Merge branch 'master' into role-platform1c

README.md

@@ -22,6 +22,7 @@
 - [nginx_docker](roles/nginx_docker/README.md)
 - [node_exporter](roles/node_exporter/README.md)
 - [platform1c](roles/platform1c/README.md)
+- [postgres1c](roles/postgres1c/README.md)
 - [prometheus](roles/prometheus/README.md)
 - [promtail](roles/promtail/README.md)
 - [rclone_yandex](roles/rclone_yandex/README.md)

requirements.yml

@@ -7,3 +7,4 @@ collections:
   - name: community.crypto
   - name: maxhoesel.borgbackup
   - name: lucasheld.uptime_kuma
+  - name: community.postgresql

roles/alertmanager/README.md

@@ -1,4 +1,4 @@
-genlab.alertmanager
+alertmanager
 =========
 
 The [Alertmanager](https://github.com/prometheus/alertmanager) handles alerts sent by client applications such as the Prometheus server. It takes care of deduplicating, grouping, and routing them to the correct receiver integration such as email, PagerDuty, or OpsGenie. It also takes care of silencing and inhibition of alerts.
@@ -34,13 +34,7 @@ None
 Example Playbook
 ----------------
 
-```yaml
+See: [converge.yml](molecule/default/converge.yml)
-roles:
-    - role: genlab.template
-      config_source_dir: alertmanager
-      alertmanager_version: 0.28.1
-
-```
 
 License
 -------

roles/alertmanager/meta/main.yml

@@ -10,7 +10,7 @@ galaxy_info:
 
   platforms:
     - name: "Ubuntu"
-      versions: ["focal", "jammy", "noble"]
+      versions: ["jammy", "noble"]
 
   galaxy_tags: []
 

roles/borgmatic/README.md

@@ -1,4 +1,4 @@
-ansible-borgmatic
+borgmatic
 =========
 
 This is a wrapper around the `borgmatic` role from the `maxhoesel.borgbackup` collection.
@@ -12,7 +12,7 @@ In the case of Borgmatic we are installing it via `pipx`, as recommended by thei
 Requirements
 ------------
 
-- `maxhoesel.borgbackup` collection installed (see `requirements.yml`);
+- `maxhoesel.borgbackup` collection installed;
 
 Role Variables
 --------------
@@ -27,7 +27,7 @@ None
 Example Playbook
 ----------------
 
-See `molecule/default/converge.yml`
+See: [converge.yml](molecule/default/converge.yml)
 
 License
 -------

roles/borgmatic/meta/main.yml

@@ -10,7 +10,7 @@ galaxy_info:
 
   platforms:
     - name: "Ubuntu"
-      versions: ["focal", "jammy", "noble"]
+      versions: ["jammy", "noble"]
 
   galaxy_tags: []
 

roles/curl_scheduled/.gitignore

@@ -1,2 +0,0 @@
-.vscode
-.idea

roles/curl_scheduled/README.md

@@ -1,7 +1,7 @@
-curl-scheduled
+curl_scheduled
 =========
 
-Configure curl to run on schedule by deploying a systemd service + timer. Useful for sending heartbeats.
+Configure `curl` to run on schedule by deploying a systemd service + timer. Useful for sending heartbeats.
 
 Requirements
 ------------
@@ -12,9 +12,7 @@ Role Variables
 --------------
 
 - `args`: arguments to the curl command
-
 - `url`: address to be accessed by curl
-
 - `schedule`: string compatible with systemd timer `OnSchedule` option (default: `minutely`)
 
 
@@ -26,7 +24,7 @@ None
 Example Playbook
 ----------------
 
-See `molecule/default/converge.yml`.
+See: [converge.yml](molecule/default/converge.yml)
 
 License
 -------

roles/curl_scheduled/meta/main.yml

@@ -10,7 +10,7 @@ galaxy_info:
 
   platforms:
     - name: "Ubuntu"
-      versions: ["focal", "jammy", "noble"]
+      versions: ["jammy", "noble"]
 
   galaxy_tags: []
 

roles/dnsmasq/README.md

@@ -1,7 +1,7 @@
-ansible-dnsmasq
+dnsmasq
 =========
 
-Deploy dnsmasq on the target node. For now, supports only DNS functionality (DHCP and TFTP are not configuratble).
+Deploy `dnsmasq` on the target node. For now, supports only DNS functionality (DHCP and TFTP are not configurable).
 
 Requirements
 ------------
@@ -21,10 +21,7 @@ None
 Example Playbook
 ----------------
 
-```yaml
+See: [converge.yml](molecule/default/converge.yml)
-roles:
-    - role: genlab.dnsmasq
-```
 
 License
 -------

roles/dnsmasq/meta/main.yml

@@ -10,7 +10,7 @@ galaxy_info:
 
   platforms:
     - name: "Ubuntu"
-      versions: ["focal", "jammy"]
+      versions: ["jammy", "noble"]
 
   galaxy_tags: []
 

roles/docker_ubuntu/README.md

@@ -3,10 +3,6 @@ docker_ubuntu
 
 Install Docker ecosystem on Ubuntu.
 
