From 5408325a13337672ea09907278ff97b42de60b36 Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@spreadspace.org>
Date: Tue, 22 Jun 2021 23:29:18 +0200
Subject: add minimalistic role for prometheus/alertmanager

---
 chaos-at-home/ch-mon.yml                           |  1 +
 inventory/host_vars/ch-mon.yml                     |  7 +++-
 .../prometheus/alertmanager/defaults/main.yml      |  5 +++
 .../prometheus/alertmanager/handlers/main.yml      | 10 +++++
 .../prometheus/alertmanager/tasks/main.yml         | 45 ++++++++++++++++++++++
 .../alertmanager/templates/alertmanager.yml.j2     | 17 ++++++++
 .../templates/prometheus-alertmanager.service.j2   | 37 ++++++++++++++++++
 7 files changed, 121 insertions(+), 1 deletion(-)
 create mode 100644 roles/monitoring/prometheus/alertmanager/defaults/main.yml
 create mode 100644 roles/monitoring/prometheus/alertmanager/handlers/main.yml
 create mode 100644 roles/monitoring/prometheus/alertmanager/tasks/main.yml
 create mode 100644 roles/monitoring/prometheus/alertmanager/templates/alertmanager.yml.j2
 create mode 100644 roles/monitoring/prometheus/alertmanager/templates/prometheus-alertmanager.service.j2

diff --git a/chaos-at-home/ch-mon.yml b/chaos-at-home/ch-mon.yml
index 8e25d6ec..906e8adc 100644
--- a/chaos-at-home/ch-mon.yml
+++ b/chaos-at-home/ch-mon.yml
@@ -12,5 +12,6 @@
   - role: apt-repo/spreadspace
   - role: monitoring/prometheus/ca
   - role: monitoring/prometheus/exporter
+  - role: monitoring/prometheus/alertmanager
   - role: monitoring/prometheus/server
   - role: monitoring/grafana
diff --git a/inventory/host_vars/ch-mon.yml b/inventory/host_vars/ch-mon.yml
index 03a9b80a..c0551768 100644
--- a/inventory/host_vars/ch-mon.yml
+++ b/inventory/host_vars/ch-mon.yml
@@ -68,6 +68,11 @@ prometheus_exporter_blackbox_modules_extra:
   icmp:
     prober: icmp
 
+promethues_alertmanager_smtp:
+  smarthost: "{{ network_zones.lan.prefix | ipaddr(network_zones.lan.offsets['ch-prometheus-legacy']) | ipaddr('address') }}:25"
+  from: "noreply@chaos-at-home.org"
+  require_tls: no
+
 
 grafana_secret_key: "{{ vault_grafana_secret_key }}"
 
@@ -75,7 +80,7 @@ grafana_config_smtp:
   enabled: true
   host: "{{ network_zones.lan.prefix | ipaddr(network_zones.lan.offsets['ch-prometheus-legacy']) | ipaddr('address') }}:25"
   from_name: "chaos@home Grafana"
-  from_address: noreply@chaos-at-home.org
+  from_address: "noreply@chaos-at-home.org"
 
