Graham McIntire
66986e294b
Add a telegraf role (applied to the resolvers) that runs unbound-control via the inputs.unbound plugin and exposes the stats as a Prometheus /metrics endpoint on :9273, firewalled to the 204.110.188.0/22 scrape network. Imports the InfluxData signing key (influxdata-archive.key; the _compat key expired 2026-01-17) so dnf can validate the package. - prom.w5isp.com: scrape job "unbound" for resolver1/2:9273 - grafana: "Unbound Resolvers" dashboard (queries, cache hit ratio, rcodes, query types, recursion time, request list, cache memory) - resolvers: disable unused shm-enable to silence the startup warning
53 lines
1.6 KiB
YAML
53 lines
1.6 KiB
YAML
---
|
|
# Installs Telegraf and configures it to collect Unbound stats (via
|
|
# unbound-control) and expose them as Prometheus metrics on
|
|
# telegraf_prometheus_port for the central Prometheus server to scrape.
|
|
|
|
- name: Import InfluxData package signing key (RedHat)
|
|
ansible.builtin.rpm_key:
|
|
key: "{{ telegraf_influxdata_gpgkey }}"
|
|
state: present
|
|
when: ansible_facts['os_family'] == "RedHat"
|
|
|
|
- name: Add InfluxData package repository (RedHat)
|
|
ansible.builtin.yum_repository:
|
|
name: influxdata
|
|
description: InfluxData Repository - Stable
|
|
baseurl: "{{ telegraf_influxdata_baseurl }}"
|
|
gpgcheck: true
|
|
gpgkey: "{{ telegraf_influxdata_gpgkey }}"
|
|
enabled: true
|
|
when: ansible_facts['os_family'] == "RedHat"
|
|
|
|
- name: Install Telegraf (RedHat)
|
|
ansible.builtin.dnf:
|
|
name: telegraf
|
|
state: present
|
|
when: ansible_facts['os_family'] == "RedHat"
|
|
|
|
- name: Deploy Telegraf configuration
|
|
ansible.builtin.template:
|
|
src: telegraf.conf.j2
|
|
dest: /etc/telegraf/telegraf.conf
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: Restart telegraf
|
|
|
|
- name: Allow Prometheus scrape of the metrics port from the scrape subnet (firewalld)
|
|
ansible.posix.firewalld:
|
|
zone: public
|
|
rich_rule: >-
|
|
rule family="ipv4" source address="{{ telegraf_scrape_allow_cidr }}"
|
|
port port="{{ telegraf_prometheus_port }}" protocol="tcp" accept
|
|
permanent: true
|
|
immediate: true
|
|
state: enabled
|
|
when: ansible_facts['os_family'] == "RedHat"
|
|
|
|
- name: Enable and start Telegraf
|
|
ansible.builtin.systemd:
|
|
name: telegraf
|
|
state: started
|
|
enabled: true
|
|
daemon_reload: true
|