From a8e8cb2ed3d5e68d89edd8785ed59f0ee45f81bf Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@spreadspace.org>
Date: Tue, 21 Sep 2021 19:34:25 +0200
Subject: prometheus: simplify job config

---
 roles/monitoring/prometheus/exporter/node/tasks/main.yml | 1 +
 1 file changed, 1 insertion(+)

(limited to 'roles/monitoring/prometheus/exporter/node/tasks/main.yml')

diff --git a/roles/monitoring/prometheus/exporter/node/tasks/main.yml b/roles/monitoring/prometheus/exporter/node/tasks/main.yml
index 8392e580..00a4ab3f 100644
--- a/roles/monitoring/prometheus/exporter/node/tasks/main.yml
+++ b/roles/monitoring/prometheus/exporter/node/tasks/main.yml
@@ -1,4 +1,5 @@
 ---
+  ## TODO: pin version
 - name: install apt packages
   apt:
     name: prom-exporter-node
-- 
cgit v1.2.3


From d4a5276b2813f95d56e8fadb0e6d8ff169b8eecb Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@spreadspace.org>
Date: Thu, 23 Sep 2021 14:40:38 +0200
Subject: move exporter_exporter configuration into canonical config dir

---
 roles/monitoring/prometheus/exporter/base/tasks/main.yml       | 2 +-
 roles/monitoring/prometheus/exporter/base/templates/service.j2 | 2 +-
 roles/monitoring/prometheus/exporter/blackbox/tasks/main.yml   | 2 +-
 roles/monitoring/prometheus/exporter/mikrotik/tasks/main.yml   | 2 +-
 roles/monitoring/prometheus/exporter/node/tasks/main.yml       | 2 +-
 roles/monitoring/prometheus/exporter/nut/tasks/main.yml        | 2 +-
 6 files changed, 6 insertions(+), 6 deletions(-)

(limited to 'roles/monitoring/prometheus/exporter/node/tasks/main.yml')

diff --git a/roles/monitoring/prometheus/exporter/base/tasks/main.yml b/roles/monitoring/prometheus/exporter/base/tasks/main.yml
index 9e35c48d..eeb2a23d 100644
--- a/roles/monitoring/prometheus/exporter/base/tasks/main.yml
+++ b/roles/monitoring/prometheus/exporter/base/tasks/main.yml
@@ -14,7 +14,7 @@
 
 - name: create configuration directories
   file:
-    path: /etc/prometheus/exporter/enabled
+    path: /etc/prometheus/exporter/exporter
     state: directory
 
 - name: add user for prometheus-exporter
diff --git a/roles/monitoring/prometheus/exporter/base/templates/service.j2 b/roles/monitoring/prometheus/exporter/base/templates/service.j2
index c24baf43..3d44744a 100644
--- a/roles/monitoring/prometheus/exporter/base/templates/service.j2
+++ b/roles/monitoring/prometheus/exporter/base/templates/service.j2
@@ -4,7 +4,7 @@ Description=Prometheus exporter proxy
 [Service]
 Restart=always
 User=prometheus-exporter
-ExecStart=/usr/bin/prometheus-exporter-exporter -config.dirs=/etc/prometheus/exporter/enabled -config.file="" -web.listen-address="" -web.tls.listen-address="{{ prometheus_exporter_listen }}" -web.tls.cert="/etc/ssl/prometheus/exporter/crt.pem" -web.tls.key="/etc/ssl/prometheus/exporter/key.pem" --web.tls.ca="/etc/ssl/prometheus/ca-crt.pem" -web.tls.verify
+ExecStart=/usr/bin/prometheus-exporter-exporter -config.dirs=/etc/prometheus/exporter/exporter -config.file="" -web.listen-address="" -web.tls.listen-address="{{ prometheus_exporter_listen }}" -web.tls.cert="/etc/ssl/prometheus/exporter/crt.pem" -web.tls.key="/etc/ssl/prometheus/exporter/key.pem" --web.tls.ca="/etc/ssl/prometheus/ca-crt.pem" -web.tls.verify
 {# TODO: implement reloading once the exporter_exporter supports this #}
 
 # systemd hardening-options
diff --git a/roles/monitoring/prometheus/exporter/blackbox/tasks/main.yml b/roles/monitoring/prometheus/exporter/blackbox/tasks/main.yml
index 96c247ec..cab521cc 100644
--- a/roles/monitoring/prometheus/exporter/blackbox/tasks/main.yml
+++ b/roles/monitoring/prometheus/exporter/blackbox/tasks/main.yml
@@ -36,5 +36,5 @@
       http:
         port: 9115
         path: '/probe'
-    dest: /etc/prometheus/exporter/enabled/blackbox.yml
+    dest: /etc/prometheus/exporter/exporter/blackbox.yml
   notify: reload prometheus-exporter-exporter
diff --git a/roles/monitoring/prometheus/exporter/mikrotik/tasks/main.yml b/roles/monitoring/prometheus/exporter/mikrotik/tasks/main.yml
index dda33e9f..07219c68 100644
--- a/roles/monitoring/prometheus/exporter/mikrotik/tasks/main.yml
+++ b/roles/monitoring/prometheus/exporter/mikrotik/tasks/main.yml
@@ -38,5 +38,5 @@
       method: http
       http:
         port: 9436
-    dest: /etc/prometheus/exporter/enabled/mikrotik.yml
+    dest: /etc/prometheus/exporter/exporter/mikrotik.yml
   notify: reload prometheus-exporter-exporter
diff --git a/roles/monitoring/prometheus/exporter/node/tasks/main.yml b/roles/monitoring/prometheus/exporter/node/tasks/main.yml
index 00a4ab3f..3fa0a1ec 100644
--- a/roles/monitoring/prometheus/exporter/node/tasks/main.yml
+++ b/roles/monitoring/prometheus/exporter/node/tasks/main.yml
@@ -29,5 +29,5 @@
       method: http
       http:
         port: 9100
-    dest: /etc/prometheus/exporter/enabled/node.yml
+    dest: /etc/prometheus/exporter/exporter/node.yml
   notify: reload prometheus-exporter-exporter
diff --git a/roles/monitoring/prometheus/exporter/nut/tasks/main.yml b/roles/monitoring/prometheus/exporter/nut/tasks/main.yml
index 78a8e817..8245feae 100644
--- a/roles/monitoring/prometheus/exporter/nut/tasks/main.yml
+++ b/roles/monitoring/prometheus/exporter/nut/tasks/main.yml
@@ -25,5 +25,5 @@
       http:
         port: 9199
         path: /ups_metrics
-    dest: /etc/prometheus/exporter/enabled/nut.yml
+    dest: /etc/prometheus/exporter/exporter/nut.yml
   notify: reload prometheus-exporter-exporter
-- 
cgit v1.2.3


From 6320da1262c1f44ac773c6b6578a59ba286ce973 Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@spreadspace.org>
Date: Fri, 24 Sep 2021 00:57:01 +0200
Subject: add some basic prometheus node exporter textfile collector scripts

---
 .../prometheus/exporter/node/defaults/main.yml     |  5 +-
 .../monitoring/prometheus/exporter/node/files/apt  | 40 ++++++++++++
 .../exporter/node/files/deleted-libraries          | 75 ++++++++++++++++++++++
 .../prometheus/exporter/node/tasks/main.yml        | 35 ++++++++++
 .../node/tasks/textfile_collector_script.yml       | 21 ++++++
 .../textfile-collector-scripts/apt.service.j2      | 30 +++++++++
 .../textfile-collector-scripts/apt.timer.j2        |  9 +++
 .../deleted-libraries.service.j2                   | 30 +++++++++
 .../deleted-libraries.timer.j2                     |  9 +++
 9 files changed, 253 insertions(+), 1 deletion(-)
 create mode 100755 roles/monitoring/prometheus/exporter/node/files/apt
 create mode 100755 roles/monitoring/prometheus/exporter/node/files/deleted-libraries
 create mode 100644 roles/monitoring/prometheus/exporter/node/tasks/textfile_collector_script.yml
 create mode 100644 roles/monitoring/prometheus/exporter/node/templates/textfile-collector-scripts/apt.service.j2
 create mode 100644 roles/monitoring/prometheus/exporter/node/templates/textfile-collector-scripts/apt.timer.j2
 create mode 100644 roles/monitoring/prometheus/exporter/node/templates/textfile-collector-scripts/deleted-libraries.service.j2
 create mode 100644 roles/monitoring/prometheus/exporter/node/templates/textfile-collector-scripts/deleted-libraries.timer.j2

