Add InfluxDB role

roles/autossh/defaults/main.yaml

@@ -0,0 +1,17 @@
+---
+autossh_package_name: autossh
+autossh_package_state: present
+
+autossh_service_name: autossh@.service
+autossh_systemd_unit_path: /etc/systemd/system/autossh@.service
+
+autossh_etc_path: /etc/autossh
+autossh_run_path: /run/autossh
+
+autossh_user: autossh
+autossh_group: autossh
+autossh_user_state: present
+autossh_user_comment: AutoSSH
+autossh_user_home: "/home/{{ autossh_user }}"
+autossh_user_password: "!"
+autossh_user_shell: /usr/sbin/nologin

roles/autossh/handlers/main.yaml

@@ -0,0 +1,20 @@
+---
+- name: autossh daemon-reload
+  systemd:
+    daemon_reload: yes
+
+- name: reload autossh
+  service:
+    name: "{{ autossh_service_name }}"
+    state: reloaded
+
+- name: restart autossh
+  service:
+    name: "{{ autossh_service_name }}"
+    state: restarted
+
+- name: reload autossh instances
+  service:
+    name: "autossh@{{ item.name }}.service"
+    state: restarted
+  loop: "{{ autossh_config | default([]) }}"

roles/autossh/tasks/keys.yaml

@@ -0,0 +1,28 @@
+---
+- set_fact:
+    key_path: "{{ autossh_user_home }}/.ssh/{{ item }}"
+    
+- name: "install private key ({{ item }})"
+  copy:
+    dest: "{{ autossh_user_home }}/.ssh/{{ item }}"
+    content: "{{ lookup('vars', 'autossh_private_key_' + item) }}"
+    owner: "{{ autossh_user }}"
+    group: "{{ autossh_group }}"
+    mode: 0600
+  when: lookup('vars', 'autossh_private_key_' + item, default='') | length
+
+- name: "determine if private key exists ({{ item }})"
+  stat:
+    path: "{{ key_path }}"
+  register: priv_key
+
+- name: "determine if public key exists ({{ item }}.pub)"
+  stat:
+    path: "{{ key_path }}.pub"
+  register: pub_key
+
+- name: "derive public key ({{ item }})"
+  shell: "ssh-keygen -y -f {{ key_path }} > {{ key_path }}.pub"
+  when:
+    - not pub_key.stat.exists
+    - priv_key.stat.exists

roles/autossh/tasks/main.yaml

@@ -0,0 +1,80 @@
+---
+- name: "create {{ autossh_user }} user"
+  user:
+    name: "{{ autossh_user }}"
+    comment: "{{ autossh_user_comment }}"
+    password: "{{ autossh_user_password }}"
+    #password_lock: yes
+    shell: "{{ autossh_user_shell }}"
+    generate_ssh_key: yes
+    state: "{{ autossh_user_state }}"
+    system: yes
+    skeleton: /dev/null
+
+- name: "manage keys {{ item }}"
+  include: keys.yaml
+  loop:
+    - id_dsa
+    - id_ecdsa
+    - id_ed25519
+    - id_rsa
+
+- name: create directories
+  file:
+    path: "{{ item }}"
+    owner: root
+    group: root
+    mode: 0755
+    state: directory
+  loop:
+    - "{{ autossh_etc_path }}"
+    - "{{ autossh_run_path }}"
+
+- name: install package
+  package:
+    name: "{{ autossh_package_name }}"
+    state: "{{ autossh_package_state }}"
+- name: manage keys "{{ item }}"
+  include: keys.yaml
+  loop:
+    - id_dsa
+    - id_ecdsa
+    - id_ed25519
+    - id_rsa
+
+- name: manage authorized keys
+  authorized_key:
+    user: "{{ autossh_user }}"
+    key: "{{ item.key }}"
+    comment: "{{ item.comment | default(omit) }}"
+    state: "{{ item.state | default('present') }}"
+  loop: "{{ autossh_authorized_keys | default([]) }}"
+
+- name: configure systemd unit
+  template:
+    src: autossh.service.j2
+    dest: "{{ autossh_systemd_unit_path }}"
+    owner: root
+    group: root
+    mode: 0644
+  notify:
+    - reload autossh instances
+    - autossh daemon-reload
+  when: ansible_service_mgr == 'systemd'
+
+- name: configure autossh tunnels
+  template:
+    src: autossh.j2
+    dest: "{{ autossh_etc_path }}/{{ item.name }}"
+    owner: root
+    group: root
+    mode: 0644
+  loop: "{{ autossh_config | default([]) }}"
+  notify: reload autossh instances
+
+- name: manage services
+  service:
+    name: "autossh@{{ item.name }}.service"
+    state: "{{ item.state | default('started') }}"
+    enabled: "{{ item.enabled | default(true) }}"
+  loop: "{{ autossh_config | default([]) }}"

