From 8bcf938a7b95536c66a34b043915615df489f243 Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@spreadspace.org>
Date: Thu, 3 Jun 2021 22:55:21 +0200
Subject: prometheus: fix blackbox exporter icmp probes

---
 .../monitoring/prometheus/exporter/blackbox/defaults/main.yml  | 10 +++++++---
 .../prometheus/exporter/blackbox/templates/service.j2          |  6 +++++-
 2 files changed, 12 insertions(+), 4 deletions(-)

(limited to 'roles/monitoring/prometheus/exporter')

diff --git a/roles/monitoring/prometheus/exporter/blackbox/defaults/main.yml b/roles/monitoring/prometheus/exporter/blackbox/defaults/main.yml
index fcf66555..4e7d8d9a 100644
--- a/roles/monitoring/prometheus/exporter/blackbox/defaults/main.yml
+++ b/roles/monitoring/prometheus/exporter/blackbox/defaults/main.yml
@@ -1,10 +1,8 @@
 ---
 prometheus_exporter_blackbox_modules:
-  icmp:
-    prober: icmp
   tcp_connect:
     prober: tcp
-  tcp_tls:
+  tcp_tls_connect:
     prober: tcp
     tcp:
       tls: true
@@ -12,6 +10,12 @@ prometheus_exporter_blackbox_modules:
         insecure_skip_verify: true
   http_2xx:
     prober: http
+  http_tls_2xx:
+    prober: http
+    http:
+      fail_if_not_ssl: true
+      tls_config:
+        insecure_skip_verify: true
   ssh_banner:
     prober: tcp
     tcp:
diff --git a/roles/monitoring/prometheus/exporter/blackbox/templates/service.j2 b/roles/monitoring/prometheus/exporter/blackbox/templates/service.j2
index c9c5712c..a8a91d0b 100644
--- a/roles/monitoring/prometheus/exporter/blackbox/templates/service.j2
+++ b/roles/monitoring/prometheus/exporter/blackbox/templates/service.j2
@@ -8,8 +8,13 @@ ExecStart=/usr/bin/prometheus-blackbox-exporter --web.listen-address="127.0.0.1:
 ExecReload=/bin/kill -HUP $MAINPID
 
 # systemd hardening-options
+{% if prometheus_exporter_blackbox_modules | combine(prometheus_exporter_blackbox_modules_extra) | dict2items | selectattr('value.prober', 'eq', 'icmp') | length > 0 %}
 AmbientCapabilities=CAP_NET_RAW
 CapabilityBoundingSet=CAP_NET_RAW
+{% else %}
+AmbientCapabilities=
+CapabilityBoundingSet=
+{% endif %}
 DeviceAllow=/dev/null rw
 DevicePolicy=strict
 LockPersonality=true
@@ -17,7 +22,6 @@ MemoryDenyWriteExecute=true
 NoNewPrivileges=true
 PrivateDevices=true
 PrivateTmp=true
-PrivateUsers=true
 ProtectControlGroups=true
 ProtectHome=true
 ProtectKernelModules=true
-- 
cgit v1.2.3