(limited to 'roles/monitoring/prometheus/exporter/node/tasks/main.yml')

diff --git a/roles/monitoring/prometheus/exporter/node/defaults/main.yml b/roles/monitoring/prometheus/exporter/node/defaults/main.yml
index 56227fbb..4a9b40cd 100644
--- a/roles/monitoring/prometheus/exporter/node/defaults/main.yml
+++ b/roles/monitoring/prometheus/exporter/node/defaults/main.yml
@@ -9,4 +9,7 @@ prometheus_exporter_node_timesync_collector: "{{ _prometheus_exporter_node_time_
 
 prometheus_exporter_node_disable_collectors: []
 prometheus_exporter_node_extra_collectors:
-- "{{ prometheus_exporter_node_timesync_collector }}"
+  - "{{ prometheus_exporter_node_timesync_collector }}"
+
+prometheus_exporter_node_textfile_collector_scripts:
+  - deleted-libraries
diff --git a/roles/monitoring/prometheus/exporter/node/files/apt b/roles/monitoring/prometheus/exporter/node/files/apt
new file mode 100755
index 00000000..015addb0
--- /dev/null
+++ b/roles/monitoring/prometheus/exporter/node/files/apt
@@ -0,0 +1,40 @@
+#!/bin/bash
+#
+# Description: Expose metrics from apt updates.
+#
+# Author: Ben Kochie <superq@gmail.com>
+
+upgrades="$(/usr/bin/apt-get --just-print dist-upgrade \
+  | /usr/bin/awk -F'[()]' \
+      '/^Inst/ { sub("^[^ ]+ ", "", $2); gsub(" ","",$2);
+                 sub("\\[", " ", $2); sub("\\]", "", $2); print $2 }' \
+  | /usr/bin/sort \
+  | /usr/bin/uniq -c \
+  | awk '{ gsub(/\\\\/, "\\\\", $2); gsub(/"/, "\\\"", $2);
+           gsub(/\[/, "", $3); gsub(/\]/, "", $3);
+           print "apt_upgrades_pending{origin=\"" $2 "\",arch=\"" $NF "\"} " $1}'
+)"
+
+autoremove="$(/usr/bin/apt-get --just-print autoremove \
+  | /usr/bin/awk '/^Remv/{a++}END{printf "apt_autoremove_pending %d", a}'
+)"
+
+echo '# HELP apt_upgrades_pending Apt package pending updates by origin.'
+echo '# TYPE apt_upgrades_pending gauge'
+if [[ -n "${upgrades}" ]] ; then
+  echo "${upgrades}"
+else
+  echo 'apt_upgrades_pending{origin="",arch=""} 0'
+fi
+
+echo '# HELP apt_autoremove_pending Apt package pending autoremove.'
+echo '# TYPE apt_autoremove_pending gauge'
+echo "${autoremove}"
+
+echo '# HELP node_reboot_required Node reboot is required for software updates.'
+echo '# TYPE node_reboot_required gauge'
+if [[ -f '/run/reboot-required' ]] ; then
+  echo 'node_reboot_required 1'
+else
+  echo 'node_reboot_required 0'
+fi
diff --git a/roles/monitoring/prometheus/exporter/node/files/deleted-libraries b/roles/monitoring/prometheus/exporter/node/files/deleted-libraries
new file mode 100755
index 00000000..e3e19cbd
--- /dev/null
+++ b/roles/monitoring/prometheus/exporter/node/files/deleted-libraries
@@ -0,0 +1,75 @@
+#!/usr/bin/env python3
+"""
+Script to count the number of deleted libraries that are linked by running
+processes and expose a summary as Prometheus metrics.
+
+The aim is to discover processes that are still using libraries that have since
+been updated, perhaps due security vulnerabilities.
+"""
+
+import errno
+import glob
+import os
+import sys
+
+
+def main():
+    processes_linking_deleted_libraries = {}
+
+    for path in glob.glob('/proc/*/maps'):
+        try:
+            with open(path, 'rb') as file:
+                for line in file:
+                    part = line.decode().strip().split()
+
+                    if len(part) == 7:
+                        library = part[5]
+                        comment = part[6]
+
+                        if '/lib/' in library and '(deleted)' in comment:
+                            if path not in processes_linking_deleted_libraries:
+                                processes_linking_deleted_libraries[path] = {}
+
+                                if library in processes_linking_deleted_libraries[path]:
+                                    processes_linking_deleted_libraries[path][library] += 1
+                                else:
+                                    processes_linking_deleted_libraries[path][library] = 1
+        except EnvironmentError as e:
+            # Ignore non-existent files, since the files may have changed since
+            # we globbed.
+            if e.errno != errno.ENOENT:
+                sys.exit('Failed to open file: {0}'.format(path))
+
+    num_processes_per_library = {}
+
+    for process, library_count in processes_linking_deleted_libraries.items():
+        libraries_seen = set()
+        for library, count in library_count.items():
+            if library in libraries_seen:
+                continue
+
+            libraries_seen.add(library)
+            if library in num_processes_per_library:
+                num_processes_per_library[library] += 1
+            else:
+                num_processes_per_library[library] = 1
+
+    metric_name = 'node_processes_linking_deleted_libraries'
+    description = 'Count of running processes that link a deleted library'
+    print('# HELP {0} {1}'.format(metric_name, description))
+    print('# TYPE {0} gauge'.format(metric_name))
+
+    for library, count in num_processes_per_library.items():
+        dir_path, basename = os.path.split(library)
+        basename = basename.replace('"', '\\"')
+        dir_path = dir_path.replace('"', '\\"')
+        print('{0}{{library_path="{1}", library_name="{2}"}} {3}'.format(
+            metric_name,
+            dir_path,
+            basename,
+            count)
+        )
+
+
+if __name__ == "__main__":
+    main()
diff --git a/roles/monitoring/prometheus/exporter/node/tasks/main.yml b/roles/monitoring/prometheus/exporter/node/tasks/main.yml
index 3fa0a1ec..61e385f7 100644
--- a/roles/monitoring/prometheus/exporter/node/tasks/main.yml
+++ b/roles/monitoring/prometheus/exporter/node/tasks/main.yml
@@ -31,3 +31,38 @@
         port: 9100
     dest: /etc/prometheus/exporter/exporter/node.yml
   notify: reload prometheus-exporter-exporter
+
+- name: create directory for textfile collector scripts
+  file:
+    path: /usr/local/lib/prometheus-node-exporter
+    state: directory
+
+- name: install textfile collector script wrapper
+  copy:
+    content: |
+      #!/bin/bash
+
+      if [ -z "$1" ]; then
+        echo "Please specify which collector script to call!"
+        exit 1
+      fi
+      collector="$1"
+
+      set -e
+      rm -f "/var/lib/prometheus-node-exporter/textfile-collector/$collector.prom".*
+      "/usr/local/lib/prometheus-node-exporter/$collector" > "/var/lib/prometheus-node-exporter/textfile-collector/$collector.prom.$$"
+      mv "/var/lib/prometheus-node-exporter/textfile-collector/$collector.prom.$$" "/var/lib/prometheus-node-exporter/textfile-collector/$collector.prom"
+    dest: /usr/local/lib/prometheus-node-exporter/run-collector
+    mode: 0755
+
+- name: install the apt textfile collector script
+  when: ansible_pkg_mgr == "apt"
+  vars:
+    textfile_collector_name: "apt"
+  include_tasks: textfile_collector_script.yml
+
+- name: install all other textfile collector scripts
+  loop: "{{ prometheus_exporter_node_textfile_collector_scripts }}"
+  loop_control:
+    loop_var: textfile_collector_name
+  include_tasks: textfile_collector_script.yml
diff --git a/roles/monitoring/prometheus/exporter/node/tasks/textfile_collector_script.yml b/roles/monitoring/prometheus/exporter/node/tasks/textfile_collector_script.yml
new file mode 100644
index 00000000..1a39bb4c
--- /dev/null
+++ b/roles/monitoring/prometheus/exporter/node/tasks/textfile_collector_script.yml
@@ -0,0 +1,21 @@
+---
+- name: install the collector script
+  copy:
+    src: "{{ textfile_collector_name }}"
+    dest: "/usr/local/lib/prometheus-node-exporter/{{ textfile_collector_name }}"
+    mode: 0755
+
+- name: install systemd service units
+  loop:
+  - service
+  - timer
+  template:
+    src: "textfile-collector-scripts/{{ textfile_collector_name }}.{{ item }}.j2"
+    dest: "/etc/systemd/system/prometheus-node-exporter_{{ textfile_collector_name }}.{{ item }}"
+
+- name: make sure the systemd timer is enabled and started
+  systemd:
+    daemon_reload: yes
+    name: "prometheus-node-exporter_{{ textfile_collector_name }}.timer"
+    state: started
+    enabled: yes
diff --git a/roles/monitoring/prometheus/exporter/node/templates/textfile-collector-scripts/apt.service.j2 b/roles/monitoring/prometheus/exporter/node/templates/textfile-collector-scripts/apt.service.j2
new file mode 100644
index 00000000..b0e9d167
--- /dev/null
+++ b/roles/monitoring/prometheus/exporter/node/templates/textfile-collector-scripts/apt.service.j2
@@ -0,0 +1,30 @@
+[Unit]
+Description=Promethues node exporter textfile collector apt
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/lib/prometheus-node-exporter/run-collector apt
+
+# systemd hardening-options
+AmbientCapabilities=
+CapabilityBoundingSet=
+DeviceAllow=/dev/null rw
+DevicePolicy=strict
+LockPersonality=true
+MemoryDenyWriteExecute=true
+NoNewPrivileges=true
+PrivateDevices=true
+PrivateTmp=true
+ProtectControlGroups=true
+ProtectHome=true
+ProtectKernelModules=true
+ProtectKernelTunables=true
+ProtectSystem=strict
+ReadWritePaths=/var/lib/prometheus-node-exporter/textfile-collector
+RemoveIPC=true
+RestrictNamespaces=true
+RestrictRealtime=true
+SystemCallArchitectures=native
+
+[Install]
+WantedBy=multi-user.target
diff --git a/roles/monitoring/prometheus/exporter/node/templates/textfile-collector-scripts/apt.timer.j2 b/roles/monitoring/prometheus/exporter/node/templates/textfile-collector-scripts/apt.timer.j2
new file mode 100644
index 00000000..5e7d3062
--- /dev/null
+++ b/roles/monitoring/prometheus/exporter/node/templates/textfile-collector-scripts/apt.timer.j2
@@ -0,0 +1,9 @@
+[Unit]
+Description=Promethues node exporter textfile collector apt
+
+[Timer]
+OnCalendar=*-*-* *:1/30:17
+AccuracySec=10s
+
+[Install]
+WantedBy=timers.target
diff --git a/roles/monitoring/prometheus/exporter/node/templates/textfile-collector-scripts/deleted-libraries.service.j2 b/roles/monitoring/prometheus/exporter/node/templates/textfile-collector-scripts/deleted-libraries.service.j2
new file mode 100644
index 00000000..9dbc822f
--- /dev/null
+++ b/roles/monitoring/prometheus/exporter/node/templates/textfile-collector-scripts/deleted-libraries.service.j2
@@ -0,0 +1,30 @@
+[Unit]
+Description=Promethues node exporter textfile collector deleted-libraries
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/lib/prometheus-node-exporter/run-collector deleted-libraries
+
+# systemd hardening-options
+AmbientCapabilities=CAP_SYS_PTRACE
+CapabilityBoundingSet=CAP_SYS_PTRACE
+DeviceAllow=/dev/null rw
+DevicePolicy=strict
+LockPersonality=true
+MemoryDenyWriteExecute=true
+NoNewPrivileges=true
+PrivateDevices=true
+PrivateTmp=true
+ProtectControlGroups=true
+ProtectHome=true
+ProtectKernelModules=true
+ProtectKernelTunables=true
+ProtectSystem=strict
+ReadWritePaths=/var/lib/prometheus-node-exporter/textfile-collector
+RemoveIPC=true
+RestrictNamespaces=true
+RestrictRealtime=true
+SystemCallArchitectures=native
+
+[Install]
+WantedBy=multi-user.target
diff --git a/roles/monitoring/prometheus/exporter/node/templates/textfile-collector-scripts/deleted-libraries.timer.j2 b/roles/monitoring/prometheus/exporter/node/templates/textfile-collector-scripts/deleted-libraries.timer.j2
new file mode 100644
index 00000000..8f38050a
--- /dev/null
+++ b/roles/monitoring/prometheus/exporter/node/templates/textfile-collector-scripts/deleted-libraries.timer.j2
@@ -0,0 +1,9 @@
+[Unit]
+Description=Promethues node exporter textfile collector deleted-libraries
+
+[Timer]
+OnCalendar=*-*-* *:2/30:22
+AccuracySec=10s
+
+[Install]
+WantedBy=timers.target
-- 
cgit v1.2.3


