Graham McIntire
c64f59929e
Add an RPZ blocklist on the Unbound resolvers that returns NXDOMAIN for a set of domains (and subdomains) and logs only those matches under rpz-log tag "blocklist". Domains are templated from resolver_blocked_domains (single source of truth) into /etc/unbound/blocklist.rpz; respip module enabled for RPZ support. Fix deprecation warnings across the Ansible tree: - apt_repository -> deb822_repository (monitor, aprsc, uisp, grafana), removing stale .list files and adding update_cache where deb822 drops it - community.mysql.* -> ansible.mysql.* (monitor) and requirements.yml - top-level facts -> ansible_facts[...] (ansible_os_family, distribution_release, fqdn, architecture, default_ipv4) repo-wide
106 lines
2.7 KiB
YAML
106 lines
2.7 KiB
YAML
---
|
|
# Installs Loki from the upstream zip release and runs it under systemd in
|
|
# single-binary mode with filesystem storage.
|
|
|
|
- name: Install unzip (required to extract loki release)
|
|
ansible.builtin.apt:
|
|
name: unzip
|
|
state: present
|
|
update_cache: true
|
|
when: ansible_facts['os_family'] == "Debian"
|
|
|
|
- name: Create loki group
|
|
ansible.builtin.group:
|
|
name: "{{ loki_group }}"
|
|
system: true
|
|
state: present
|
|
|
|
- name: Create loki user
|
|
ansible.builtin.user:
|
|
name: "{{ loki_user }}"
|
|
group: "{{ loki_group }}"
|
|
system: true
|
|
shell: /usr/sbin/nologin
|
|
home: "{{ loki_data_dir }}"
|
|
create_home: false
|
|
state: present
|
|
|
|
- name: Create loki directories
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
owner: "{{ loki_user }}"
|
|
group: "{{ loki_group }}"
|
|
mode: "0755"
|
|
loop:
|
|
- "{{ loki_config_dir }}"
|
|
- "{{ loki_data_dir }}"
|
|
- "{{ loki_data_dir }}/chunks"
|
|
- "{{ loki_data_dir }}/rules"
|
|
- "{{ loki_data_dir }}/compactor"
|
|
|
|
- name: Check installed loki version
|
|
ansible.builtin.command: "{{ loki_install_dir }}/loki -version"
|
|
register: loki_installed
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Decide whether loki needs (re)install
|
|
ansible.builtin.set_fact:
|
|
loki_needs_install: >-
|
|
{{
|
|
loki_installed.rc != 0
|
|
or loki_version not in (loki_installed.stdout | default(''))
|
|
and loki_version not in (loki_installed.stderr | default(''))
|
|
}}
|
|
|
|
- name: Download loki zip
|
|
ansible.builtin.get_url:
|
|
url: "https://github.com/grafana/loki/releases/download/v{{ loki_version }}/loki-linux-{{ loki_arch }}.zip"
|
|
dest: "/tmp/loki-{{ loki_version }}-linux-{{ loki_arch }}.zip"
|
|
mode: "0644"
|
|
when: loki_needs_install
|
|
|
|
- name: Extract loki
|
|
ansible.builtin.unarchive:
|
|
src: "/tmp/loki-{{ loki_version }}-linux-{{ loki_arch }}.zip"
|
|
dest: /tmp/
|
|
remote_src: true
|
|
creates: "/tmp/loki-linux-{{ loki_arch }}"
|
|
when: loki_needs_install
|
|
|
|
- name: Install loki binary
|
|
ansible.builtin.copy:
|
|
src: "/tmp/loki-linux-{{ loki_arch }}"
|
|
dest: "{{ loki_install_dir }}/loki"
|
|
remote_src: true
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
when: loki_needs_install
|
|
notify: Restart loki
|
|
|
|
- name: Render loki.yml
|
|
ansible.builtin.template:
|
|
src: loki.yml.j2
|
|
dest: "{{ loki_config_dir }}/loki.yml"
|
|
owner: "{{ loki_user }}"
|
|
group: "{{ loki_group }}"
|
|
mode: "0640"
|
|
notify: Restart loki
|
|
|
|
- name: Install loki systemd unit
|
|
ansible.builtin.template:
|
|
src: loki.service.j2
|
|
dest: /etc/systemd/system/loki.service
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: Restart loki
|
|
|
|
- name: Enable and start loki
|
|
ansible.builtin.systemd:
|
|
name: loki
|
|
enabled: true
|
|
state: started
|
|
daemon_reload: true
|