From 5b6ecbd32d2a1aeaca788e2ec4f86ef14632d9b2 Mon Sep 17 00:00:00 2001 From: Sergey Malyuk Date: Wed, 17 Dec 2025 17:58:14 +0300 Subject: [PATCH 1/5] add promtail role --- roles/promtail/.ansible-lint | 16 +++ roles/promtail/.gitignore | 2 + roles/promtail/.yamllint | 8 ++ roles/promtail/README.md | 44 ++++++++ roles/promtail/defaults/main.yml | 7 ++ roles/promtail/handlers/main.yml | 11 ++ roles/promtail/meta/main.yml | 14 +++ roles/promtail/molecule/default/converge.yml | 5 + roles/promtail/molecule/default/molecule.yml | 24 +++++ roles/promtail/molecule/default/verify.yml | 19 ++++ roles/promtail/renovate.json | 6 ++ roles/promtail/requirements.ci.txt | 5 + roles/promtail/tasks/main.yml | 107 +++++++++++++++++++ roles/promtail/templates/promtail.service.j2 | 11 ++ roles/promtail/templates/promtail.yml.j2 | 28 +++++ roles/promtail/vars/main.yml | 1 + 16 files changed, 308 insertions(+) create mode 100644 roles/promtail/.ansible-lint create mode 100644 roles/promtail/.gitignore create mode 100644 roles/promtail/.yamllint create mode 100644 roles/promtail/README.md create mode 100644 roles/promtail/defaults/main.yml create mode 100644 roles/promtail/handlers/main.yml create mode 100644 roles/promtail/meta/main.yml create mode 100644 roles/promtail/molecule/default/converge.yml create mode 100644 roles/promtail/molecule/default/molecule.yml create mode 100644 roles/promtail/molecule/default/verify.yml create mode 100644 roles/promtail/renovate.json create mode 100644 roles/promtail/requirements.ci.txt create mode 100644 roles/promtail/tasks/main.yml create mode 100644 roles/promtail/templates/promtail.service.j2 create mode 100644 roles/promtail/templates/promtail.yml.j2 create mode 100644 roles/promtail/vars/main.yml diff --git a/roles/promtail/.ansible-lint b/roles/promtail/.ansible-lint new file mode 100644 index 0000000..f865478 --- /dev/null +++ b/roles/promtail/.ansible-lint @@ -0,0 +1,16 @@ +--- +profile: production +strict: true + +# Enable checking of loop variable prefixes in roles +loop_var_prefix: "^(__|{role}_)" + +skip_list: + - var-naming[no-role-prefix] + +warn_list: + - role-name[path] + - var-naming[no-role-prefix] + +exclude_paths: + - .github/ diff --git a/roles/promtail/.gitignore b/roles/promtail/.gitignore new file mode 100644 index 0000000..8cd0df3 --- /dev/null +++ b/roles/promtail/.gitignore @@ -0,0 +1,2 @@ +.vscode +.idea \ No newline at end of file diff --git a/roles/promtail/.yamllint b/roles/promtail/.yamllint new file mode 100644 index 0000000..611db54 --- /dev/null +++ b/roles/promtail/.yamllint @@ -0,0 +1,8 @@ +--- +rules: + brackets: + forbid: false + min-spaces-inside: 0 + max-spaces-inside: 2 + min-spaces-inside-empty: -1 + max-spaces-inside-empty: 2 diff --git a/roles/promtail/README.md b/roles/promtail/README.md new file mode 100644 index 0000000..ee40a4f --- /dev/null +++ b/roles/promtail/README.md @@ -0,0 +1,44 @@ +promtail +========= + +Installs promtail as systemd service. + +Requirements +------------ + +Role Variables +-------------- + +(all optional) +`promtail_version`: version to install +`loki_server`: set loki server +`loki_port`: set loki port +`custom_server_config`: path to custom config witch replace all config with your own +`custom_scrape_configs`: path to custom scrape configs + +Dependencies +------------ + +No + +Example Playbook +---------------- + + - hosts: servers + roles: + - role: promtail + promtail_version: 2.7.3 + +License +------- + +MIT + +Author Information +------------------ + +Alexander Gorelyshev and Danilkin Danila (MIPT) + +Genlab LLC + +corvus-migratorius@proton.me diff --git a/roles/promtail/defaults/main.yml b/roles/promtail/defaults/main.yml