add alertmanager role

roles/alertmanager/README.md

@@ -0,0 +1,53 @@
+genlab.alertmanager
+=========
+
+The [Alertmanager](https://github.com/prometheus/alertmanager) handles alerts sent by client applications such as the Prometheus server. It takes care of deduplicating, grouping, and routing them to the correct receiver integration such as email, PagerDuty, or OpsGenie. It also takes care of silencing and inhibition of alerts.
+
+You'll need to manually specify the paths to your template files in the main Alertmanager configuration file (`alertmanager.yml`) on the target machine. The configuration file must have a `.yml` suffix, and template files must use a `.tmpl` suffix.
+
+Requirements
+------------
+
+None
+
+Role Variables
+--------------
+
+```
+alertmanager_version: 0.28.1          # version of Alertmanager (AM)
+config_dir: "/etc/alertmanager/conf"  # where to place AM configs
+storage_dir: "/var/lib/alertmanager"  # path to AM storage
+alertmanager_dir: "/etc/alertmanager" # where to install AM on target
+alertmanager_user: "alertmanager"     # system user name
+alertmanager_group: "alertmanager"    # system group name
+config_source_dir: "./alertmanager"   # path to config files on source
+
+# Optional
+template_source_dir: "./templates"    # path to template files on source
+```
+
+Dependencies
+------------
+
+None
+
+Example Playbook
+----------------
+
+```yaml
+roles:
+    - role: genlab.template
+      config_source_dir: alertmanager
+      alertmanager_version: 0.28.1
+
+```
+
+License
+-------
+
+BSD
+
+Author Information
+------------------
+
+corvus-migratorius@proton.me

roles/alertmanager/defaults/main.yml

@@ -0,0 +1,7 @@
+---
+alertmanager_version: 0.28.1
+config_dir: "/etc/alertmanager/conf"
+storage_dir: "/var/lib/alertmanager"
+alertmanager_dir: "/etc/alertmanager"
+alertmanager_user: alertmanager
+alertmanager_group: alertmanager

roles/alertmanager/handlers/main.yml

@@ -0,0 +1,7 @@
+---
+- name: "(Re)start and enable Alertmanager"
+  ansible.builtin.systemd_service:
+    name: alertmanager.service
+    state: restarted
+    enabled: true
+    daemon_reload: true

roles/alertmanager/meta/main.yml

@@ -0,0 +1,17 @@
+---
+galaxy_info:
+  role_name: "alertmanager"
+  namespace: genlab
+  author: "Alexander Gorelyshev"
+  company: "Genlab, LLC"
+  description: ""
+  license: "MIT"
+  min_ansible_version: "2.1"
+
+  platforms:
+    - name: "Ubuntu"
+      versions: [ "focal", "jammy", "noble" ]
+
+  galaxy_tags: [ ]
+
+dependencies: []

roles/alertmanager/molecule/default/alertmanager/alertmanager.yml

@@ -0,0 +1,36 @@
+global:
+  # SMTP configuration for email notifications (if needed)
+  smtp_smarthost: 'mailserver.example.com:587'
+  smtp_from: 'alertmanager@example.com'
+  smtp_auth_username: 'alertmanager'
+  smtp_auth_password: 'your_password'
+
+  # Other global settings like resolve_timeout, http_config, etc.
+
+route: 
+  # Default receiver for alerts
+  receiver: 'default-receiver'
+
+  # Labels used for grouping alerts 
+  group_by: ['alertname', 'instance', 'severity'] 
+
+  # Timing settings (group_wait, group_interval, repeat_interval) 
+  # You can have nested 'routes' for more complex routing logic 
+
+receivers:
+  - name: 'default-receiver'
+    email_configs:
+      - to: 'ops-team@example.com' 
+
+inhibit_rules:
+  # Rules to suppress alerts based on other alerts
+  # Example:
+  - source_match:
+      severity: 'critical'
+    target_match:
+      severity: 'warning'
+    # Suppress 'warning' alerts if a 'critical' alert is also firing
+
+templates: 
+  # Paths to template files for customizing notifications 
+  - '/etc/alertmanager/templates/*.tmpl' 

roles/alertmanager/molecule/default/converge.yml

@@ -0,0 +1,6 @@
+---
+- name: Converge
+  hosts: all
+  roles:
+    - role: genlab.alertmanager
+      config_source_dir: alertmanager

