add minimalistic role for prometheus/alertmanager

5 files changed, 114 insertions, 0 deletions

diff --git a/roles/monitoring/prometheus/alertmanager/defaults/main.yml b/roles/monitoring/prometheus/alertmanager/defaults/main.yml
new file mode 100644
index 00000000..34b03df0
--- /dev/null
+++ b/roles/monitoring/prometheus/alertmanager/defaults/main.yml
@@ -0,0 +1,5 @@
+---
+promethues_alertmanager_smtp:
+  smarthost: "127.0.0.1:25"
+  from: "noreply@example.com"
+  require_tls: no
diff --git a/roles/monitoring/prometheus/alertmanager/handlers/main.yml b/roles/monitoring/prometheus/alertmanager/handlers/main.yml
new file mode 100644
index 00000000..571b1f7c
--- /dev/null
+++ b/roles/monitoring/prometheus/alertmanager/handlers/main.yml
@@ -0,0 +1,10 @@
+---
+- name: restart prometheus-alertmanager
+  service:
+    name: prometheus-alertmanager
+    state: restarted
+
+- name: reload prometheus-alertmanager
+  service:
+    name: prometheus-alertmanager
+    state: reloaded
diff --git a/roles/monitoring/prometheus/alertmanager/tasks/main.yml b/roles/monitoring/prometheus/alertmanager/tasks/main.yml
new file mode 100644
index 00000000..fe8ce9ca
--- /dev/null
+++ b/roles/monitoring/prometheus/alertmanager/tasks/main.yml
@@ -0,0 +1,45 @@
+---
+- name: check if prometheus apt component of spreadspace repo is enabled
+  assert:
+    msg: "please enable the 'prometheus' component of spreadspace repo using 'spreadspace_apt_repo_components'"
+    that:
+    - spreadspace_apt_repo_components is defined
+    - "'prometheus' in spreadspace_apt_repo_components"
+
+- name: install apt packages
+  apt:
+    name: prom-alertmanager
+    state: present
+
+- name: add user for server
+  user:
+    name: prometheus-alertmanager
+    system: yes
+    home: /nonexistent
+    create_home: no
+
+- name: create data directory
+  file:
+    path: /var/lib/prometheus/alertmanager
+    state: directory
+    owner: prometheus-alertmanager
+    group: prometheus-alertmanager
+
+- name: generate configuration file
+  template:
+    src: alertmanager.yml.j2
+    dest: /etc/prometheus/alertmanager.yml
+  notify: reload prometheus-alertmanager
+
+- name: generate systemd service unit
+  template:
+    src: prometheus-alertmanager.service.j2
+    dest: /etc/systemd/system/prometheus-alertmanager.service
+  notify: restart prometheus-alertmanager
+
+- name: make sure alertmanager is enabled and started
+  systemd:
+    name: prometheus-alertmanager.service
+    daemon_reload: yes
+    state: started
+    enabled: yes
diff --git a/roles/monitoring/prometheus/alertmanager/templates/alertmanager.yml.j2 b/roles/monitoring/prometheus/alertmanager/templates/alertmanager.yml.j2
new file mode 100644
index 00000000..b1d40bb2
--- /dev/null
+++ b/roles/monitoring/prometheus/alertmanager/templates/alertmanager.yml.j2
@@ -0,0 +1,17 @@
+# {{ ansible_managed }}
+
+global:
+  smtp_smarthost: '{{ promethues_alertmanager_smtp.smarthost }}'
+  smtp_from: '{{ promethues_alertmanager_smtp.from }}'
+  smtp_require_tls: {{ promethues_alertmanager_smtp.require_tls | ternary('true', 'false') }}
+
+route:
+  receiver: empty
+
+  routes:
+  - match_re:
+      instance: ^$
+    receiver: empty
+
+receivers:
+- name: empty
diff --git a/roles/monitoring/prometheus/alertmanager/templates/prometheus-alertmanager.service.j2 b/roles/monitoring/prometheus/alertmanager/templates/prometheus-alertmanager.service.j2
new file mode 100644
index 00000000..f290dca8
--- /dev/null
+++ b/roles/monitoring/prometheus/alertmanager/templates/prometheus-alertmanager.service.j2
@@ -0,0 +1,37 @@
+[Unit]
+Description=Alertmanager for Prometheus Monitoring system
+Documentation=https://prometheus.io/docs/alerting/alertmanager/
+
+[Service]
+Restart=on-failure
+User=prometheus-alertmanager
+ExecStart=/usr/bin/prometheus-alertmanager --config.file=/etc/prometheus/alertmanager.yml --cluster.listen-address= --storage.path="/var/lib/prometheus/alertmanager"
+ExecReload=/bin/kill -HUP $MAINPID
+TimeoutStopSec=20s
+SendSIGKILL=no
+
+# systemd hardening-options
+AmbientCapabilities=
+CapabilityBoundingSet=
+DeviceAllow=/dev/null rw
+DevicePolicy=strict
+LimitMEMLOCK=0
+LimitNOFILE=8192
+LockPersonality=true
+MemoryDenyWriteExecute=true
+NoNewPrivileges=true
+PrivateDevices=true
+PrivateTmp=true
+PrivateUsers=true
+ProtectControlGroups=true
+ProtectHome=true
+ProtectKernelModules=true
+ProtectKernelTunables=true
+ProtectSystem=full
+RemoveIPC=true
+RestrictNamespaces=true
+RestrictRealtime=true
+SystemCallArchitectures=native
+
+[Install]
+WantedBy=multi-user.target