From 9a47d5c3ef94cb09338a1b64d4dc9365d526bb54 Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@spreadspace.org>
Date: Fri, 24 Sep 2021 15:05:48 +0200
Subject: refactor textfile collector script handling

---
 roles/monitoring/prometheus/exporter/TODO          |   4 -
 .../prometheus/exporter/node/defaults/main.yml     |   1 +
 .../prometheus/exporter/node/files/smartmon        | 391 +++++++++++++++++++++
 .../prometheus/exporter/node/tasks/main.yml        |  24 +-
 .../node/tasks/textfile_collector_script.yml       |   2 +-
 .../textfile-collector-scripts/apt.service.j2      |   3 +-
 .../textfile-collector-scripts/apt.timer.j2        |   5 +-
 .../deleted-libraries.service.j2                   |   3 +-
 .../deleted-libraries.timer.j2                     |   5 +-
 .../textfile-collector-scripts/smartmon.service.j2 |  29 ++
 .../textfile-collector-scripts/smartmon.timer.j2   |  13 +
 11 files changed, 447 insertions(+), 33 deletions(-)
 create mode 100644 roles/monitoring/prometheus/exporter/node/files/smartmon
 create mode 100644 roles/monitoring/prometheus/exporter/node/templates/textfile-collector-scripts/smartmon.service.j2
 create mode 100644 roles/monitoring/prometheus/exporter/node/templates/textfile-collector-scripts/smartmon.timer.j2

(limited to 'roles/monitoring/prometheus/exporter/node/tasks/main.yml')

diff --git a/roles/monitoring/prometheus/exporter/TODO b/roles/monitoring/prometheus/exporter/TODO
index c02e5699..79ff8721 100644
--- a/roles/monitoring/prometheus/exporter/TODO
+++ b/roles/monitoring/prometheus/exporter/TODO
@@ -1,7 +1,3 @@
-Node Exporter - Text Collector Scripts:
- - https://github.com/prometheus-community/node-exporter-textfile-collector-scripts
- - https://packages.debian.org/bullseye/prometheus-node-exporter-collectors
-
 IPMI Exporter:
   - https://github.com/soundcloud/ipmi_exporter
   - https://packages.debian.org/bullseye/prometheus-ipmi-exporter
diff --git a/roles/monitoring/prometheus/exporter/node/defaults/main.yml b/roles/monitoring/prometheus/exporter/node/defaults/main.yml
index 9309562f..870753c3 100644
--- a/roles/monitoring/prometheus/exporter/node/defaults/main.yml
+++ b/roles/monitoring/prometheus/exporter/node/defaults/main.yml
@@ -14,3 +14,4 @@ prometheus_exporter_node_extra_collectors:
 
