Graham McIntire
c64f59929e
Add an RPZ blocklist on the Unbound resolvers that returns NXDOMAIN for a set of domains (and subdomains) and logs only those matches under rpz-log tag "blocklist". Domains are templated from resolver_blocked_domains (single source of truth) into /etc/unbound/blocklist.rpz; respip module enabled for RPZ support. Fix deprecation warnings across the Ansible tree: - apt_repository -> deb822_repository (monitor, aprsc, uisp, grafana), removing stale .list files and adding update_cache where deb822 drops it - community.mysql.* -> ansible.mysql.* (monitor) and requirements.yml - top-level facts -> ansible_facts[...] (ansible_os_family, distribution_release, fqdn, architecture, default_ipv4) repo-wide
123 lines
3.1 KiB
YAML
123 lines
3.1 KiB
YAML
---
|
|
- name: Ensure /etc/apt/keyrings exists
|
|
ansible.builtin.file:
|
|
path: /etc/apt/keyrings
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
|
|
- name: Install prerequisites
|
|
ansible.builtin.apt:
|
|
name:
|
|
- apt-transport-https
|
|
- gnupg
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Add Grafana apt signing key
|
|
ansible.builtin.get_url:
|
|
url: "{{ grafana_apt_key_url }}"
|
|
dest: "{{ grafana_apt_keyring }}"
|
|
mode: "0644"
|
|
force: false
|
|
|
|
- name: Add Grafana apt repository
|
|
ansible.builtin.deb822_repository:
|
|
name: grafana
|
|
types: [deb]
|
|
uris: https://apt.grafana.com
|
|
suites: [stable]
|
|
components: [main]
|
|
signed_by: "{{ grafana_apt_keyring }}"
|
|
state: present
|
|
|
|
- name: Remove legacy Grafana .list repo (superseded by deb822 .sources)
|
|
ansible.builtin.file:
|
|
path: /etc/apt/sources.list.d/grafana.list
|
|
state: absent
|
|
|
|
- name: Install Grafana OSS
|
|
ansible.builtin.apt:
|
|
name: grafana
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Configure grafana.ini
|
|
ansible.builtin.template:
|
|
src: grafana.ini.j2
|
|
dest: /etc/grafana/grafana.ini
|
|
owner: root
|
|
group: grafana
|
|
mode: "0640"
|
|
notify: Restart grafana
|
|
|
|
- name: Provision Prometheus datasource
|
|
ansible.builtin.template:
|
|
src: datasources.yaml.j2
|
|
dest: /etc/grafana/provisioning/datasources/prometheus.yaml
|
|
owner: root
|
|
group: grafana
|
|
mode: "0640"
|
|
notify: Restart grafana
|
|
|
|
- name: Create dashboards directory
|
|
ansible.builtin.file:
|
|
path: "{{ grafana_dashboards_dir }}"
|
|
state: directory
|
|
owner: grafana
|
|
group: grafana
|
|
mode: "0755"
|
|
|
|
- name: Sync standard dashboard JSON files
|
|
ansible.builtin.copy:
|
|
src: dashboards/
|
|
dest: "{{ grafana_dashboards_dir }}/"
|
|
owner: grafana
|
|
group: grafana
|
|
mode: "0644"
|
|
notify: Restart grafana
|
|
|
|
- name: List currently-provisioned dashboard files on host
|
|
ansible.builtin.find:
|
|
paths: "{{ grafana_dashboards_dir }}"
|
|
patterns: "*.json"
|
|
file_type: file
|
|
register: grafana_remote_dashboards
|
|
|
|
- name: List dashboard JSON files from this role
|
|
ansible.builtin.set_fact:
|
|
grafana_managed_dashboards: >-
|
|
{{
|
|
query('ansible.builtin.fileglob',
|
|
role_path ~ '/files/dashboards/*.json')
|
|
| map('basename') | list
|
|
}}
|
|
|
|
# Without this, a renamed dashboard leaves the old file on disk and the
|
|
# provisioner refuses to write any dashboards (duplicate UID warning).
|
|
- name: Remove stale dashboard files not present in the role
|
|
ansible.builtin.file:
|
|
path: "{{ item.path }}"
|
|
state: absent
|
|
loop: "{{ grafana_remote_dashboards.files }}"
|
|
loop_control:
|
|
label: "{{ item.path | basename }}"
|
|
when: (item.path | basename) not in grafana_managed_dashboards
|
|
notify: Restart grafana
|
|
|
|
- name: Render dashboard provider config
|
|
ansible.builtin.template:
|
|
src: dashboard-providers.yaml.j2
|
|
dest: /etc/grafana/provisioning/dashboards/default.yaml
|
|
owner: root
|
|
group: grafana
|
|
mode: "0640"
|
|
notify: Restart grafana
|
|
|
|
- name: Enable and start grafana-server
|
|
ansible.builtin.systemd:
|
|
name: grafana-server
|
|
enabled: true
|
|
state: started
|
|
daemon_reload: true
|