roles/autossh/templates/autossh.j2

@@ -0,0 +1,8 @@
+# {{ ansible_managed }}
+
+AUTOSSH_POLL=60
+AUTOSSH_FIRST_POLL=30
+AUTOSSH_GATETIME=0
+AUTOSSH_PORT=22000
+SSH_OPTIONS="{{ item.options | join(' ') }}"
+SSH_HOST={{ item.host }}

roles/autossh/templates/autossh.service.j2

@@ -0,0 +1,19 @@
+# {{ ansible_managed }}
+
+[Unit]
+Description=autossh %I
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+Type=simple
+User={{ autossh_user }}
+EnvironmentFile={{ autossh_etc_path }}/%i
+ExecStart=
+ExecStart=/usr/bin/autossh -C -q -l {{ autossh_user }} -N -o ExitOnForwardFailure=yes -o ServerAliveInterval=15 -o ServerAliveCountMax=3 -o StrictHostKeyChecking=no $SSH_OPTIONS $SSH_HOST
+Restart=always
+RestartSec=60
+PIDFile={{ autossh_run_path }}/%i.pid
+
+[Install]
+WantedBy=multi-user.target

roles/grafana/defaults/main.yaml

@@ -0,0 +1,23 @@
+---
+grafana_package_version:
+grafana_package_name: "grafana{{grafana_package_version}}"
+grafana_package_state: present
+
+grafana_service_name: grafana-server.service
+grafana_service_state: started
+grafana_service_enabled: yes
+
+grafana_etc_path: /etc/grafana
+grafana_config_path: "{{ grafana_etc_path }}/grafana.ini"
+
+grafana_domain: "stats.{{ ansible_domain }}"
+grafana_port: "stats.{{ ansible_domain }}"
+grafana_user: grafana
+grafana_group: grafana
+
+grafana_config:
+  server:
+    domain: "{{ grafana_domain }}"
+    root_url: "https://{{ grafana_domain }}"
+    http_addr: localhost
+    http_port: "{{ grafana_port }}"

roles/grafana/handlers/main.yaml

@@ -0,0 +1,11 @@
+---
+- name: grafana daemon-reload
+  systemd:
+    name: "{{ grafana_service_name }}"
+    daemon_reload: yes
+    state: restarted
+
+- name: restart grafana
+  service:
+    name: "{{ grafana_service_name }}"
+    state: restarted

roles/grafana/tasks/Debian.yaml

@@ -0,0 +1,12 @@
+---
+- name: add grafana apt key
+  apt_key:
+    url: https://packages.grafana.com/gpg.key
+    state: present
+
+- name: configure apt repository
+  apt_repository:
+    repo: "deb https://packages.grafana.com/oss/deb stable main"
+    filename: influxdb
+    update_cache: yes
+    state: present