 prometheus_exporter_node_textfile_collector_scripts:
   - deleted-libraries
+  - smartmon
diff --git a/roles/monitoring/prometheus/exporter/node/files/smartmon b/roles/monitoring/prometheus/exporter/node/files/smartmon
new file mode 100644
index 00000000..1c39b492
--- /dev/null
+++ b/roles/monitoring/prometheus/exporter/node/files/smartmon
@@ -0,0 +1,391 @@
+#!/usr/bin/env python3
+import argparse
+import collections
+import csv
+import datetime
+import decimal
+import re
+import shlex
+import subprocess
+import sys
+
+device_info_re = re.compile(r'^(?P<k>[^:]+?)(?:(?:\sis|):)\s*(?P<v>.*)$')
+
+ata_error_count_re = re.compile(
+    r'^Error (\d+) \[\d+\] occurred', re.MULTILINE)
+
+self_test_re = re.compile(r'^SMART.*(PASSED|OK)$', re.MULTILINE)
+
+device_info_map = {
+    'Vendor': 'vendor',
+    'Product': 'product',
+    'Revision': 'revision',
+    'Logical Unit id': 'lun_id',
+    'Model Family': 'model_family',
+    'Device Model': 'device_model',
+    'Serial Number': 'serial_number',
+    'Firmware Version': 'firmware_version',
+}
+
+smart_attributes_whitelist = {
+    'airflow_temperature_cel',
+    'command_timeout',
+    'current_pending_sector',
+    'end_to_end_error',
+    'erase_fail_count_total',
+    'g_sense_error_rate',
+    'hardware_ecc_recovered',
+    'host_reads_mib',
+    'host_reads_32mib',
+    'host_writes_mib',
+    'host_writes_32mib',
+    'load_cycle_count',
+    'media_wearout_indicator',
+    'wear_leveling_count',
+    'nand_writes_1gib',
+    'offline_uncorrectable',
+    'power_cycle_count',
+    'power_on_hours',
+    'program_fail_count',
+    'raw_read_error_rate',
+    'reallocated_event_count',
+    'reallocated_sector_ct',
+    'reported_uncorrect',
+    'sata_downshift_count',
+    'seek_error_rate',
+    'spin_retry_count',
+    'spin_up_time',
+    'start_stop_count',
+    'temperature_case',
+    'temperature_celsius',
+    'temperature_internal',
+    'total_lbas_read',
+    'total_lbas_written',
+    'udma_crc_error_count',
+    'unsafe_shutdown_count',
+    'workld_host_reads_perc',
+    'workld_media_wear_indic',
+    'workload_minutes',
+}
+
+Metric = collections.namedtuple('Metric', 'name labels value')
+
+SmartAttribute = collections.namedtuple('SmartAttribute', [
+    'id', 'name', 'flag', 'value', 'worst', 'threshold', 'type', 'updated',
+    'when_failed', 'raw_value',
+])
+
+
+class Device(collections.namedtuple('DeviceBase', 'path opts')):
+    """Representation of a device as found by smartctl --scan output."""
+
+    @property
+    def type(self):
+        return self.opts.type
+
+    @property
+    def base_labels(self):
+        return {'device': self.path, 'disk': self.type.partition('+')[2] or '0'}
+
+    def smartctl_select(self):
+        return ['--device', self.type, self.path]
+
+
+def metric_key(metric, prefix=''):
+    return '{prefix}{metric.name}'.format(prefix=prefix, metric=metric)
+
+
+def metric_format(metric, prefix=''):
+    key = metric_key(metric, prefix)
+    labels = ','.join(
+        '{k}="{v}"'.format(k=k, v=v.replace('"', '\\"')) for k, v in metric.labels.items())
+    value = decimal.Decimal(metric.value)
+
+    return '{key}{{{labels}}} {value}'.format(
+        key=key, labels=labels, value=value)
+
+
+def metric_print_meta(metric, prefix=''):
+    key = metric_key(metric, prefix)
+    print('# HELP {key} SMART metric {metric.name}'.format(
+        key=key, metric=metric))
+    print('# TYPE {key} gauge'.format(key=key))
+
+
+def metric_print(metric, prefix=''):
+    print(metric_format(metric, prefix))
+
+
+def smart_ctl(*args, check=True):
+    """Wrapper around invoking the smartctl binary.
+
+    Returns:
+        (str) Data piped to stdout by the smartctl subprocess.
+    """
+    return subprocess.run(
+        ['smartctl', *args], stdout=subprocess.PIPE, check=check
+    ).stdout.decode('utf-8')
+
+
+def smart_ctl_version():
+    return smart_ctl('-V').split('\n')[0].split()[1]
+
+
+def find_devices():
+    """Find SMART devices.
+
+    Yields:
+        (Device) Single device found by smartctl.
+    """
+    parser = argparse.ArgumentParser()
+    parser.add_argument('-d', '--device', dest='type')
+
+    devices = smart_ctl('--scan-open')
+
+    for device in devices.split('\n'):
+        device = device.strip()
+        if not device:
+            continue
+
+        tokens = shlex.split(device, comments=True)
+        if not tokens:
+            continue
+
+        yield Device(tokens[0], parser.parse_args(tokens[1:]))
+
+
+def device_is_active(device):
+    """Returns whenever the given device is currently active or not.
+
+    Args:
+        device: (Device) Device in question.
+
+    Returns:
+        (bool) True if the device is active and False otherwise.
+    """
+    try:
+        smart_ctl('--nocheck', 'standby', *device.smartctl_select())
+    except subprocess.CalledProcessError:
+        return False
+
+    return True
+
+
+def device_info(device):
+    """Query device for basic model information.
+
+    Args:
+        device: (Device) Device in question.
+
+    Returns:
+        (generator): Generator yielding:
+
+            key (str): Key describing the value.
+            value (str): Actual value.
+    """
+    info_lines = smart_ctl(
+        '--info', *device.smartctl_select()
+    ).strip().split('\n')[3:]
+
+    matches = (device_info_re.match(line) for line in info_lines)
+    return (m.groups() for m in matches if m is not None)
+
+
+def device_smart_capabilities(device):
+    """Returns SMART capabilities of the given device.
+
+    Args:
+        device: (Device) Device in question.
+
+    Returns:
+        (tuple): tuple containing:
+
+            (bool): True whenever SMART is available, False otherwise.
+            (bool): True whenever SMART is enabled, False otherwise.
+    """
+    groups = device_info(device)
+
+    state = {
+        g[1].split(' ', 1)[0]
+        for g in groups if g[0] == 'SMART support'}
+
+    smart_available = 'Available' in state
+    smart_enabled = 'Enabled' in state
+
+    return smart_available, smart_enabled
+
+
+def collect_device_info(device):
+    """Collect basic device information.
+
+    Args:
+        device: (Device) Device in question.
+
+    Yields:
+        (Metric) metrics describing general device information.
+    """
+    values = dict(device_info(device))
+    yield Metric('device_info', {
+        **device.base_labels,
+        **{v: values[k] for k, v in device_info_map.items() if k in values}
+    }, True)
+
+
+def collect_device_health_self_assessment(device):
+    """Collect metric about the device health self assessment.
+
+    Args:
+        device: (Device) Device in question.
+
+    Yields:
+        (Metric) Device health self assessment.
+    """
+    out = smart_ctl('--health', *device.smartctl_select(), check=False)
+
+    self_assessment_passed = bool(self_test_re.search(out))
+
+    yield Metric(
+        'device_smart_healthy', device.base_labels, self_assessment_passed)
+
+
+def collect_ata_metrics(device):
+    # Fetch SMART attributes for the given device.
+    attributes = smart_ctl(
+        '--attributes', *device.smartctl_select()
+    )
+
+    # replace multiple occurrences of whitespace with a single whitespace
+    # so that the CSV Parser recognizes individual columns properly.
+    attributes = re.sub(r'[\t\x20]+', ' ', attributes)
+
+    # Turn smartctl output into a list of lines and skip to the table of
+    # SMART attributes.
+    attribute_lines = attributes.strip().split('\n')[7:]
+
+    # Some attributes have multiple IDs but have the same name.  Don't
+    # yield attributes that already have been reported before.
+    seen = set()
+
+    reader = csv.DictReader(
+        (line.strip() for line in attribute_lines),
+        fieldnames=SmartAttribute._fields[:-1],
+        restkey=SmartAttribute._fields[-1], delimiter=' ')
+    for entry in reader:
+        # We're only interested in the SMART attributes that are
+        # whitelisted here.
+        entry['name'] = entry['name'].lower()
+        if entry['name'] not in smart_attributes_whitelist:
+            continue
+
+        # Ensure that only the numeric parts are fetched from the raw_value.
+        # Attributes such as 194 Temperature_Celsius reported by my SSD
+        # are in the format of "36 (Min/Max 24/40)" which can't be expressed
+        # properly as a prometheus metric.
+        m = re.match(r'^(\d+)', ' '.join(entry['raw_value']))
+        if not m:
+            continue
+        entry['raw_value'] = m.group(1)
+
+        # Some device models report "---" in the threshold value where most
+        # devices would report "000". We do the substitution here because
+        # downstream code expects values to be convertable to integer.
+        if entry['threshold'] == '---':
+            entry['threshold'] = '0'
+
+        if entry['name'] in smart_attributes_whitelist and entry['name'] not in seen:
+            labels = {
+                'name': entry['name'],
+                **device.base_labels,
+            }
+
+            for col in 'value', 'worst', 'threshold', 'raw_value':
+                yield Metric(
+                    'attr_{col}'.format(col=col),
+                    labels, entry[col])
+
+            seen.add(entry['name'])
+
+
+def collect_ata_error_count(device):
+    """Inspect the device error log and report the amount of entries.
+
+    Args:
+        device: (Device) Device in question.
+
+    Yields:
+        (Metric) Device error count.
+    """
+    error_log = smart_ctl(
+        '-l', 'xerror,1', *device.smartctl_select(), check=False)
+
+    m = ata_error_count_re.search(error_log)
+
+    error_count = m.group(1) if m is not None else 0
+
+    yield Metric('device_errors', device.base_labels, error_count)
+
+
+def collect_disks_smart_metrics(wakeup_disks):
+    now = int(datetime.datetime.utcnow().timestamp())
+
+    for device in find_devices():
+        yield Metric('smartctl_run', device.base_labels, now)
+
+        is_active = device_is_active(device)
+
+        yield Metric('device_active', device.base_labels, is_active)
+
+        # Skip further metrics collection to prevent the disk from
+        # spinning up.
+        if not is_active and not wakeup_disks:
+            continue
+
+        yield from collect_device_info(device)
+
+        smart_available, smart_enabled = device_smart_capabilities(device)
+
+        yield Metric(
+            'device_smart_available', device.base_labels, smart_available)
+        yield Metric(
+            'device_smart_enabled', device.base_labels, smart_enabled)
+
+        # Skip further metrics collection here if SMART is disabled
+        # on the device.  Further smartctl invocations would fail
+        # anyways.
+        if not smart_available:
+            continue
+
+        yield from collect_device_health_self_assessment(device)
+
+        if device.type.startswith('sat'):
+            yield from collect_ata_metrics(device)
+
+            yield from collect_ata_error_count(device)
+
+
+def main():
+    parser = argparse.ArgumentParser()
+    parser.add_argument('-s', '--wakeup-disks', dest='wakeup_disks', action='store_true')
+    args = parser.parse_args(sys.argv[1:])
+
+    version_metric = Metric('smartctl_version', {
+        'version': smart_ctl_version()
+    }, True)
+    metric_print_meta(version_metric, 'smartmon_')
+    metric_print(version_metric, 'smartmon_')
+
+    metrics = list(collect_disks_smart_metrics(args.wakeup_disks))
+    metrics.sort(key=lambda i: i.name)
+
+    previous_name = None
+    for m in metrics:
+        if m.name != previous_name:
+            metric_print_meta(m, 'smartmon_')
+
+            previous_name = m.name
+
+        metric_print(m, 'smartmon_')
+
+
+if __name__ == '__main__':
+    main()
diff --git a/roles/monitoring/prometheus/exporter/node/tasks/main.yml b/roles/monitoring/prometheus/exporter/node/tasks/main.yml
index 61e385f7..56903a33 100644
--- a/roles/monitoring/prometheus/exporter/node/tasks/main.yml
+++ b/roles/monitoring/prometheus/exporter/node/tasks/main.yml
@@ -2,7 +2,9 @@
   ## TODO: pin version
 - name: install apt packages
   apt:
-    name: prom-exporter-node
+    name:
+    - prom-exporter-node
+    - moreutils
     state: present
 
