From 17ebbf1fcaf6145a37e378fa78103a6b353a850f Mon Sep 17 00:00:00 2001 From: Sergey Malyuk Date: Mon, 8 Dec 2025 15:11:23 +0300 Subject: [PATCH 1/6] add alertmanager role --- roles/alertmanager/README.md | 53 ++++++++++++ roles/alertmanager/defaults/main.yml | 7 ++ roles/alertmanager/handlers/main.yml | 7 ++ roles/alertmanager/meta/main.yml | 17 ++++ .../default/alertmanager/alertmanager.yml | 36 ++++++++ .../molecule/default/converge.yml | 6 ++ .../molecule/default/molecule.yml | 27 ++++++ .../alertmanager/molecule/default/verify.yml | 55 ++++++++++++ roles/alertmanager/tasks/configuration.yml | 24 ++++++ roles/alertmanager/tasks/install.yml | 85 +++++++++++++++++++ roles/alertmanager/tasks/main.yml | 9 ++ .../templates/alertmanager.service.j2 | 27 ++++++ roles/alertmanager/vars/main.yml | 1 + 13 files changed, 354 insertions(+) create mode 100644 roles/alertmanager/README.md create mode 100644 roles/alertmanager/defaults/main.yml create mode 100644 roles/alertmanager/handlers/main.yml create mode 100644 roles/alertmanager/meta/main.yml create mode 100644 roles/alertmanager/molecule/default/alertmanager/alertmanager.yml create mode 100644 roles/alertmanager/molecule/default/converge.yml create mode 100644 roles/alertmanager/molecule/default/molecule.yml create mode 100644 roles/alertmanager/molecule/default/verify.yml create mode 100644 roles/alertmanager/tasks/configuration.yml create mode 100644 roles/alertmanager/tasks/install.yml create mode 100644 roles/alertmanager/tasks/main.yml create mode 100644 roles/alertmanager/templates/alertmanager.service.j2 create mode 100644 roles/alertmanager/vars/main.yml diff --git a/roles/alertmanager/README.md b/roles/alertmanager/README.md new file mode 100644 index 0000000..a8a57da --- /dev/null +++ b/roles/alertmanager/README.md @@ -0,0 +1,53 @@ +genlab.alertmanager +========= + +The [Alertmanager](https://github.com/prometheus/alertmanager) handles alerts sent by client applications such as the Prometheus server. It takes care of deduplicating, grouping, and routing them to the correct receiver integration such as email, PagerDuty, or OpsGenie. It also takes care of silencing and inhibition of alerts. + +You'll need to manually specify the paths to your template files in the main Alertmanager configuration file (`alertmanager.yml`) on the target machine. The configuration file must have a `.yml` suffix, and template files must use a `.tmpl` suffix. + +Requirements +------------ + +None + +Role Variables +-------------- + +``` +alertmanager_version: 0.28.1 # version of Alertmanager (AM) +config_dir: "/etc/alertmanager/conf" # where to place AM configs +storage_dir: "/var/lib/alertmanager" # path to AM storage +alertmanager_dir: "/etc/alertmanager" # where to install AM on target +alertmanager_user: "alertmanager" # system user name +alertmanager_group: "alertmanager" # system group name +config_source_dir: "./alertmanager" # path to config files on source + +# Optional +template_source_dir: "./templates" # path to template files on source +``` + +Dependencies +------------ + +None + +Example Playbook +---------------- + +```yaml +roles: + - role: genlab.template + config_source_dir: alertmanager + alertmanager_version: 0.28.1 + +``` + +License +------- + +BSD + +Author Information +------------------ + +corvus-migratorius@proton.me diff --git a/roles/alertmanager/defaults/main.yml b/roles/alertmanager/defaults/main.yml new file mode 100644 index 0000000..88707b3 --- /dev/null +++ b/roles/alertmanager/defaults/main.yml @@ -0,0 +1,7 @@ +--- +alertmanager_version: 0.28.1 +config_dir: "/etc/alertmanager/conf" +storage_dir: "/var/lib/alertmanager" +alertmanager_dir: "/etc/alertmanager" +alertmanager_user: alertmanager +alertmanager_group: alertmanager diff --git a/roles/alertmanager/handlers/main.yml b/roles/alertmanager/handlers/main.yml new file mode 100644 index 0000000..4a0e813 --- /dev/null +++ b/roles/alertmanager/handlers/main.yml @@ -0,0 +1,7 @@ +--- +- name: "(Re)start and enable Alertmanager" + ansible.builtin.systemd_service: + name: alertmanager.service + state: restarted + enabled: true + daemon_reload: true diff --git a/roles/alertmanager/meta/main.yml b/roles/alertmanager/meta/main.yml new file mode 100644 index 0000000..942b852 --- /dev/null +++ b/roles/alertmanager/meta/main.yml @@ -0,0 +1,17 @@ +--- +galaxy_info: + role_name: "alertmanager" + namespace: genlab + author: "Alexander Gorelyshev" + company: "Genlab, LLC" + description: "" + license: "MIT" + min_ansible_version: "2.1" + + platforms: + - name: "Ubuntu" + versions: [ "focal", "jammy", "noble" ] + + galaxy_tags: [ ] + +dependencies: [] diff --git a/roles/alertmanager/molecule/default/alertmanager/alertmanager.yml b/roles/alertmanager/molecule/default/alertmanager/alertmanager.yml new file mode 100644 index 0000000..7c3bff0 --- /dev/null +++ b/roles/alertmanager/molecule/default/alertmanager/alertmanager.yml @@ -0,0 +1,36 @@ +global: + # SMTP configuration for email notifications (if needed) + smtp_smarthost: 'mailserver.example.com:587' + smtp_from: 'alertmanager@example.com' + smtp_auth_username: 'alertmanager' + smtp_auth_password: 'your_password' + + # Other global settings like resolve_timeout, http_config, etc. + +route: + # Default receiver for alerts + receiver: 'default-receiver' + + # Labels used for grouping alerts + group_by: ['alertname', 'instance', 'severity'] + + # Timing settings (group_wait, group_interval, repeat_interval) + # You can have nested 'routes' for more complex routing logic + +receivers: + - name: 'default-receiver' + email_configs: + - to: 'ops-team@example.com' + +inhibit_rules: + # Rules to suppress alerts based on other alerts + # Example: + - source_match: + severity: 'critical' + target_match: + severity: 'warning' + # Suppress 'warning' alerts if a 'critical' alert is also firing + +templates: + # Paths to template files for customizing notifications + - '/etc/alertmanager/templates/*.tmpl' \ No newline at end of file diff --git a/roles/alertmanager/molecule/default/converge.yml b/roles/alertmanager/molecule/default/converge.yml new file mode 100644 index 0000000..3f7be92 --- /dev/null +++ b/roles/alertmanager/molecule/default/converge.yml @@ -0,0 +1,6 @@ +--- +- name: Converge + hosts: all + roles: + - role: genlab.alertmanager + config_source_dir: alertmanager diff --git a/roles/alertmanager/molecule/default/molecule.yml b/roles/alertmanager/molecule/default/molecule.yml new file mode 100644 index 0000000..d82158e --- /dev/null +++ b/roles/alertmanager/molecule/default/molecule.yml @@ -0,0 +1,27 @@ +--- +dependency: + name: galaxy + +driver: + name: docker + +platforms: + - name: ubuntu + image: geerlingguy/docker-${MOLECULE_DISTRO:-ubuntu2404}-ansible:latest + pre_build_image: true + command: ${MOLECULE_DOCKER_COMMAND:-""} + volumes: + - /sys/fs/cgroup:/sys/fs/cgroup:rw + cgroupns_mode: host + privileged: true + +provisioner: + name: ansible + +verifier: + name: ansible + +lint: | + set -e + yamllint . + ansible-lint . diff --git a/roles/alertmanager/molecule/default/verify.yml b/roles/alertmanager/molecule/default/verify.yml new file mode 100644 index 0000000..0836d76 --- /dev/null +++ b/roles/alertmanager/molecule/default/verify.yml @@ -0,0 +1,55 @@ +--- +- name: Verify + hosts: all + gather_facts: false + any_errors_fatal: true + + tasks: + + - name: "Include default vars" + ansible.builtin.include_vars: + dir: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/defaults/" + extensions: [ 'yml' ] + + - name: "Check if Alertmanager is installed" + changed_when: false + ansible.builtin.command: "alertmanager --version" + register: alertmanager_installed_version + + - name: "Check Alertmanager version" + ansible.builtin.assert: + that: "alertmanager_installed_version.stdout is regex('{{ alertmanager_version }}')" + success_msg: "Alertmanager version {{ alertmanager_version }} is installed and working" + fail_msg: "Alertmanager version {{ alertmanager_version }} is not installed or not working correctly" + + # kics-scan ignore-block + - name: "Check if Alertmanager is reachable" + ansible.builtin.uri: + url: "http://localhost:9093/-/healthy" + return_content: true + status_code: 200 + method: GET + body_format: json + register: alertmanager_health + + - name: "Assert Alertmanager health status" + ansible.builtin.assert: + that: "alertmanager_health.content == 'OK'" + success_msg: "Alertmanager is healthy" + fail_msg: "Alertmanager is not healthy" + + # kics-scan ignore-block + - name: "Check if Alertmanager is ready" + ansible.builtin.uri: + url: "http://localhost:9093/-/ready" + return_content: true + status_code: 200 + method: GET + body_format: json + register: alertmanager_ready + + - name: "Assert Alertmanager readiness status" + ansible.builtin.assert: + that: "alertmanager_ready.content == 'OK'" + success_msg: "Alertmanager is ready" + fail_msg: "Alertmanager is not ready" diff --git a/roles/alertmanager/tasks/configuration.yml b/roles/alertmanager/tasks/configuration.yml new file mode 100644 index 0000000..4932c8e --- /dev/null +++ b/roles/alertmanager/tasks/configuration.yml @@ -0,0 +1,24 @@ +--- + +- name: "Copy config file" + notify: "(Re)start and enable Alertmanager" + ansible.builtin.template: + src: "{{ item }}" + dest: "{{ config_dir }}/{{ item | basename }}" + owner: "{{ alertmanager_user }}" + group: "{{ alertmanager_group }}" + mode: "0660" + with_fileglob: + - "{{ config_source_dir }}/*.yml" + +- name: "Copy templates if existed" + notify: "(Re)start and enable Alertmanager" + when: template_source_dir is defined + ansible.builtin.copy: + src: "{{ item }}" + dest: "{{ config_dir }}/{{ item | basename }}" + owner: "{{ alertmanager_user }}" + group: "{{ alertmanager_group }}" + mode: "0660" + with_fileglob: + - "{{ template_source_dir }}/*.tmpl" diff --git a/roles/alertmanager/tasks/install.yml b/roles/alertmanager/tasks/install.yml new file mode 100644 index 0000000..f97a99e --- /dev/null +++ b/roles/alertmanager/tasks/install.yml @@ -0,0 +1,85 @@ +--- +- name: "Create Alertmanager system group" + ansible.builtin.group: + name: "{{ alertmanager_user }}" + system: true + state: present + +- name: "Create Alertmanager system user" + ansible.builtin.user: + name: "{{ alertmanager_user }}" + group: "{{ alertmanager_group }}" + system: true + shell: "/sbin/nologin" + create_home: false + state: present + +- name: "Install Alertmanager from binary" + block: + - name: "Check Alertmanager version" + changed_when: false + ansible.builtin.command: + cmd: "alertmanager --version" + register: alertmanager_ver + + - name: "Assert version correctness" + ansible.builtin.assert: + that: "alertmanager_ver.stdout is regex('{{ alertmanager_version }}')" + success_msg: "alertmanager version {{ alertmanager_version }} is installed and working" + fail_msg: "alertmanager version {{ alertmanager_version }} is not installed or not working correctly" + + rescue: + - name: "Create Alertmanager directories '{{ item }}'" + ansible.builtin.file: + path: "{{ item }}" + state: directory + owner: "{{ alertmanager_user }}" + group: "{{ alertmanager_group }}" + mode: "0755" + with_items: + - "{{ config_dir }}" + - "{{ alertmanager_dir }}" + - "{{ storage_dir }}" + + - name: "Download Alertmanager binary" + ansible.builtin.get_url: + url: "https://github.com/prometheus/alertmanager/releases/download/v{{ alertmanager_version }}/\ + alertmanager-{{ alertmanager_version }}.linux-amd64.tar.gz" + dest: "/tmp/alertmanager-{{ alertmanager_version }}.linux-amd64.tar.gz" + owner: "{{ alertmanager_user }}" + group: "{{ alertmanager_group }}" + mode: "0644" + + - name: "Unpack Alertmanager binaries" + notify: "(Re)start and enable Alertmanager" + ansible.builtin.unarchive: + src: "/tmp/alertmanager-{{ alertmanager_version }}.linux-amd64.tar.gz" + dest: "{{ alertmanager_dir }}" + creates: "{{ alertmanager_dir }}/alertmanager-{{ alertmanager_version }}.linux-amd64" + remote_src: true + + - name: "Cleanup downloaded file" + ansible.builtin.file: + path: "/tmp/alertmanager-{{ alertmanager_version }}.linux-amd64.tar.gz" + state: absent + + - name: "Move official alertmanager and amtool binaries" + ansible.builtin.copy: + src: "{{ alertmanager_dir }}/alertmanager-{{ alertmanager_version }}.linux-amd64/{{ item }}" + dest: "/usr/local/bin/{{ item }}" + mode: "0755" + owner: "{{ alertmanager_user }}" + group: "{{ alertmanager_group }}" + remote_src: true + with_items: + - alertmanager + - amtool + + +- name: "Create systemd service unit" + ansible.builtin.template: + src: alertmanager.service.j2 + dest: /etc/systemd/system/alertmanager.service + owner: "{{ alertmanager_user }}" + group: "{{ alertmanager_group }}" + mode: "0660" diff --git a/roles/alertmanager/tasks/main.yml b/roles/alertmanager/tasks/main.yml new file mode 100644 index 0000000..6bd62b2 --- /dev/null +++ b/roles/alertmanager/tasks/main.yml @@ -0,0 +1,9 @@ +--- +- name: "Run installation tasks" + ansible.builtin.include_tasks: install.yml + +- name: "Run configuration tasks" + ansible.builtin.include_tasks: configuration.yml + +- name: "Flush handlers" + ansible.builtin.meta: "flush_handlers" diff --git a/roles/alertmanager/templates/alertmanager.service.j2 b/roles/alertmanager/templates/alertmanager.service.j2 new file mode 100644 index 0000000..e4ee45a --- /dev/null +++ b/roles/alertmanager/templates/alertmanager.service.j2 @@ -0,0 +1,27 @@ +[Unit] +Description=Alertmanager Service +After=network.target +Documentation="https://prometheus.io/docs/alerting/latest/alertmanager/" + +[Service] +User={{ alertmanager_user }} +Group={{ alertmanager_group }} +Type=simple +ExecStart=/usr/local/bin/alertmanager \ + --config.file={{ config_dir }}/alertmanager.yml \ + --storage.path={{ storage_dir }} +Restart=on-failure + +# Security hardening +ReadWritePaths={{ storage_dir }} +ProtectSystem=strict +NoNewPrivileges=true +PrivateTmp=true +ProtectKernelModules=true +ProtectControlGroups=true +ProtectKernelTunables=true +ProtectClock=yes +RestrictSUIDSGID=true + +[Install] +WantedBy=multi-user.target \ No newline at end of file diff --git a/roles/alertmanager/vars/main.yml b/roles/alertmanager/vars/main.yml new file mode 100644 index 0000000..ed97d53 --- /dev/null +++ b/roles/alertmanager/vars/main.yml @@ -0,0 +1 @@ +--- From 27ce34c42007c0d663c2c1bf2df53356b1ed5ffd Mon Sep 17 00:00:00 2001 From: Sergey Malyuk Date: Mon, 8 Dec 2025 15:29:02 +0300 Subject: [PATCH 2/6] update README.md --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index dc6784a..eecffb1 100644 --- a/README.md +++ b/README.md @@ -6,3 +6,4 @@ ## Roles - [mount_device](roles/mount_device/README.md) +- [alertmanager](roles/alertmanager/README.md) From 48ced598f75a87759d3c6ddc0da5f27a151bca2a Mon Sep 17 00:00:00 2001 From: Sergey Malyuk Date: Mon, 8 Dec 2025 15:29:16 +0300 Subject: [PATCH 3/6] add .gitignore --- .gitignore | 1 + 1 file changed, 1 insertion(+) create mode 100644 .gitignore diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..feaf22e --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +.ansible \ No newline at end of file From 56436fe607f4a8466e6e7cb0388ff6f4a55f5189 Mon Sep 17 00:00:00 2001 From: Sergey Malyuk Date: Mon, 8 Dec 2025 15:35:57 +0300 Subject: [PATCH 4/6] fix linter errors --- roles/alertmanager/README.md | 4 ++-- roles/alertmanager/defaults/main.yml | 4 ++-- roles/alertmanager/meta/main.yml | 6 +++--- .../default/alertmanager/alertmanager.yml | 18 +++++++++--------- .../alertmanager/molecule/default/converge.yml | 2 +- roles/alertmanager/molecule/default/verify.yml | 2 +- 6 files changed, 18 insertions(+), 18 deletions(-) diff --git a/roles/alertmanager/README.md b/roles/alertmanager/README.md index a8a57da..7ef20e9 100644 --- a/roles/alertmanager/README.md +++ b/roles/alertmanager/README.md @@ -15,8 +15,8 @@ Role Variables ``` alertmanager_version: 0.28.1 # version of Alertmanager (AM) -config_dir: "/etc/alertmanager/conf" # where to place AM configs -storage_dir: "/var/lib/alertmanager" # path to AM storage +alertmanager_config_dir: "/etc/alertmanager/conf" # where to place AM configs +alertmanager_storage_dir: "/var/lib/alertmanager" # path to AM storage alertmanager_dir: "/etc/alertmanager" # where to install AM on target alertmanager_user: "alertmanager" # system user name alertmanager_group: "alertmanager" # system group name diff --git a/roles/alertmanager/defaults/main.yml b/roles/alertmanager/defaults/main.yml index 88707b3..4e14295 100644 --- a/roles/alertmanager/defaults/main.yml +++ b/roles/alertmanager/defaults/main.yml @@ -1,7 +1,7 @@ --- alertmanager_version: 0.28.1 -config_dir: "/etc/alertmanager/conf" -storage_dir: "/var/lib/alertmanager" +alertmanager_config_dir: "/etc/alertmanager/conf" +alertmanager_storage_dir: "/var/lib/alertmanager" alertmanager_dir: "/etc/alertmanager" alertmanager_user: alertmanager alertmanager_group: alertmanager diff --git a/roles/alertmanager/meta/main.yml b/roles/alertmanager/meta/main.yml index 942b852..0cebb5a 100644 --- a/roles/alertmanager/meta/main.yml +++ b/roles/alertmanager/meta/main.yml @@ -1,6 +1,6 @@ --- galaxy_info: - role_name: "alertmanager" + role_name: alertmanager namespace: genlab author: "Alexander Gorelyshev" company: "Genlab, LLC" @@ -10,8 +10,8 @@ galaxy_info: platforms: - name: "Ubuntu" - versions: [ "focal", "jammy", "noble" ] + versions: ["focal", "jammy", "noble"] - galaxy_tags: [ ] + galaxy_tags: [] dependencies: [] diff --git a/roles/alertmanager/molecule/default/alertmanager/alertmanager.yml b/roles/alertmanager/molecule/default/alertmanager/alertmanager.yml index 7c3bff0..78e14ea 100644 --- a/roles/alertmanager/molecule/default/alertmanager/alertmanager.yml +++ b/roles/alertmanager/molecule/default/alertmanager/alertmanager.yml @@ -7,20 +7,20 @@ global: # Other global settings like resolve_timeout, http_config, etc. -route: +route: # Default receiver for alerts receiver: 'default-receiver' - # Labels used for grouping alerts - group_by: ['alertname', 'instance', 'severity'] + # Labels used for grouping alerts + group_by: ['alertname', 'instance', 'severity'] - # Timing settings (group_wait, group_interval, repeat_interval) - # You can have nested 'routes' for more complex routing logic + # Timing settings (group_wait, group_interval, repeat_interval) + # You can have nested 'routes' for more complex routing logic receivers: - name: 'default-receiver' email_configs: - - to: 'ops-team@example.com' + - to: 'ops-team@example.com' inhibit_rules: # Rules to suppress alerts based on other alerts @@ -31,6 +31,6 @@ inhibit_rules: severity: 'warning' # Suppress 'warning' alerts if a 'critical' alert is also firing -templates: - # Paths to template files for customizing notifications - - '/etc/alertmanager/templates/*.tmpl' \ No newline at end of file +templates: + # Paths to template files for customizing notifications + - '/etc/alertmanager/templates/*.tmpl' diff --git a/roles/alertmanager/molecule/default/converge.yml b/roles/alertmanager/molecule/default/converge.yml index 3f7be92..470c151 100644 --- a/roles/alertmanager/molecule/default/converge.yml +++ b/roles/alertmanager/molecule/default/converge.yml @@ -2,5 +2,5 @@ - name: Converge hosts: all roles: - - role: genlab.alertmanager + - role: genlab.common.alertmanager config_source_dir: alertmanager diff --git a/roles/alertmanager/molecule/default/verify.yml b/roles/alertmanager/molecule/default/verify.yml index 0836d76..37eb46f 100644 --- a/roles/alertmanager/molecule/default/verify.yml +++ b/roles/alertmanager/molecule/default/verify.yml @@ -9,7 +9,7 @@ - name: "Include default vars" ansible.builtin.include_vars: dir: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/defaults/" - extensions: [ 'yml' ] + extensions: ['yml'] - name: "Check if Alertmanager is installed" changed_when: false From 756b5904373a2c017004b39f6ef0c568e5d7b51e Mon Sep 17 00:00:00 2001 From: Sergey Malyuk Date: Mon, 8 Dec 2025 16:44:48 +0300 Subject: [PATCH 5/6] update variables --- roles/alertmanager/tasks/configuration.yml | 4 ++-- roles/alertmanager/tasks/install.yml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/roles/alertmanager/tasks/configuration.yml b/roles/alertmanager/tasks/configuration.yml index 4932c8e..f06c996 100644 --- a/roles/alertmanager/tasks/configuration.yml +++ b/roles/alertmanager/tasks/configuration.yml @@ -4,7 +4,7 @@ notify: "(Re)start and enable Alertmanager" ansible.builtin.template: src: "{{ item }}" - dest: "{{ config_dir }}/{{ item | basename }}" + dest: "{{ alertmanager_config_dir }}/{{ item | basename }}" owner: "{{ alertmanager_user }}" group: "{{ alertmanager_group }}" mode: "0660" @@ -16,7 +16,7 @@ when: template_source_dir is defined ansible.builtin.copy: src: "{{ item }}" - dest: "{{ config_dir }}/{{ item | basename }}" + dest: "{{ alertmanager_config_dir }}/{{ item | basename }}" owner: "{{ alertmanager_user }}" group: "{{ alertmanager_group }}" mode: "0660" diff --git a/roles/alertmanager/tasks/install.yml b/roles/alertmanager/tasks/install.yml index f97a99e..db0b8c6 100644 --- a/roles/alertmanager/tasks/install.yml +++ b/roles/alertmanager/tasks/install.yml @@ -37,9 +37,9 @@ group: "{{ alertmanager_group }}" mode: "0755" with_items: - - "{{ config_dir }}" + - "{{ alertmanager_config_dir }}" - "{{ alertmanager_dir }}" - - "{{ storage_dir }}" + - "{{ alertmanager_storage_dir }}" - name: "Download Alertmanager binary" ansible.builtin.get_url: From ff206814345fe01326461f67dd3db4d52e99d5e3 Mon Sep 17 00:00:00 2001 From: Sergey Malyuk Date: Mon, 8 Dec 2025 16:48:41 +0300 Subject: [PATCH 6/6] update variables --- roles/alertmanager/templates/alertmanager.service.j2 | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/roles/alertmanager/templates/alertmanager.service.j2 b/roles/alertmanager/templates/alertmanager.service.j2 index e4ee45a..a85ae68 100644 --- a/roles/alertmanager/templates/alertmanager.service.j2 +++ b/roles/alertmanager/templates/alertmanager.service.j2 @@ -8,12 +8,12 @@ User={{ alertmanager_user }} Group={{ alertmanager_group }} Type=simple ExecStart=/usr/local/bin/alertmanager \ - --config.file={{ config_dir }}/alertmanager.yml \ - --storage.path={{ storage_dir }} + --config.file={{ alertmanager_config_dir }}/alertmanager.yml \ + --storage.path={{ alertmanager_storage_dir }} Restart=on-failure # Security hardening -ReadWritePaths={{ storage_dir }} +ReadWritePaths={{ alertmanager_storage_dir }} ProtectSystem=strict NoNewPrivileges=true PrivateTmp=true