roles/grafana/tasks/main.yaml

@@ -0,0 +1,55 @@
+---
+- name: gather os specific variables
+  include_vars: "{{ lookup('first_found', possible_files) }}"
+  vars:
+    possible_files:
+      files:
+        - "{{ ansible_distribution }}-{{ ansible_distribution_version }}.yaml"
+        - "{{ ansible_distribution }}.yaml"
+        - "{{ ansible_os_family }}.yaml"
+        - "default.yaml"
+      paths:
+        - vars
+
+- name: include os specific tasks
+  include_tasks: "{{ lookup('first_found', possible_files) }}"
+  vars:
+    possible_files:
+      files:
+        - "{{ ansible_distribution }}-{{ ansible_distribution_version }}.yaml"
+        - "{{ ansible_distribution }}.yaml"
+        - "{{ ansible_os_family }}.yaml"
+        - "default.yaml"
+      paths:
+        - tasks
+
+- name: install package
+  package:
+    name: "{{ grafana_package_name }}"
+    state: "{{ grafana_package_state }}"
+
+- name: "create {{ grafana_etc_path }}"
+  file:
+    path: "{{ grafana_etc_path }}"
+    owner: root
+    group: root
+    mode: 0755
+
+- name: configure
+  template:
+    src: grafana.ini.j2
+    dest: "{{ grafana_config_path }}"
+    owner: root
+    group: "{{ grafana_group }}"
+    mode: 0640
+  notify: restart grafana
+
+- name: manage service
+  service:
+    name: "{{ grafana_service_name }}"
+    state: "{{ grafana_service_state }}"
+    enabled: "{{ grafana_service_enabled }}"
+
+- name: configure nginx
+  include: nginx.yaml
+  when: "'nginx' in ansible_play_role_names"

roles/grafana/tasks/nginx.yaml

@@ -0,0 +1,17 @@
+- name: configure nginx
+  template:
+    src: nginx.conf.j2
+    dest: /etc/nginx/sites-available/grafana
+    owner: root
+    group: root
+    mode: 0644
+  notify: reload nginx
+
+- name: activate site
+  file:
+    src: /etc/nginx/sites-available/grafana
+    dest: /etc/nginx/sites-enabled/grafana
+    owner: root
+    group: root
+    state: link
+  notify: reload nginx

roles/grafana/templates/grafana.ini.j2

@@ -0,0 +1,22 @@
+{%- macro ini_scalar(v) -%}
+{% if v is sameas True or v is sameas False %}
+{{ v | bool | lower }}{% if seq %},{% endif %}
+{% elif v is sameas None %}
+{{ "" }}
+{% else %}
+{{ v }}
+{%- endif %}
+{%- endmacro -%}
+
+{%- macro render_config(config = {}) -%}
+{% for s, sc in config.items() | default({}) %}
+[{{ s }}]
+{% for k, v in sc.items() | default({}) %}
+{{ k }} = {{ ini_scalar(v) }}
+{% endfor %}
+{% endfor %}
+{%- endmacro -%}
+
+# {{ ansible_managed }}
+
+{{ render_config(grafana_config) }}

roles/grafana/templates/nginx.conf.j2

@@ -0,0 +1,44 @@
+server {
+    listen 80;
+{% if ansible_all_ipv6_addresses | length %}
+    listen [::]:80;
+{% endif %}
+    server_name {{ grafana_domain }};
+
+    location /.well-known/acme-challenge/ {
+        root /var/www/.acme-challenge;
+        try_files $uri =404;
+    }
+
+{% if grafana_ssl_enabled is defined and
+      grafana_ssl_enabled %}
+    location / {
+        return 301 https://$server_name$request_uri;
+    }
+{% endif %}
+}
+
+{% if grafana_ssl_enabled is defined and
+      grafana_ssl_enabled %}
+server {
+    listen 443 ssl;
+{% if ansible_all_ipv6_addresses | length %}
+    listen [::]:443 ssl;
+{% endif %}
+    server_name {{ grafana_domain }};
+
+{% if grafana_ssl_certificate is defined %}
+    ssl_certificate {{ grafana_ssl_certificate }};
+{% endif %}
+{% if grafana_ssl_certificate_key is defined %}
+    ssl_certificate_key {{ grafana_ssl_certificate_key }};
+{% endif %}
+{% if grafana_ssl_dhparam is defined %}
+    ssl_dhparam {{ grafana_ssl_dhparam }};
+{% endif %}
+
+    location / {
+        proxy_pass http://localhost:{{ grafana_port }};
+    }
+}
+{% endif %}

roles/grafana/vars/default.yaml

@@ -0,0 +1 @@
+---

roles/influxdb/defaults/main.yaml

@@ -0,0 +1,20 @@
+---
+influxdb_package_name: influxdb
+influxdb_package_state: present
+
+influxdb_service_name: influxdb.service
+influxdb_service_state: started
+influxdb_service_enabled: yes
+
+influxdb_config:
+  reporting-disabled: yes
+  meta:
+    dir: /var/lib/influxdb/meta
+  data:
+    dir: /var/lib/influxdb/data
+    wal-dir: /var/lib/influxdb/wal
+    series-id-set-cache-size: 100
+    index-version: tsi1
+    query-log-enabled: no
+  http:
+    log-enabled: no