 - name: create directory for textfile collector
@@ -34,27 +36,9 @@
 
 - name: create directory for textfile collector scripts
   file:
-    path: /usr/local/lib/prometheus-node-exporter
+    path: /usr/local/share/prometheus-node-exporter
     state: directory
 
-- name: install textfile collector script wrapper
-  copy:
-    content: |
-      #!/bin/bash
-
-      if [ -z "$1" ]; then
-        echo "Please specify which collector script to call!"
-        exit 1
-      fi
-      collector="$1"
-
-      set -e
-      rm -f "/var/lib/prometheus-node-exporter/textfile-collector/$collector.prom".*
-      "/usr/local/lib/prometheus-node-exporter/$collector" > "/var/lib/prometheus-node-exporter/textfile-collector/$collector.prom.$$"
-      mv "/var/lib/prometheus-node-exporter/textfile-collector/$collector.prom.$$" "/var/lib/prometheus-node-exporter/textfile-collector/$collector.prom"
-    dest: /usr/local/lib/prometheus-node-exporter/run-collector
-    mode: 0755
-
 - name: install the apt textfile collector script
   when: ansible_pkg_mgr == "apt"
   vars:
diff --git a/roles/monitoring/prometheus/exporter/node/tasks/textfile_collector_script.yml b/roles/monitoring/prometheus/exporter/node/tasks/textfile_collector_script.yml
index 1a39bb4c..5c068fe7 100644
--- a/roles/monitoring/prometheus/exporter/node/tasks/textfile_collector_script.yml
+++ b/roles/monitoring/prometheus/exporter/node/tasks/textfile_collector_script.yml
@@ -2,7 +2,7 @@
 - name: install the collector script
   copy:
     src: "{{ textfile_collector_name }}"
-    dest: "/usr/local/lib/prometheus-node-exporter/{{ textfile_collector_name }}"
+    dest: "/usr/local/share/prometheus-node-exporter/{{ textfile_collector_name }}"
     mode: 0755
 
 - name: install systemd service units
diff --git a/roles/monitoring/prometheus/exporter/node/templates/textfile-collector-scripts/apt.service.j2 b/roles/monitoring/prometheus/exporter/node/templates/textfile-collector-scripts/apt.service.j2
index b0e9d167..7eca94fb 100644
--- a/roles/monitoring/prometheus/exporter/node/templates/textfile-collector-scripts/apt.service.j2
+++ b/roles/monitoring/prometheus/exporter/node/templates/textfile-collector-scripts/apt.service.j2
@@ -3,7 +3,8 @@ Description=Promethues node exporter textfile collector apt
 
 [Service]
 Type=oneshot
-ExecStart=/usr/local/lib/prometheus-node-exporter/run-collector apt
+Environment=TMPDIR=/var/lib/prometheus-node-exporter/textfile-collector
+ExecStart=bash -c "/usr/local/share/prometheus-node-exporter/apt | sponge /var/lib/prometheus-node-exporter/textfile-collector/apt.prom"
 
 # systemd hardening-options
 AmbientCapabilities=
diff --git a/roles/monitoring/prometheus/exporter/node/templates/textfile-collector-scripts/apt.timer.j2 b/roles/monitoring/prometheus/exporter/node/templates/textfile-collector-scripts/apt.timer.j2
index b8a9c34e..dc473749 100644
--- a/roles/monitoring/prometheus/exporter/node/templates/textfile-collector-scripts/apt.timer.j2
+++ b/roles/monitoring/prometheus/exporter/node/templates/textfile-collector-scripts/apt.timer.j2
@@ -2,9 +2,8 @@
 Description=Promethues node exporter textfile collector apt
 
 [Timer]
-OnBootSec=50s
-OnCalendar=*-*-* *:1/30:17
-AccuracySec=10s
+OnBootSec=10s
+OnUnitActiveSec=15min
 
 [Install]
 WantedBy=timers.target
diff --git a/roles/monitoring/prometheus/exporter/node/templates/textfile-collector-scripts/deleted-libraries.service.j2 b/roles/monitoring/prometheus/exporter/node/templates/textfile-collector-scripts/deleted-libraries.service.j2
index 9dbc822f..7b15e558 100644
--- a/roles/monitoring/prometheus/exporter/node/templates/textfile-collector-scripts/deleted-libraries.service.j2
+++ b/roles/monitoring/prometheus/exporter/node/templates/textfile-collector-scripts/deleted-libraries.service.j2
@@ -3,7 +3,8 @@ Description=Promethues node exporter textfile collector deleted-libraries
 
 [Service]
 Type=oneshot
-ExecStart=/usr/local/lib/prometheus-node-exporter/run-collector deleted-libraries
+Environment=TMPDIR=/var/lib/prometheus-node-exporter/textfile-collector
+ExecStart=bash -c "/usr/local/share/prometheus-node-exporter/deleted-libraries | sponge /var/lib/prometheus-node-exporter/textfile-collector/deleted-libraries.prom"
 
 # systemd hardening-options
 AmbientCapabilities=CAP_SYS_PTRACE
diff --git a/roles/monitoring/prometheus/exporter/node/templates/textfile-collector-scripts/deleted-libraries.timer.j2 b/roles/monitoring/prometheus/exporter/node/templates/textfile-collector-scripts/deleted-libraries.timer.j2
index 1646ac73..c09acecf 100644
--- a/roles/monitoring/prometheus/exporter/node/templates/textfile-collector-scripts/deleted-libraries.timer.j2
+++ b/roles/monitoring/prometheus/exporter/node/templates/textfile-collector-scripts/deleted-libraries.timer.j2
@@ -2,9 +2,8 @@
 Description=Promethues node exporter textfile collector deleted-libraries
 