 grafana_config_plugins:
   enable_alpha: true
diff --git a/roles/monitoring/prometheus/alertmanager/defaults/main.yml b/roles/monitoring/prometheus/alertmanager/defaults/main.yml
new file mode 100644
index 00000000..34b03df0
--- /dev/null
+++ b/roles/monitoring/prometheus/alertmanager/defaults/main.yml
@@ -0,0 +1,5 @@
+---
+promethues_alertmanager_smtp:
+  smarthost: "127.0.0.1:25"
+  from: "noreply@example.com"
+  require_tls: no
diff --git a/roles/monitoring/prometheus/alertmanager/handlers/main.yml b/roles/monitoring/prometheus/alertmanager/handlers/main.yml
new file mode 100644
index 00000000..571b1f7c
--- /dev/null
+++ b/roles/monitoring/prometheus/alertmanager/handlers/main.yml
@@ -0,0 +1,10 @@
+---
+- name: restart prometheus-alertmanager
+  service:
+    name: prometheus-alertmanager
+    state: restarted
+
+- name: reload prometheus-alertmanager
+  service:
+    name: prometheus-alertmanager
+    state: reloaded
diff --git a/roles/monitoring/prometheus/alertmanager/tasks/main.yml b/roles/monitoring/prometheus/alertmanager/tasks/main.yml
new file mode 100644
index 00000000..fe8ce9ca
--- /dev/null
+++ b/roles/monitoring/prometheus/alertmanager/tasks/main.yml
@@ -0,0 +1,45 @@
+---
+- name: check if prometheus apt component of spreadspace repo is enabled
+  assert:
+    msg: "please enable the 'prometheus' component of spreadspace repo using 'spreadspace_apt_repo_components'"
+    that:
+    - spreadspace_apt_repo_components is defined
+    - "'prometheus' in spreadspace_apt_repo_components"
+
+- name: install apt packages
+  apt:
+    name: prom-alertmanager
+    state: present
+
+- name: add user for server
+  user:
+    name: prometheus-alertmanager
+    system: yes
+    home: /nonexistent
+    create_home: no
+
+- name: create data directory
+  file:
+    path: /var/lib/prometheus/alertmanager
+    state: directory
+    owner: prometheus-alertmanager
+    group: prometheus-alertmanager
+
+- name: generate configuration file
+  template:
+    src: alertmanager.yml.j2
+    dest: /etc/prometheus/alertmanager.yml
+  notify: reload prometheus-alertmanager
+
+- name: generate systemd service unit
+  template:
+    src: prometheus-alertmanager.service.j2
+    dest: /etc/systemd/system/prometheus-alertmanager.service
+  notify: restart prometheus-alertmanager
+
+- name: make sure alertmanager is enabled and started
+  systemd:
+    name: prometheus-alertmanager.service
+    daemon_reload: yes
+    state: started
+    enabled: yes
diff --git a/roles/monitoring/prometheus/alertmanager/templates/alertmanager.yml.j2 b/roles/monitoring/prometheus/alertmanager/templates/alertmanager.yml.j2
new file mode 100644
index 00000000..b1d40bb2
--- /dev/null
+++ b/roles/monitoring/prometheus/alertmanager/templates/alertmanager.yml.j2
@@ -0,0 +1,17 @@
+# {{ ansible_managed }}
+
+global:
+  smtp_smarthost: '{{ promethues_alertmanager_smtp.smarthost }}'
+  smtp_from: '{{ promethues_alertmanager_smtp.from }}'
+  smtp_require_tls: {{ promethues_alertmanager_smtp.require_tls | ternary('true', 'false') }}
+
+route:
+  receiver: empty
+
+  routes:
+  - match_re:
+      instance: ^$
+    receiver: empty
+
+receivers:
+- name: empty
diff --git a/roles/monitoring/prometheus/alertmanager/templates/prometheus-alertmanager.service.j2 b/roles/monitoring/prometheus/alertmanager/templates/prometheus-alertmanager.service.j2
new file mode 100644
index 00000000..f290dca8
--- /dev/null
+++ b/roles/monitoring/prometheus/alertmanager/templates/prometheus-alertmanager.service.j2
@@ -0,0 +1,37 @@
+[Unit]
+Description=Alertmanager for Prometheus Monitoring system
+Documentation=https://prometheus.io/docs/alerting/alertmanager/
+
+[Service]
+Restart=on-failure
+User=prometheus-alertmanager
+ExecStart=/usr/bin/prometheus-alertmanager --config.file=/etc/prometheus/alertmanager.yml --cluster.listen-address= --storage.path="/var/lib/prometheus/alertmanager"
+ExecReload=/bin/kill -HUP $MAINPID
+TimeoutStopSec=20s
+SendSIGKILL=no
+
+# systemd hardening-options
+AmbientCapabilities=
+CapabilityBoundingSet=
+DeviceAllow=/dev/null rw
+DevicePolicy=strict
+LimitMEMLOCK=0
+LimitNOFILE=8192
+LockPersonality=true
+MemoryDenyWriteExecute=true
+NoNewPrivileges=true
+PrivateDevices=true
+PrivateTmp=true
+PrivateUsers=true
+ProtectControlGroups=true
+ProtectHome=true
+ProtectKernelModules=true
+ProtectKernelTunables=true
+ProtectSystem=full
+RemoveIPC=true
+RestrictNamespaces=true
+RestrictRealtime=true
+SystemCallArchitectures=native
+
+[Install]
+WantedBy=multi-user.target
-- 
cgit v1.2.3