 500-1000 -C 1000-1000000"
|
|
hostgroup: tag-nagios-checkpgsql
|
|
- name: Unit postgresql.service
|
|
command: check_by_ssh!/usr/local/bin/monitoring-scripts/check_systemd_unit postgresql.service
|
|
hostgroup: tag-nagios-checkpgsql
|
|
# nagios-checkswap
|
|
- name: Swap Usage
|
|
command: check_by_ssh!/usr/lib/nagios/plugins/check_swap -w 20% -c 10%
|
|
hostgroup: tag-nagios-checkswap
|
|
# zerotier
|
|
- name: Unit zerotier-one.service
|
|
command: check_by_ssh!/usr/local/bin/monitoring-scripts/check_systemd_unit zerotier-one.service
|
|
hostgroup: tag-zerotier
|
|
tags: [ nagios ]
|
|
- role: ingress
|
|
vars:
|
|
ingress_servers:
|
|
- name: netbox.desu.ltd
|
|
proxy_pass: http://netbox:8080
|
|
- name: nagios.desu.ltd
|
|
proxy_pass: http://nagios:80
|
|
- name: movie.desu.ltd
|
|
proxy_pass: http://movienight:8089
|
|
tags: [ web, docker, ingress ]
|