 [Timer]
-OnBootSec=60s
-OnCalendar=*-*-* *:2/30:22
-AccuracySec=10s
+OnBootSec=20s
+OnUnitActiveSec=15min
 
 [Install]
 WantedBy=timers.target
diff --git a/roles/monitoring/prometheus/exporter/node/templates/textfile-collector-scripts/smartmon.service.j2 b/roles/monitoring/prometheus/exporter/node/templates/textfile-collector-scripts/smartmon.service.j2
new file mode 100644
index 00000000..fc7c9f3f
--- /dev/null
+++ b/roles/monitoring/prometheus/exporter/node/templates/textfile-collector-scripts/smartmon.service.j2
@@ -0,0 +1,29 @@
+[Unit]
+Description=Promethues node exporter textfile collector smartmon
+
+[Service]
+Type=oneshot
+Environment=TMPDIR=/var/lib/prometheus-node-exporter/textfile-collector
+Environment=LC_NUMERIC=C
+ExecStart=bash -c "/usr/local/share/prometheus-node-exporter/smartmon | sponge /var/lib/prometheus-node-exporter/textfile-collector/smartmon.prom"
+
+# systemd hardening-options
+AmbientCapabilities=
+CapabilityBoundingSet=
+LockPersonality=true
+MemoryDenyWriteExecute=true
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectControlGroups=true
+ProtectHome=true
+ProtectKernelModules=true
+ProtectKernelTunables=true
+ProtectSystem=strict
+ReadWritePaths=/var/lib/prometheus-node-exporter/textfile-collector
+RemoveIPC=true
+RestrictNamespaces=true
+RestrictRealtime=true
+SystemCallArchitectures=native
+
+[Install]
+WantedBy=multi-user.target
diff --git a/roles/monitoring/prometheus/exporter/node/templates/textfile-collector-scripts/smartmon.timer.j2 b/roles/monitoring/prometheus/exporter/node/templates/textfile-collector-scripts/smartmon.timer.j2
new file mode 100644
index 00000000..438da6b0
--- /dev/null
+++ b/roles/monitoring/prometheus/exporter/node/templates/textfile-collector-scripts/smartmon.timer.j2
@@ -0,0 +1,13 @@
+[Unit]
+Description=Promethues node exporter textfile collector smartmon
+ConditionPathExists=/usr/sbin/smartctl
+ConditionPathExistsGlob=|/dev/sd*
+ConditionPathExistsGlob=|/dev/hd*
+ConditionPathExistsGlob=|/dev/nvme*
+
+[Timer]
+OnBootSec=30s
+OnUnitActiveSec=15min
+
+[Install]
+WantedBy=timers.target
-- 
cgit v1.2.3


From 063bdb70a8e8353908ca9742e05be8fac65a61bf Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@spreadspace.org>
Date: Sat, 25 Sep 2021 23:36:40 +0200
Subject: move away from exporter-exporter in favor for nginx

---
 chaos-at-home/ch-testvm-prometheus.yml             |  1 +
 inventory/host_vars/ch-testvm-prometheus.yml       |  3 ++
 .../prometheus/exporter/base/defaults/main.yml     |  2 +-
 .../prometheus/exporter/base/handlers/main.yml     |  6 ++--
 .../prometheus/exporter/base/tasks/main.yml        | 30 +++++---------------
 .../exporter/base/templates/nginx-vhost.j2         | 19 +++++++++++++
 .../prometheus/exporter/base/templates/service.j2  | 32 ----------------------
 .../prometheus/exporter/blackbox/handlers/main.yml |  7 ++---
 .../prometheus/exporter/blackbox/tasks/main.yml    | 11 ++++----
 .../prometheus/exporter/ipmi/handlers/main.yml     |  7 ++---
 .../prometheus/exporter/ipmi/tasks/main.yml        | 21 ++++++--------
 roles/monitoring/prometheus/exporter/meta/main.yml | 10 ++++---
 .../prometheus/exporter/mikrotik/handlers/main.yml |  7 ++---
 .../prometheus/exporter/mikrotik/tasks/main.yml    | 10 +++----
 .../prometheus/exporter/node/handlers/main.yml     |  7 ++---
 .../prometheus/exporter/node/tasks/main.yml        | 10 +++----
 .../prometheus/exporter/nut/handlers/main.yml      |  7 ++---
 .../prometheus/exporter/nut/tasks/main.yml         | 14 ++++++----
 .../server/templates/jobs/blackbox/https.j2        |  3 +-
 .../server/templates/jobs/blackbox/ping.j2         |  3 +-
 .../server/templates/jobs/blackbox/ssh.j2          |  3 +-
 .../prometheus/server/templates/jobs/generic.j2    |  5 +---
 .../prometheus/server/templates/jobs/node.j2       |  5 +---
 .../prometheus/server/templates/jobs/nut/ups.j2    |  5 +---
 24 files changed, 92 insertions(+), 136 deletions(-)
 create mode 100644 roles/monitoring/prometheus/exporter/base/templates/nginx-vhost.j2
 delete mode 100644 roles/monitoring/prometheus/exporter/base/templates/service.j2

(limited to 'roles/monitoring/prometheus/exporter/node/tasks/main.yml')

diff --git a/chaos-at-home/ch-testvm-prometheus.yml b/chaos-at-home/ch-testvm-prometheus.yml
index 3fd99d41..c0f33b8f 100644
--- a/chaos-at-home/ch-testvm-prometheus.yml
+++ b/chaos-at-home/ch-testvm-prometheus.yml
@@ -7,6 +7,7 @@
   - role: core/sshd/base
   - role: core/zsh
   - role: core/ntp
+  - role: nginx/base
   - role: apt-repo/spreadspace
   - role: monitoring/prometheus/exporter
   # - role: kubernetes/base
diff --git a/inventory/host_vars/ch-testvm-prometheus.yml b/inventory/host_vars/ch-testvm-prometheus.yml
index e539735f..939fa398 100644
--- a/inventory/host_vars/ch-testvm-prometheus.yml
+++ b/inventory/host_vars/ch-testvm-prometheus.yml
@@ -36,6 +36,9 @@ network:
 spreadspace_apt_repo_components:
   - prometheus
 
+prometheus_exporters_extra:
+  - ipmi
+
 
 containerd_storage:
   type: lvm
diff --git a/roles/monitoring/prometheus/exporter/base/defaults/main.yml b/roles/monitoring/prometheus/exporter/base/defaults/main.yml
index 963763a5..613943d8 100644
--- a/roles/monitoring/prometheus/exporter/base/defaults/main.yml
+++ b/roles/monitoring/prometheus/exporter/base/defaults/main.yml
@@ -1,2 +1,2 @@
 ---
-prometheus_exporter_listen: ":9999"
+prometheus_exporter_listen: "9999"
diff --git a/roles/monitoring/prometheus/exporter/base/handlers/main.yml b/roles/monitoring/prometheus/exporter/base/handlers/main.yml
index ebd760cf..d4e42ca0 100644
--- a/roles/monitoring/prometheus/exporter/base/handlers/main.yml
+++ b/roles/monitoring/prometheus/exporter/base/handlers/main.yml
@@ -1,5 +1,5 @@
 ---
-- name: restart prometheus-exporter-exporter
+- name: reload nginx
   service:
-    name: prometheus-exporter-exporter
-    state: restarted
+    name: nginx
+    state: reloaded
diff --git a/roles/monitoring/prometheus/exporter/base/tasks/main.yml b/roles/monitoring/prometheus/exporter/base/tasks/main.yml
index eeb2a23d..5f42867d 100644
--- a/roles/monitoring/prometheus/exporter/base/tasks/main.yml
+++ b/roles/monitoring/prometheus/exporter/base/tasks/main.yml
@@ -6,17 +6,6 @@
     - spreadspace_apt_repo_components is defined
     - "'prometheus' in spreadspace_apt_repo_components"
 
-  ## TODO: pin version
-- name: install apt packages
-  apt:
-    name: prom-exporter-exporter
-    state: present
-
-- name: create configuration directories
-  file:
-    path: /etc/prometheus/exporter/exporter
-    state: directory
-
 - name: add user for prometheus-exporter
   user:
     name: prometheus-exporter
@@ -27,15 +16,10 @@
 - name: create TLS certificate and key
   import_tasks: tls.yml
 