roles/alertmanager/molecule/default/molecule.yml

@@ -0,0 +1,27 @@
+---
+dependency:
+  name: galaxy
+
+driver:
+  name: docker
+
+platforms:
+  - name: ubuntu
+    image: geerlingguy/docker-${MOLECULE_DISTRO:-ubuntu2404}-ansible:latest
+    pre_build_image: true
+    command: ${MOLECULE_DOCKER_COMMAND:-""}
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+    cgroupns_mode: host
+    privileged: true
+
+provisioner:
+  name: ansible
+
+verifier:
+  name: ansible
+
+lint: |
+  set -e
+  yamllint .
+  ansible-lint .

roles/alertmanager/molecule/default/verify.yml

@@ -0,0 +1,55 @@
+---
+- name: Verify
+  hosts: all
+  gather_facts: false
+  any_errors_fatal: true
+
+  tasks:
+
+    - name: "Include default vars"
+      ansible.builtin.include_vars:
+        dir: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/defaults/"
+        extensions: [ 'yml' ]
+
+    - name: "Check if Alertmanager is installed"
+      changed_when: false
+      ansible.builtin.command: "alertmanager --version"
+      register: alertmanager_installed_version
+
+    - name: "Check Alertmanager version"
+      ansible.builtin.assert:
+        that: "alertmanager_installed_version.stdout is regex('{{ alertmanager_version }}')"
+        success_msg: "Alertmanager version {{ alertmanager_version }} is installed and working"
+        fail_msg: "Alertmanager version {{ alertmanager_version }} is not installed or not working correctly"
+
+    # kics-scan ignore-block
+    - name: "Check if Alertmanager is reachable"
+      ansible.builtin.uri:
+        url: "http://localhost:9093/-/healthy"
+        return_content: true
+        status_code: 200
+        method: GET
+        body_format: json
+      register: alertmanager_health
+
+    - name: "Assert Alertmanager health status"
+      ansible.builtin.assert:
+        that: "alertmanager_health.content == 'OK'"
+        success_msg: "Alertmanager is healthy"
+        fail_msg: "Alertmanager is not healthy"
+
+    # kics-scan ignore-block
+    - name: "Check if Alertmanager is ready"
+      ansible.builtin.uri:
+        url: "http://localhost:9093/-/ready"
+        return_content: true
+        status_code: 200
+        method: GET
+        body_format: json
+      register: alertmanager_ready
+
+    - name: "Assert Alertmanager readiness status"
+      ansible.builtin.assert:
+        that: "alertmanager_ready.content == 'OK'"
+        success_msg: "Alertmanager is ready"
+        fail_msg: "Alertmanager is not ready"

roles/alertmanager/tasks/configuration.yml

@@ -0,0 +1,24 @@
+---
+
+- name: "Copy config file"
+  notify: "(Re)start and enable Alertmanager"
+  ansible.builtin.template:
+    src: "{{ item }}"
+    dest: "{{ config_dir }}/{{ item | basename }}"
+    owner: "{{ alertmanager_user }}"
+    group: "{{ alertmanager_group }}"
+    mode: "0660"
+  with_fileglob:
+    - "{{ config_source_dir }}/*.yml"
+
+- name: "Copy templates if existed"
+  notify: "(Re)start and enable Alertmanager"
+  when: template_source_dir is defined
+  ansible.builtin.copy:
+    src: "{{ item }}"
+    dest: "{{ config_dir }}/{{ item | basename }}"
+    owner: "{{ alertmanager_user }}"
+    group: "{{ alertmanager_group }}"
+    mode: "0660"
+  with_fileglob:
+    - "{{ template_source_dir }}/*.tmpl"