roles/influxdb/handlers/main.yaml

@@ -0,0 +1,14 @@
+---
+- name: reload influxdb
+  service:
+    name: "{{ influxdb_service_name }}"
+    state: restarted
+  when: influxdb_service_enabled
+
+- name: influxdb daemon-reload
+  systemd:
+    name: "{{ influxdb_service_name }}"
+    daemon_reload: yes
+    state: restarted
+
+# vim:ft=yaml.ansible:

roles/influxdb/tasks/Debian.yaml

@@ -0,0 +1,12 @@
+---
+- name: add influx apt key
+  apt_key:
+    url: https://repos.influxdata.com/influxdb.key
+    state: present
+
+- name: configure apt repository
+  apt_repository:
+    repo: "deb https://repos.influxdata.com/{{ ansible_distribution | lower }} {{ ansible_distribution_release }} stable"
+    filename: influxdb
+    update_cache: yes
+    state: present

roles/influxdb/tasks/main.yaml

@@ -0,0 +1,44 @@
+---
+- name: gather os specific variables
+  include_vars: "{{ lookup('first_found', possible_files) }}"
+  vars:
+    possible_files:
+      files:
+        - "{{ ansible_distribution }}-{{ ansible_distribution_version }}.yaml"
+        - "{{ ansible_distribution }}.yaml"
+        - "{{ ansible_os_family }}.yaml"
+        - "default.yaml"
+      paths:
+        - vars
+
+- name: include os specific tasks
+  include_tasks: "{{ lookup('first_found', possible_files) }}"
+  vars:
+    possible_files:
+      files:
+        - "{{ ansible_distribution }}-{{ ansible_distribution_version }}.yaml"
+        - "{{ ansible_distribution }}.yaml"
+        - "{{ ansible_os_family }}.yaml"
+        - "default.yaml"
+      paths:
+        - tasks
+
+- name: install package
+  package:
+    name: "{{ influxdb_package_name }}"
+    state: "{{ influxdb_package_state }}"
+
+- name: configure
+  template:
+    src: influxdb.conf.j2
+    dest: /etc/influxdb/influxdb.conf
+    owner: root
+    group: root
+    mode: 0644
+  notify: reload influxdb
+
+- name: manage service
+  service:
+    name: "{{ influxdb_service_name }}"
+    state: "{{ influxdb_service_state }}"
+    enabled: "{{ influxdb_service_enabled }}"

roles/influxdb/templates/influxdb.conf.j2

@@ -0,0 +1,38 @@
+{%- macro toml_scalar(v, seq=False) -%}
+{% if v is string %}
+  "{{ v | quote }}"{% if seq %},{% endif %}
+{% elif v is sameas True or v is sameas False %}
+  {{ v | bool | lower }}{% if seq %},{% endif %}
+{% elif v is sameas None %}
+  ""{% if seq %},{% endif %}
+{% elif v is number %}
+  {{ v }}{% if seq %},{% endif %}
+{% endif %}
+{%- endmacro -%}
+
+{%- macro render_section(config = {}) -%}
+{% for k, v in config.items() | default({}) %}
+{% if v is mapping %}
+[{{ k }}]
+{{ render_section(v) }}
+{% elif v is string %}
+{{ k }} = "{{ v | quote }}"
+{% elif v is sameas True or v is sameas False %}
+{{ k }} = {{ v | bool | lower }}
+{% elif v is sameas None %}
+{{ k }} = ""
+{% elif v is number %}
+{{ k }} = {{ v }}
+{% elif v is sequence %}
+{{ k }} = [
+{% for i in v | default([]) %}
+  {{ toml_scalar(i, seq=True) }}
+{% endfor %}
+]
+{% endif %}
+{% endfor %}
+{%- endmacro -%}
+
+# {{ ansible_managed }}
+
+{{ render_section(influxdb_config) }}

roles/influxdb/vars/default.yaml

@@ -0,0 +1 @@
+---