sgg-icecast: icecast client limit and simple stats

1 files changed, 78 insertions, 0 deletions

diff --git a/spreadspace/sgg-icecast.yml b/spreadspace/sgg-icecast.yml
index 6a4b3eeb..7e475b72 100644
--- a/spreadspace/sgg-icecast.yml
+++ b/spreadspace/sgg-icecast.yml
@@ -55,3 +55,81 @@
         proxy_pass: http://127.0.0.1:8080
     include_role:
       name: nginx/vhost
+
+
+  - name: create base directory for stats
+    file:
+      path: /srv/www/stats-schlagergarten
+      state: directory
+
+  - name: add user for stats
+    user:
+      name: stats
+      system: yes
+      home: /nonexistent
+      create_home: no
+
+  - name: create data directory for stats
+    file:
+      path: /srv/www/stats-schlagergarten/data
+      state: directory
+      group: stats
+      mode: 0775
+
+  - name: install stats collector script
+    copy:
+      content: |
+        #!/bin/bash
+        STATS_D=$(realpath "${BASH_SOURCE%/*}")
+        ts=$(date '+%Y-%m-%d_%H-%M-%S')
+        exec curl -s http://localhost:8080/status-json.xsl | gzip > "$STATS_D/data/$ts.json.gz"
+      dest: /srv/www/stats-schlagergarten/fetch.sh
+      mode: 0755
+
+  - name: install systemd unit for stats collector
+    copy:
+      content: |
+        [Unit]
+        Description=Schlagergarten Stream Stats Collector
+
+        [Service]
+        Type=oneshot
+        User=stats
+        ExecStart=/srv/www/stats-schlagergarten/fetch.sh
+        TimeoutStartSec=20s
+        TimeoutStartFailureMode=kill
+        NoNewPrivileges=yes
+        PrivateTmp=yes
+        PrivateDevices=yes
+        ProtectSystem=strict
+        ReadWritePaths=/srv/www/stats-schlagergarten/data
+        ProtectHome=yes
+        ProtectKernelTunables=yes
+        ProtectControlGroups=yes
+        RestrictRealtime=yes
+        RestrictAddressFamilies=AF_INET
+
+        [Install]
+        WantedBy=multi-user.target
+      dest: /etc/systemd/system/stats-schlagergarten.service
+
+  - name: install systemd timer for stats collector
+    copy:
+      content: |
+        [Unit]
+        Description=whawty-auth store sync timer
+
+        [Timer]
+        OnCalendar=minutely
+        AccuracySec=0s
+
+        [Install]
+        WantedBy=timers.target
+      dest: /etc/systemd/system/stats-schlagergarten.timer
+
+  - name: make sure stats collector timer unit is enabled and started
+    systemd:
+      name: stats-schlagergarten.timer
+      daemon_reload: yes
+      enabled: yes
+      state: started