roles/alertmanager/tasks/install.yml

@@ -0,0 +1,85 @@
+---
+- name: "Create Alertmanager system group"
+  ansible.builtin.group:
+    name: "{{ alertmanager_user }}"
+    system: true
+    state: present
+
+- name: "Create Alertmanager system user"
+  ansible.builtin.user:
+    name: "{{ alertmanager_user }}"
+    group: "{{ alertmanager_group }}"
+    system: true
+    shell: "/sbin/nologin"
+    create_home: false
+    state: present
+
+- name: "Install Alertmanager from binary"
+  block:
+    - name: "Check Alertmanager version"
+      changed_when: false
+      ansible.builtin.command:
+        cmd: "alertmanager --version"
+      register: alertmanager_ver
+
+    - name: "Assert version correctness"
+      ansible.builtin.assert:
+        that: "alertmanager_ver.stdout is regex('{{ alertmanager_version }}')"
+        success_msg: "alertmanager version {{ alertmanager_version }} is installed and working"
+        fail_msg: "alertmanager version {{ alertmanager_version }} is not installed or not working correctly"
+
+  rescue:
+    - name: "Create Alertmanager directories '{{ item }}'"
+      ansible.builtin.file:
+        path: "{{ item }}"
+        state: directory
+        owner: "{{ alertmanager_user }}"
+        group: "{{ alertmanager_group }}"
+        mode: "0755"
+      with_items:
+        - "{{ config_dir }}"
+        - "{{ alertmanager_dir }}"
+        - "{{ storage_dir }}"
+
+    - name: "Download Alertmanager binary"
+      ansible.builtin.get_url:
+        url: "https://github.com/prometheus/alertmanager/releases/download/v{{ alertmanager_version }}/\
+              alertmanager-{{ alertmanager_version }}.linux-amd64.tar.gz"
+        dest: "/tmp/alertmanager-{{ alertmanager_version }}.linux-amd64.tar.gz"
+        owner: "{{ alertmanager_user }}"
+        group: "{{ alertmanager_group }}"
+        mode: "0644"
+
+    - name: "Unpack Alertmanager binaries"
+      notify: "(Re)start and enable Alertmanager"
+      ansible.builtin.unarchive:
+        src: "/tmp/alertmanager-{{ alertmanager_version }}.linux-amd64.tar.gz"
+        dest: "{{ alertmanager_dir }}"
+        creates: "{{ alertmanager_dir }}/alertmanager-{{ alertmanager_version }}.linux-amd64"
+        remote_src: true
+
+    - name: "Cleanup downloaded file"
+      ansible.builtin.file:
+        path: "/tmp/alertmanager-{{ alertmanager_version }}.linux-amd64.tar.gz"
+        state: absent
+
+    - name: "Move official alertmanager and amtool binaries"
+      ansible.builtin.copy:
+        src: "{{ alertmanager_dir }}/alertmanager-{{ alertmanager_version }}.linux-amd64/{{ item }}"
+        dest: "/usr/local/bin/{{ item }}"
+        mode: "0755"
+        owner: "{{ alertmanager_user }}"
+        group: "{{ alertmanager_group }}"
+        remote_src: true
+      with_items:
+        - alertmanager
+        - amtool
+
+
+- name: "Create systemd service unit"
+  ansible.builtin.template:
+    src: alertmanager.service.j2
+    dest: /etc/systemd/system/alertmanager.service
+    owner: "{{ alertmanager_user }}"
+    group: "{{ alertmanager_group }}"
+    mode: "0660"

roles/alertmanager/tasks/main.yml

@@ -0,0 +1,9 @@
+---
+- name: "Run installation tasks"
+  ansible.builtin.include_tasks: install.yml
+
+- name: "Run configuration tasks"
+  ansible.builtin.include_tasks: configuration.yml
+
+- name: "Flush handlers"
+  ansible.builtin.meta: "flush_handlers"

roles/alertmanager/templates/alertmanager.service.j2

@@ -0,0 +1,27 @@
+[Unit]
+Description=Alertmanager Service
+After=network.target
+Documentation="https://prometheus.io/docs/alerting/latest/alertmanager/"
+
+[Service]
+User={{ alertmanager_user }}
+Group={{ alertmanager_group }}
+Type=simple
+ExecStart=/usr/local/bin/alertmanager \
+          --config.file={{ config_dir }}/alertmanager.yml \
+          --storage.path={{ storage_dir }}
+Restart=on-failure
+ 
+# Security hardening
+ReadWritePaths={{ storage_dir }}
+ProtectSystem=strict
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+ProtectKernelTunables=true
+ProtectClock=yes
+RestrictSUIDSGID=true
+
+[Install]
+WantedBy=multi-user.target

roles/alertmanager/vars/main.yml

@@ -0,0 +1 @@
+---