-- name: generate systemd service unit
-  template:
-    src: service.j2
-    dest: /etc/systemd/system/prometheus-exporter-exporter.service
-  notify: restart prometheus-exporter-exporter
-
-- name: make sure prometheus-exporter-exporter is enabled and started
-  systemd:
-    name: prometheus-exporter-exporter.service
-    daemon_reload: yes
-    state: started
-    enabled: yes
+- name: configure nginx vhost
+  import_role:
+    name: nginx/vhost
+  vars:
+    nginx_vhost:
+      name: prometheus-exporter
+      content: "{{ lookup('template', 'nginx-vhost.j2') }}"
diff --git a/roles/monitoring/prometheus/exporter/base/templates/nginx-vhost.j2 b/roles/monitoring/prometheus/exporter/base/templates/nginx-vhost.j2
new file mode 100644
index 00000000..70e65b29
--- /dev/null
+++ b/roles/monitoring/prometheus/exporter/base/templates/nginx-vhost.j2
@@ -0,0 +1,19 @@
+server {
+    listen {{ prometheus_exporter_listen }} ssl;
+    server_name _;
+
+    ssl_certificate /etc/ssl/prometheus/exporter/crt.pem;
+    ssl_certificate_key /etc/ssl/prometheus/exporter/key.pem;
+    ssl_client_certificate /etc/ssl/prometheus/ca-crt.pem;
+    ssl_verify_client on;
+
+    root /nonexistent;
+
+    location = / {
+        return 404 'please specify the exporter you want to reach!';
+    }
+
+    include snippets/proxy-nobuff.conf;
+
+    include /etc/prometheus/exporter/*.locations;
+}
diff --git a/roles/monitoring/prometheus/exporter/base/templates/service.j2 b/roles/monitoring/prometheus/exporter/base/templates/service.j2
deleted file mode 100644
index 3d44744a..00000000
--- a/roles/monitoring/prometheus/exporter/base/templates/service.j2
+++ /dev/null
@@ -1,32 +0,0 @@
-[Unit]
-Description=Prometheus exporter proxy
-
-[Service]
-Restart=always
-User=prometheus-exporter
-ExecStart=/usr/bin/prometheus-exporter-exporter -config.dirs=/etc/prometheus/exporter/exporter -config.file="" -web.listen-address="" -web.tls.listen-address="{{ prometheus_exporter_listen }}" -web.tls.cert="/etc/ssl/prometheus/exporter/crt.pem" -web.tls.key="/etc/ssl/prometheus/exporter/key.pem" --web.tls.ca="/etc/ssl/prometheus/ca-crt.pem" -web.tls.verify
-{# TODO: implement reloading once the exporter_exporter supports this #}
-
-# systemd hardening-options
-AmbientCapabilities=
-CapabilityBoundingSet=
-DeviceAllow=/dev/null rw
-DevicePolicy=strict
-LockPersonality=true
-MemoryDenyWriteExecute=true
-NoNewPrivileges=true
-PrivateDevices=true
-PrivateTmp=true
-PrivateUsers=true
-ProtectControlGroups=true
-ProtectHome=true
-ProtectKernelModules=true
-ProtectKernelTunables=true
-ProtectSystem=strict
-RemoveIPC=true
-RestrictNamespaces=true
-RestrictRealtime=true
-SystemCallArchitectures=native
-
-[Install]
-WantedBy=multi-user.target
diff --git a/roles/monitoring/prometheus/exporter/blackbox/handlers/main.yml b/roles/monitoring/prometheus/exporter/blackbox/handlers/main.yml
index 99a416e2..12250769 100644
--- a/roles/monitoring/prometheus/exporter/blackbox/handlers/main.yml
+++ b/roles/monitoring/prometheus/exporter/blackbox/handlers/main.yml
@@ -9,8 +9,7 @@
     name: prometheus-blackbox-exporter
     state: reloaded
 
-- name: reload prometheus-exporter-exporter
+- name: reload nginx
   service:
-    name: prometheus-exporter-exporter
-    ## TODO: implement reload once exporter_exporter supports this...
-    state: restarted
+    name: nginx
+    state: reloaded
diff --git a/roles/monitoring/prometheus/exporter/blackbox/tasks/main.yml b/roles/monitoring/prometheus/exporter/blackbox/tasks/main.yml
index 782c3561..f9793df6 100644
--- a/roles/monitoring/prometheus/exporter/blackbox/tasks/main.yml
+++ b/roles/monitoring/prometheus/exporter/blackbox/tasks/main.yml
@@ -32,9 +32,8 @@
 - name: register exporter
   copy:
     content: |
-      method: http
-      http:
-        port: 9115
-        path: /probe
-    dest: /etc/prometheus/exporter/exporter/blackbox.yml
-  notify: reload prometheus-exporter-exporter
+      location = /blackbox {
+          proxy_pass http://127.0.0.1:9115/probe;
+      }
+    dest: /etc/prometheus/exporter/blackbox.locations
+  notify: reload nginx
diff --git a/roles/monitoring/prometheus/exporter/ipmi/handlers/main.yml b/roles/monitoring/prometheus/exporter/ipmi/handlers/main.yml
index 40a945ae..a8eb55b3 100644
--- a/roles/monitoring/prometheus/exporter/ipmi/handlers/main.yml
+++ b/roles/monitoring/prometheus/exporter/ipmi/handlers/main.yml
@@ -9,8 +9,7 @@
     name: prometheus-ipmi-exporter
     state: reloaded
 
-- name: reload prometheus-exporter-exporter
+- name: reload nginx
   service:
-    name: prometheus-exporter-exporter
-    ## TODO: implement reload once exporter_exporter supports this...
-    state: restarted
+    name: nginx
+    state: reloaded
diff --git a/roles/monitoring/prometheus/exporter/ipmi/tasks/main.yml b/roles/monitoring/prometheus/exporter/ipmi/tasks/main.yml
index 9e63f692..91318f16 100644
--- a/roles/monitoring/prometheus/exporter/ipmi/tasks/main.yml
+++ b/roles/monitoring/prometheus/exporter/ipmi/tasks/main.yml
@@ -30,18 +30,13 @@
     enabled: yes
 
 - name: register exporter
-  loop:
-  - name: local
-    path: /metrics
-  - name: remote
-    path: /ipmi
-  loop_control:
-    label: "{{ item.name }}"
   copy:
     content: |
-      method: http
-      http:
-        port: 9290
-        path: {{ item.path }}
-    dest: "/etc/prometheus/exporter/exporter/ipmi-{{ item.name }}.yml"
-  notify: reload prometheus-exporter-exporter
+      location = /ipmi {
+          proxy_pass http://127.0.0.1:9290/metrics;
+      }
+      location = /ipmi/remote {
+          proxy_pass http://127.0.0.1:9290/ipmi;
+      }
+    dest: /etc/prometheus/exporter/ipmi.locations
+  notify: reload nginx
diff --git a/roles/monitoring/prometheus/exporter/meta/main.yml b/roles/monitoring/prometheus/exporter/meta/main.yml
index 22131422..68fce6cb 100644
--- a/roles/monitoring/prometheus/exporter/meta/main.yml
+++ b/roles/monitoring/prometheus/exporter/meta/main.yml
@@ -1,11 +1,13 @@
 ---
 dependencies:
   - role: monitoring/prometheus/exporter/base
-  - role: monitoring/prometheus/exporter/node
-    when: "'node' in (prometheus_exporters_default | union(prometheus_exporters_extra))"
   - role: monitoring/prometheus/exporter/blackbox
     when: "'blackbox' in (prometheus_exporters_default | union(prometheus_exporters_extra))"
-  - role: monitoring/prometheus/exporter/nut
-    when: "'nut' in (prometheus_exporters_default | union(prometheus_exporters_extra))"
+  - role: monitoring/prometheus/exporter/ipmi
+    when: "'ipmi' in (prometheus_exporters_default | union(prometheus_exporters_extra))"
   - role: monitoring/prometheus/exporter/mikrotik
     when: "'mikrotik' in (prometheus_exporters_default | union(prometheus_exporters_extra))"
+  - role: monitoring/prometheus/exporter/node
+    when: "'node' in (prometheus_exporters_default | union(prometheus_exporters_extra))"
+  - role: monitoring/prometheus/exporter/nut
+    when: "'nut' in (prometheus_exporters_default | union(prometheus_exporters_extra))"
diff --git a/roles/monitoring/prometheus/exporter/mikrotik/handlers/main.yml b/roles/monitoring/prometheus/exporter/mikrotik/handlers/main.yml
index cb85d0d9..c5844220 100644
--- a/roles/monitoring/prometheus/exporter/mikrotik/handlers/main.yml
+++ b/roles/monitoring/prometheus/exporter/mikrotik/handlers/main.yml
@@ -4,8 +4,7 @@
     name: prometheus-mikrotik-exporter
     state: restarted
 
