add monitoring for mosquitto

7 files changed, 100 insertions, 0 deletions

diff --git a/roles/monitoring/prometheus/exporter/meta/main.yml b/roles/monitoring/prometheus/exporter/meta/main.yml
index 0b466ac9..b60d0dbc 100644
--- a/roles/monitoring/prometheus/exporter/meta/main.yml
+++ b/roles/monitoring/prometheus/exporter/meta/main.yml
@@ -27,4 +27,6 @@ dependencies:
     when: "'chrony' in (prometheus_exporters_default | union(prometheus_exporters_extra))"
   - role: monitoring/prometheus/exporter/nftables
     when: "'nftables' in (prometheus_exporters_default | union(prometheus_exporters_extra))"
+  - role: monitoring/prometheus/exporter/mosquitto
+    when: "'mosquitto' in (prometheus_exporters_default | union(prometheus_exporters_extra))"
   - role: monitoring/prometheus/exporter/register
diff --git a/roles/monitoring/prometheus/exporter/mosquitto/defaults/main.yml b/roles/monitoring/prometheus/exporter/mosquitto/defaults/main.yml
new file mode 100644
index 00000000..f2c8ae43
--- /dev/null
+++ b/roles/monitoring/prometheus/exporter/mosquitto/defaults/main.yml
@@ -0,0 +1,2 @@
+---
+# prometheus_exporter_mosquitto_version:
diff --git a/roles/monitoring/prometheus/exporter/mosquitto/handlers/main.yml b/roles/monitoring/prometheus/exporter/mosquitto/handlers/main.yml
new file mode 100644
index 00000000..27050bea
--- /dev/null
+++ b/roles/monitoring/prometheus/exporter/mosquitto/handlers/main.yml
@@ -0,0 +1,10 @@
+---
+- name: restart prometheus-mosquitto-exporter
+  service:
+    name: prometheus-mosquitto-exporter
+    state: restarted
+
+- name: reload nginx
+  service:
+    name: nginx
+    state: reloaded
diff --git a/roles/monitoring/prometheus/exporter/mosquitto/tasks/main.yml b/roles/monitoring/prometheus/exporter/mosquitto/tasks/main.yml
new file mode 100644
index 00000000..0a035c3d
--- /dev/null
+++ b/roles/monitoring/prometheus/exporter/mosquitto/tasks/main.yml
@@ -0,0 +1,44 @@
+---
+- name: generate apt pin file for exporter-mosquitto package
+  when: prometheus_exporter_mosquitto_version is defined
+  copy:
+    dest: "/etc/apt/preferences.d/prom-exporter-mosquitto.pref"
+    content: |
+      Package: prom-exporter-mosquitto
+      Pin: version {{ prometheus_exporter_mosquitto_version }}-1
+      Pin-Priority: 1001
+
+- name: remove apt pin file for exporter-mosquitto package
+  when: prometheus_exporter_mosquitto_version is not defined
+  file:
+    path: "/etc/apt/preferences.d/prom-exporter-mosquitto.pref"
+    state: absent
+
+- name: install apt packages
+  apt:
+    name: "prom-exporter-mosquitto{% if prometheus_exporter_mosquitto_version is defined %}={{ prometheus_exporter_mosquitto_version }}-1{% endif %}"
+    state: present
+    allow_downgrade: yes
+  notify: restart prometheus-mosquitto-exporter
+
+- name: generate systemd service unit
+  template:
+    src: service.j2
+    dest: /etc/systemd/system/prometheus-mosquitto-exporter.service
+  notify: restart prometheus-mosquitto-exporter
+
+- name: make sure prometheus-mosquitto-exporter is enabled and started
+  systemd:
+    name: prometheus-mosquitto-exporter.service
+    daemon_reload: yes
+    state: started
+    enabled: yes
+
+- name: register exporter
+  copy:
+    content: |
+      location = /mosquitto {
+          proxy_pass http://127.0.0.1:9234/metrics;
+      }
+    dest: /etc/prometheus/exporter/mosquitto.locations
+  notify: reload nginx
diff --git a/roles/monitoring/prometheus/exporter/mosquitto/templates/service.j2 b/roles/monitoring/prometheus/exporter/mosquitto/templates/service.j2
new file mode 100644
index 00000000..ec340c32
--- /dev/null
+++ b/roles/monitoring/prometheus/exporter/mosquitto/templates/service.j2
@@ -0,0 +1,30 @@
+[Unit]
+Description=Prometheus mosquitto exporter
+
+[Service]
+Restart=always
+User=mosquitto
+ExecStart=/usr/bin/prometheus-mosquitto-exporter --bind-address="127.0.0.1:9234" --endpoint="unix:///var/run/mosquitto/prometheus.sock" --client-id prometheus
+
+# systemd hardening-options
+AmbientCapabilities=
+CapabilityBoundingSet=
+DeviceAllow=/dev/null rw
+DevicePolicy=strict
+LockPersonality=true
+MemoryDenyWriteExecute=true
+NoNewPrivileges=true
+PrivateDevices=true
+PrivateTmp=true
+ProtectControlGroups=true
+ProtectHome=true
+ProtectKernelModules=true
+ProtectKernelTunables=true
+ProtectSystem=strict
+RemoveIPC=true
+RestrictNamespaces=true
+RestrictRealtime=true
+SystemCallArchitectures=native
+
+[Install]
+WantedBy=multi-user.target
diff --git a/roles/monitoring/prometheus/server/defaults/main/main.yml b/roles/monitoring/prometheus/server/defaults/main/main.yml
index 7f78d5aa..9f867568 100644
--- a/roles/monitoring/prometheus/server/defaults/main/main.yml
+++ b/roles/monitoring/prometheus/server/defaults/main/main.yml
@@ -40,6 +40,7 @@ prometheus_server_rules:
   modbus/probe: "{{ prometheus_server_rules_modbus__probe + prometheus_server_rules_modbus__probe_extra }}"
   nftables: "{{ prometheus_server_rules_nftables + prometheus_server_rules_nftables_extra }}"
   whawty-nginx-sso: "{{ prometheus_server_rules_whawty_nginx_sso + prometheus_server_rules_whawty_nginx_sso_extra }}"
+  mosquitto: "{{ prometheus_server_rules_mosquitto + prometheus_server_rules_mosquitto_extra }}"
 
 # prometheus_server_alertmanager:
 #   url: "127.0.0.1:9093"
diff --git a/roles/monitoring/prometheus/server/defaults/main/rules_mosquitto.yml b/roles/monitoring/prometheus/server/defaults/main/rules_mosquitto.yml
new file mode 100644
index 00000000..538a5e44
--- /dev/null
+++ b/roles/monitoring/prometheus/server/defaults/main/rules_mosquitto.yml
@@ -0,0 +1,11 @@
+---
+prometheus_server_rules_mosquitto_extra: []
+prometheus_server_rules_mosquitto:
+  - alert: MosquittoBrokerUnreachable
+    expr: broker_uptime == 0
+    for: 0m
+    labels:
+      severity: critical
+    annotations:
+      summary: Unable to scrape mosquitto (instance {{ '{{' }} $labels.instance {{ '}}' }})
+      description: "The uptime of the mosquitto process is reported as 0 - this is likely because the exporter has lost it's connection to the broker.\n  VALUE = {{ '{{' }} $value {{ '}}' }}\n  LABELS = {{ '{{' }} $labels {{ '}}' }}"