new file mode 100644 index 0000000..5a64778 --- /dev/null +++ b/roles/promtail/defaults/main.yml @@ -0,0 +1,7 @@ +--- +promtail_version: 2.7.3 +promtail_positions_path: /home/promtail/positions.yaml +promtail_http_port: 9080 +loki_server: localhost +loki_port: 3100 +add_var_logs: true diff --git a/roles/promtail/handlers/main.yml b/roles/promtail/handlers/main.yml new file mode 100644 index 0000000..d1c06ac --- /dev/null +++ b/roles/promtail/handlers/main.yml @@ -0,0 +1,11 @@ +--- + +- name: "Restart the Promtail daemon" + ansible.builtin.systemd: + name: promtail + state: restarted + + +- name: "Reload the Promtail daemon configuration" + ansible.builtin.systemd: + daemon_reload: true diff --git a/roles/promtail/meta/main.yml b/roles/promtail/meta/main.yml new file mode 100644 index 0000000..79d6be3 --- /dev/null +++ b/roles/promtail/meta/main.yml @@ -0,0 +1,14 @@ +galaxy_info: + role_name: promtail + namespace: genlab + author: Danilkin Danila + description: Installs Promtail + + company: Genlab LLC + license: MIT + + min_ansible_version: "2.1" + + galaxy_tags: [] + +dependencies: [] diff --git a/roles/promtail/molecule/default/converge.yml b/roles/promtail/molecule/default/converge.yml new file mode 100644 index 0000000..ea072dd --- /dev/null +++ b/roles/promtail/molecule/default/converge.yml @@ -0,0 +1,5 @@ +--- +- name: Converge + hosts: all + roles: + - role: genlab.common.promtail diff --git a/roles/promtail/molecule/default/molecule.yml b/roles/promtail/molecule/default/molecule.yml new file mode 100644 index 0000000..8d39b18 --- /dev/null +++ b/roles/promtail/molecule/default/molecule.yml @@ -0,0 +1,24 @@ +--- +dependency: + name: galaxy +driver: + name: docker +platforms: + - name: ubuntu + image: geerlingguy/docker-ubuntu2204-ansible:latest + pre_build_image: true + command: ${MOLECULE_DOCKER_COMMAND:-""} + volumes: + - /sys/fs/cgroup:/sys/fs/cgroup:rw + cgroupns_mode: host + privileged: true +provisioner: + name: ansible + playbooks: + converge: converge.yml +verifier: + name: ansible +lint: | + set -e + yamllint . + ansible-lint . diff --git a/roles/promtail/molecule/default/verify.yml b/roles/promtail/molecule/default/verify.yml new file mode 100644 index 0000000..c9ef143 --- /dev/null +++ b/roles/promtail/molecule/default/verify.yml @@ -0,0 +1,19 @@ +--- +- name: Verify + hosts: all + gather_facts: false + tasks: + # https://github.com/ansible/molecule/issues/3587#issuecomment-1158650179 + - name: "Include default vars" + ansible.builtin.include_vars: + dir: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/defaults/" + extensions: [ 'yml' ] + + - name: "Sanity check the Promtail daemon" + retries: 3 + delay: 1 + register: this + failed_when: "this.content != 'Ready'" + ansible.builtin.uri: + url: "http://localhost:{{ promtail_http_port }}/ready" + return_content: true diff --git a/roles/promtail/renovate.json b/roles/promtail/renovate.json new file mode 100644 index 0000000..5db72dd --- /dev/null +++ b/roles/promtail/renovate.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://docs.renovatebot.com/renovate-schema.json", + "extends": [ + "config:recommended" + ] +} diff --git a/roles/promtail/requirements.ci.txt b/roles/promtail/requirements.ci.txt new file mode 100644 index 0000000..5eabc75 --- /dev/null +++ b/roles/promtail/requirements.ci.txt @@ -0,0 +1,5 @@ +ansible +molecule +molecule-plugins[docker] +docker +requests==2.31.0 # pinned to the latest version not breaking Docker SDK \ No newline at end of file diff --git a/roles/promtail/tasks/main.yml b/roles/promtail/tasks/main.yml new file mode 100644 index 0000000..ca1458b --- /dev/null +++ b/roles/promtail/tasks/main.yml @@ -0,0 +1,107 @@ +--- +- name: "Install packages" + ansible.builtin.apt: + name: [ acl, unzip ] + state: present + update_cache: true + cache_valid_time: 3600 + + +- name: "Create the 'promtail' group" + ansible.builtin.group: + name: promtail + state: present + + +- name: "Create the 'promtail' user" + ansible.builtin.user: + name: promtail + groups: + - promtail + - systemd-journal + - adm + state: present + system: true + + +- name: "Set facl to allow promtail user to read '/var/log' contents" + ansible.posix.acl: + path: /var/log + entity: promtail + etype: user + permissions: rX + state: present + + +- name: "Make promtail user owner of '{{ promtail_positions_path }}'" + changed_when: false + ansible.builtin.file: + path: "{{ promtail_positions_path }}" + owner: promtail + group: promtail + state: touch + mode: "0750" + + +- name: "Install the requested Promtail version" + block: + - name: "Check Promtail version" + ansible.builtin.command: /usr/bin/promtail --version + register: promtail_version_check + changed_when: false + + - name: "Assert version correctness" + notify: "Restart the Promtail daemon" + ansible.builtin.assert: + that: "promtail_version in promtail_version_check.stdout" + success_msg: "Expected Promtail version available ({{ promtail_version }})" + fail_msg: "Expected version '{{ promtail_version }}'; available is '{{ promtail_version_check.stdout }}'" + + rescue: + - name: "Install Promtail if its not present" + ansible.builtin.unarchive: + src: "https://github.com/grafana/loki/releases/download/v\ + {{ promtail_version }}/promtail-linux-amd64.zip" + dest: /usr/bin/ + remote_src: true + + - name: "Rename and set permissions for the Promtail binary" + ansible.builtin.copy: + src: "/usr/bin/promtail-linux-amd64" + dest: "/usr/bin/promtail" + owner: root + group: root + mode: "0755" + remote_src: true + + - name: "Cleanup the downloaded file" + ansible.builtin.file: + path: "/usr/bin/promtail-linux-amd64" + state: absent + + +- name: "Template the systemd unit file" + notify: "Reload the Promtail daemon configuration" + ansible.builtin.template: + src: promtail.service.j2 + dest: /etc/systemd/system/promtail.service + owner: root + group: root + mode: "0644" + + +- name: "Template Promtail config file" + notify: "Restart the Promtail daemon" + ansible.builtin.template: + src: templates/promtail.yml.j2 + dest: /usr/local/bin/config-promtail.yml + owner: root + group: root + mode: "0644" + + +- name: "Enable and start Promtail daemon" + ansible.builtin.systemd: + name: promtail + state: started + enabled: true diff --git a/roles/promtail/templates/promtail.service.j2 b/roles/promtail/templates/promtail.service.j2 new file mode 100644 index 0000000..3b7b517 --- /dev/null +++ b/roles/promtail/templates/promtail.service.j2 @@ -0,0 +1,11 @@ +[Unit] +Description=Promtail service +After=network.target + +[Service] +Type=simple +User=promtail +ExecStart=/usr/bin/promtail -config.file /usr/local/bin/config-promtail.yml + +[Install] +WantedBy=multi-user.target diff --git a/roles/promtail/templates/promtail.yml.j2 b/roles/promtail/templates/promtail.yml.j2 new file mode 100644 index 0000000..2435643 --- /dev/null +++ b/roles/promtail/templates/promtail.yml.j2 @@ -0,0 +1,28 @@ +{% if custom_server_config is defined %} +{{ custom_server_config }} +{% else %} +server: + http_listen_port: {{ promtail_http_port }} + grpc_listen_port: 0 +{% endif %} +positions: + filename: {{ promtail_positions_path }} + +clients: + - url: "http://{{ loki_server }}:{{ loki_port }}/loki/api/v1/push" + +scrape_configs: +{% if add_var_logs %} + - job_name: system + static_configs: + - targets: + - localhost + labels: + job: varlogs + __path__: /var/log/*log + host: {{ ansible_hostname }} +{% endif %} + +{% if custom_scrape_configs is defined %} +{{ custom_scrape_configs }} +{% endif %} diff --git a/roles/promtail/vars/main.yml b/roles/promtail/vars/main.yml new file mode 100644 index 0000000..ed97d53 --- /dev/null +++ b/roles/promtail/vars/main.yml @@ -0,0 +1 @@ +--- From d89bc09b92fc74a43e4da4d409e4c2340c37eb04 Mon Sep 17 00:00:00 2001 From: Sergey Malyuk Date: Wed, 17 Dec 2025 18:06:01 +0300 Subject: [PATCH 2/5] fix ansible-lint errors --- roles/promtail/README.md | 4 ++-- roles/promtail/defaults/main.yml | 6 +++--- roles/promtail/molecule/default/verify.yml | 6 +++--- roles/promtail/tasks/main.yml | 2 +- roles/promtail/templates/promtail.yml.j2 | 4 ++-- 5 files changed, 11 insertions(+), 11 deletions(-) diff --git a/roles/promtail/README.md b/roles/promtail/README.md index ee40a4f..7dac0b4 100644 --- a/roles/promtail/README.md +++ b/roles/promtail/README.md @@ -11,8 +11,8 @@ Role Variables (all optional) `promtail_version`: version to install -`loki_server`: set loki server -`loki_port`: set loki port +`promtail_loki_server`: set loki server +`promtail_loki_port`: set loki port `custom_server_config`: path to custom config witch replace all config with your own `custom_scrape_configs`: path to custom scrape configs diff --git a/roles/promtail/defaults/main.yml b/roles/promtail/defaults/main.yml index 5a64778..8a8fa39 100644 --- a/roles/promtail/defaults/main.yml +++ b/roles/promtail/defaults/main.yml @@ -2,6 +2,6 @@ promtail_version: 2.7.3 promtail_positions_path: /home/promtail/positions.yaml promtail_http_port: 9080 -loki_server: localhost -loki_port: 3100 -add_var_logs: true +promtail_loki_server: localhost +promtail_loki_port: 3100 +promtail_add_var_logs: true diff --git a/roles/promtail/molecule/default/verify.yml b/roles/promtail/molecule/default/verify.yml index c9ef143..e1e0984 100644 --- a/roles/promtail/molecule/default/verify.yml +++ b/roles/promtail/molecule/default/verify.yml @@ -7,13 +7,13 @@ - name: "Include default vars" ansible.builtin.include_vars: dir: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/defaults/" - extensions: [ 'yml' ] + extensions: ['yml'] - name: "Sanity check the Promtail daemon" retries: 3 delay: 1 - register: this - failed_when: "this.content != 'Ready'" + register: promtail_this + failed_when: "promtail_this.content != 'Ready'" ansible.builtin.uri: url: "http://localhost:{{ promtail_http_port }}/ready" return_content: true diff --git a/roles/promtail/tasks/main.yml b/roles/promtail/tasks/main.yml index ca1458b..127c10c 100644 --- a/roles/promtail/tasks/main.yml +++ b/roles/promtail/tasks/main.yml @@ -1,7 +1,7 @@ --- - name: "Install packages" ansible.builtin.apt: - name: [ acl, unzip ] + name: [acl, unzip] state: present update_cache: true cache_valid_time: 3600 diff --git a/roles/promtail/templates/promtail.yml.j2 b/roles/promtail/templates/promtail.yml.j2 index 2435643..21dea49 100644 --- a/roles/promtail/templates/promtail.yml.j2 +++ b/roles/promtail/templates/promtail.yml.j2 @@ -9,10 +9,10 @@ positions: filename: {{ promtail_positions_path }} clients: - - url: "http://{{ loki_server }}:{{ loki_port }}/loki/api/v1/push" + - url: "http://{{ promtail_loki_server }}:{{ promtail_loki_port }}/loki/api/v1/push" scrape_configs: -{% if add_var_logs %} +{% if promtail_add_var_logs %} - job_name: system static_configs: - targets: From a683f014636140abe51aa44364865e577021295b Mon Sep 17 00:00:00 2001 From: Sergey Malyuk Date: Wed, 17 Dec 2025 18:06:56 +0300 Subject: [PATCH 3/5] remove unneeded files --- roles/promtail/.ansible-lint | 16 ---------------- roles/promtail/.gitignore | 2 -- roles/promtail/.yamllint | 8 -------- roles/promtail/renovate.json | 6 ------ roles/promtail/requirements.ci.txt | 5 ----- 5 files changed, 37 deletions(-) delete mode 100644 roles/promtail/.ansible-lint delete mode 100644 roles/promtail/.gitignore delete mode 100644 roles/promtail/.yamllint delete mode 100644 roles/promtail/renovate.json delete mode 100644 roles/promtail/requirements.ci.txt diff --git a/roles/promtail/.ansible-lint b/roles/promtail/.ansible-lint deleted file mode 100644 index f865478..0000000 --- a/roles/promtail/.ansible-lint +++ /dev/null @@ -1,16 +0,0 @@ ---- -profile: production -strict: true - -# Enable checking of loop variable prefixes in roles -loop_var_prefix: "^(__|{role}_)" - -skip_list: - - var-naming[no-role-prefix] - -warn_list: - - role-name[path] - - var-naming[no-role-prefix] - -exclude_paths: - - .github/ diff --git a/roles/promtail/.gitignore b/roles/promtail/.gitignore deleted file mode 100644 index 8cd0df3..0000000 --- a/roles/promtail/.gitignore +++ /dev/null @@ -1,2 +0,0 @@ -.vscode -.idea \ No newline at end of file diff --git a/roles/promtail/.yamllint b/roles/promtail/.yamllint deleted file mode 100644 index 611db54..0000000 --- a/roles/promtail/.yamllint +++ /dev/null @@ -1,8 +0,0 @@ ---- -rules: - brackets: - forbid: false - min-spaces-inside: 0 - max-spaces-inside: 2 - min-spaces-inside-empty: -1 - max-spaces-inside-empty: 2 diff --git a/roles/promtail/renovate.json b/roles/promtail/renovate.json deleted file mode 100644 index 5db72dd..0000000 --- a/roles/promtail/renovate.json +++ /dev/null @@ -1,6 +0,0 @@ -{ - "$schema": "https://docs.renovatebot.com/renovate-schema.json", - "extends": [ - "config:recommended" - ] -} diff --git a/roles/promtail/requirements.ci.txt b/roles/promtail/requirements.ci.txt deleted file mode 100644 index 5eabc75..0000000 --- a/roles/promtail/requirements.ci.txt +++ /dev/null @@ -1,5 +0,0 @@ -ansible -molecule -molecule-plugins[docker] -docker -requests==2.31.0 # pinned to the latest version not breaking Docker SDK \ No newline at end of file From 471be205638537a7b8460a6aa9f19d758bcc2351 Mon Sep 17 00:00:00 2001 From: Sergey Malyuk Date: Wed, 17 Dec 2025 18:15:58 +0300 Subject: [PATCH 4/5] fix kics error --- roles/promtail/molecule/default/verify.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/roles/promtail/molecule/default/verify.yml b/roles/promtail/molecule/default/verify.yml index e1e0984..7e078c2 100644 --- a/roles/promtail/molecule/default/verify.yml +++ b/roles/promtail/molecule/default/verify.yml @@ -9,6 +9,7 @@ dir: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/defaults/" extensions: ['yml'] + # kics-scan ignore-block - kics doesn't like http but it's localhost so it's not important - name: "Sanity check the Promtail daemon" retries: 3 delay: 1 From cadbc7398619e04427a9faa2886d769f5b71d752 Mon Sep 17 00:00:00 2001 From: Sergey Malyuk Date: Wed, 17 Dec 2025 18:21:17 +0300 Subject: [PATCH 5/5] update meta --- README.md | 1 + galaxy.yml | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index f383011..3aed186 100644 --- a/README.md +++ b/README.md @@ -16,6 +16,7 @@ - [mount_device](roles/mount_device/README.md) - [nginx](roles/nginx/README.md) - [prometheus](roles/prometheus/README.md) +- [promtail](roles/promtail/README.md) - [rclone_yandex](roles/rclone_yandex/README.md) - [rustdesk](roles/rustdesk/README.md) - [sftp_share](roles/sftp_share/README.md) diff --git a/galaxy.yml b/galaxy.yml index a760250..a47d750 100644 --- a/galaxy.yml +++ b/galaxy.yml @@ -1,7 +1,7 @@ --- namespace: genlab name: common -version: 0.18.0 +version: 0.19.0 readme: README.md authors: - Alexander Gorelyshev (corvus-migratorius@proton.me)