-- name: reload prometheus-exporter-exporter
+- name: reload nginx
   service:
-    name: prometheus-exporter-exporter
-    ## TODO: implement reload once exporter_exporter supports this...
-    state: restarted
+    name: nginx
+    state: reloaded
diff --git a/roles/monitoring/prometheus/exporter/mikrotik/tasks/main.yml b/roles/monitoring/prometheus/exporter/mikrotik/tasks/main.yml
index 07219c68..72c78e4a 100644
--- a/roles/monitoring/prometheus/exporter/mikrotik/tasks/main.yml
+++ b/roles/monitoring/prometheus/exporter/mikrotik/tasks/main.yml
@@ -35,8 +35,8 @@
 - name: register exporter
   copy:
     content: |
-      method: http
-      http:
-        port: 9436
-    dest: /etc/prometheus/exporter/exporter/mikrotik.yml
-  notify: reload prometheus-exporter-exporter
+      location = /mikrotik {
+          proxy_pass http://127.0.0.1:9436/metrics;
+      }
+    dest: /etc/prometheus/exporter/mikrotik.locations
+  notify: reload nginx
diff --git a/roles/monitoring/prometheus/exporter/node/handlers/main.yml b/roles/monitoring/prometheus/exporter/node/handlers/main.yml
index 3e1b2000..56056ea6 100644
--- a/roles/monitoring/prometheus/exporter/node/handlers/main.yml
+++ b/roles/monitoring/prometheus/exporter/node/handlers/main.yml
@@ -4,8 +4,7 @@
     name: prometheus-node-exporter
     state: restarted
 
-- name: reload prometheus-exporter-exporter
+- name: reload nginx
   service:
-    name: prometheus-exporter-exporter
-    ## TODO: implement reload once exporter_exporter supports this...
-    state: restarted
+    name: nginx
+    state: reloaded
diff --git a/roles/monitoring/prometheus/exporter/node/tasks/main.yml b/roles/monitoring/prometheus/exporter/node/tasks/main.yml
index 56903a33..2811c759 100644
--- a/roles/monitoring/prometheus/exporter/node/tasks/main.yml
+++ b/roles/monitoring/prometheus/exporter/node/tasks/main.yml
@@ -28,11 +28,11 @@
 - name: register exporter
   copy:
     content: |
-      method: http
-      http:
-        port: 9100
-    dest: /etc/prometheus/exporter/exporter/node.yml
-  notify: reload prometheus-exporter-exporter
+      location = /node {
+          proxy_pass http://127.0.0.1:9100/metrics;
+      }
+    dest: /etc/prometheus/exporter/node.locations
+  notify: reload nginx
 
 - name: create directory for textfile collector scripts
   file:
diff --git a/roles/monitoring/prometheus/exporter/nut/handlers/main.yml b/roles/monitoring/prometheus/exporter/nut/handlers/main.yml
index 6e10f43b..edd87ed5 100644
--- a/roles/monitoring/prometheus/exporter/nut/handlers/main.yml
+++ b/roles/monitoring/prometheus/exporter/nut/handlers/main.yml
@@ -4,8 +4,7 @@
     name: prometheus-nut-exporter
     state: restarted
 
-- name: reload prometheus-exporter-exporter
+- name: reload ngnix
   service:
-    name: prometheus-exporter-exporter
-    ## TODO: implement reload once exporter_exporter supports this...
-    state: restarted
+    name: nginx
+    state: reloaded
diff --git a/roles/monitoring/prometheus/exporter/nut/tasks/main.yml b/roles/monitoring/prometheus/exporter/nut/tasks/main.yml
index 8245feae..f602472d 100644
--- a/roles/monitoring/prometheus/exporter/nut/tasks/main.yml
+++ b/roles/monitoring/prometheus/exporter/nut/tasks/main.yml
@@ -21,9 +21,11 @@
 - name: register exporter
   copy:
     content: |
-      method: http
-      http:
-        port: 9199
-        path: /ups_metrics
-    dest: /etc/prometheus/exporter/exporter/nut.yml
-  notify: reload prometheus-exporter-exporter
+      location = /nut {
+          proxy_pass http://127.0.0.1:9199/metrics;
+      }
+      location = /nut/ups {
+          proxy_pass http://127.0.0.1:9199/ups_metrics;
+      }
+    dest: /etc/prometheus/exporter/nut.locations
+  notify: reload nginx
diff --git a/roles/monitoring/prometheus/server/templates/jobs/blackbox/https.j2 b/roles/monitoring/prometheus/server/templates/jobs/blackbox/https.j2
index 98a64121..86ff88dd 100644
--- a/roles/monitoring/prometheus/server/templates/jobs/blackbox/https.j2
+++ b/roles/monitoring/prometheus/server/templates/jobs/blackbox/https.j2
@@ -1,8 +1,7 @@
   - job_name: '{{ job }}'
-    metrics_path: /proxy
+    metrics_path: /blackbox
     params:
       module:
-      - blackbox
       - http_tls_2xx
     scheme: https
     tls_config:
diff --git a/roles/monitoring/prometheus/server/templates/jobs/blackbox/ping.j2 b/roles/monitoring/prometheus/server/templates/jobs/blackbox/ping.j2
index 736ffec1..2d3889d2 100644
--- a/roles/monitoring/prometheus/server/templates/jobs/blackbox/ping.j2
+++ b/roles/monitoring/prometheus/server/templates/jobs/blackbox/ping.j2
@@ -1,8 +1,7 @@
   - job_name: '{{ job }}'
-    metrics_path: /proxy
+    metrics_path: /blackbox
     params:
       module:
-      - blackbox
       - icmp
     scheme: https
     tls_config:
diff --git a/roles/monitoring/prometheus/server/templates/jobs/blackbox/ssh.j2 b/roles/monitoring/prometheus/server/templates/jobs/blackbox/ssh.j2
index 166f37ad..97565673 100644
--- a/roles/monitoring/prometheus/server/templates/jobs/blackbox/ssh.j2
+++ b/roles/monitoring/prometheus/server/templates/jobs/blackbox/ssh.j2
@@ -1,8 +1,7 @@
   - job_name: '{{ job }}'
-    metrics_path: /proxy
+    metrics_path: /blackbox
     params:
       module:
-      - blackbox
       - ssh_banner
     scheme: https
     tls_config:
diff --git a/roles/monitoring/prometheus/server/templates/jobs/generic.j2 b/roles/monitoring/prometheus/server/templates/jobs/generic.j2
index b155c5f7..65a95007 100644
--- a/roles/monitoring/prometheus/server/templates/jobs/generic.j2
+++ b/roles/monitoring/prometheus/server/templates/jobs/generic.j2
@@ -1,8 +1,5 @@
   - job_name: '{{ job }}'
-    metrics_path: /proxy
-    params:
-      module:
-      - {{ job }}
+    metrics_path: /{{ job }}
     scheme: https
     tls_config:
       ca_file: /etc/ssl/prometheus/ca-crt.pem
diff --git a/roles/monitoring/prometheus/server/templates/jobs/node.j2 b/roles/monitoring/prometheus/server/templates/jobs/node.j2
index ba9eab31..1b14e1f6 100644
--- a/roles/monitoring/prometheus/server/templates/jobs/node.j2
+++ b/roles/monitoring/prometheus/server/templates/jobs/node.j2
@@ -1,8 +1,5 @@
   - job_name: '{{ job }}'
-    metrics_path: /proxy
-    params:
-      module:
-      - {{ job }}
+    metrics_path: /{{ job }}
     scheme: https
     tls_config:
       ca_file: /etc/ssl/prometheus/ca-crt.pem
diff --git a/roles/monitoring/prometheus/server/templates/jobs/nut/ups.j2 b/roles/monitoring/prometheus/server/templates/jobs/nut/ups.j2
index 3a2c5c62..0cf4ae4e 100644
--- a/roles/monitoring/prometheus/server/templates/jobs/nut/ups.j2
+++ b/roles/monitoring/prometheus/server/templates/jobs/nut/ups.j2
@@ -1,8 +1,5 @@
   - job_name: '{{ job }}'
-    metrics_path: /proxy
-    params:
-      module:
-      - nut
+    metrics_path: /nut/ups
     scheme: https
     tls_config:
       ca_file: /etc/ssl/prometheus/ca-crt.pem
-- 
cgit v1.2.3