-[![lint](https://github.com/corvus-migratorius/ansible-docker-ubuntu/actions/workflows/lint.yaml/badge.svg)](https://github.com/corvus-migratorius/ansible-docker-ubuntu/actions/workflows/lint.yaml)
-
-[![molecule](https://github.com/corvus-migratorius/ansible-docker-ubuntu/actions/workflows/molecule.yaml/badge.svg)](https://github.com/corvus-migratorius/ansible-docker-ubuntu/actions/workflows/molecule.yaml)
-
 Requirements
 ------------
 
@@ -25,10 +21,7 @@ None
 Example Playbook
 ----------------
 
-```yaml
+See: [converge.yml](molecule/default/converge.yml)
-roles:
-    - role: genlab.common.docker_ubuntu
-```
 
 License
 -------

roles/docker_ubuntu/meta/main.yml

@@ -10,7 +10,7 @@ galaxy_info:
 
   platforms:
     - name: "Ubuntu"
-      versions: ["focal", "jammy", "noble"]
+      versions: ["jammy", "noble"]
 
   galaxy_tags: ["docker"]
 

roles/grafana/README.md

@@ -1,4 +1,4 @@
-genlab.grafana
+grafana
 =========
 
 This ansible role installs [Grafana](https://github.com/grafana/grafana) - the open-source platform for monitoring and observability. It can produce charts, graphs, and alerts for the web when connected to supported data sources.
@@ -59,42 +59,7 @@ None
 Example Playbook
 ----------------
 
-```yaml
+See: [converge.yml](molecule/default/converge.yml)
----
-- name: Converge
-  hosts: all
-  vars:
-    grafana_users:
-      - name: "test"
-        user_login: "test"
-        user_password: "test"
-        user_email: "test@mail.ru"
-        is_admin: false
-    grafana_plugins:
-        version: 2.1.8
-      - name: aceiot-svg-panel
-        version: 0.1.5
-    grafana_public_dashboards:
-      - name: Node Full Exporter
-        id: 1860
-        revision: 36
-  vars_files:
-    - secrets/admin_cred.yml
-
-  roles:
-    - role: genlab.grafana
-      grafana_version: 11.5.0
-      admin_api_username: "{{ grafana.admin_api_username }}"
-      admin_api_password: "{{ grafana.admin_api_password }}"
-      users: "{{ grafana_users }}"
-      plugins: "{{ grafana_plugins }}"
-      public_dashboards: "{{ grafana_public_dashboards }}"
-      dashboard_source_path: "molecule/default/dashboards"
-      datasource_source_path: "molecule/default/datasources"
-      grafana_log_dir: "/opt/grafana/data"
-      grafana_data_dir: "/opt/grafana/lib"
-
-```
 
 License
 -------

roles/grafana/meta/main.yml

@@ -10,7 +10,7 @@ galaxy_info:
 
   platforms:
     - name: "Ubuntu"
-      versions: ["focal", "jammy", "noble"]
+      versions: ["jammy", "noble"]
 
   galaxy_tags: []
 

roles/ipmi_exporter/README.md

@@ -1,4 +1,4 @@
-genlab.ipmi_exporter
+ipmi_exporter
 =========
 
 This Ansible role installs ipmi_exporter on target host. This is a Prometheus exporter for Intelligent Platform Management Interface [metrics](https://github.com/prometheus-community/ipmi_exporter/blob/master/docs/metrics.md)
@@ -6,13 +6,19 @@ This Ansible role installs ipmi_exporter on target host. This is a Prometheus ex
 Requirements
 ------------
 
-By default, the exporter relies on tools from the FreeIPMI suite for the actual IPMI implementation.
+Target node:
+
+- `tar`
+- `gzip`
+- `freeipmi`
 
 Role Variables
 --------------
-Configuration files must have names ```web_conf.yaml``` and ```ipmi_local.conf```. If ipmi_exp_source_dir is specified, the role searches for ```web_conf.yaml``` and ```ipmi_local.conf``` in that directory and copy to target host in ```ipmi_exp_config_dir```. If the source directory is not specified, the role skips this step. In ipmi_local.conf user can describe what modules to use for metric collection.
+Configuration files must have names `web_conf.yaml` and `ipmi_local.conf`. If `ipmi_exporter_local_conf` is specified, the role searches for `web_conf.yaml` and `ipmi_local.conf` in that directory and copy to target host in `ipmi_exporter_config_dir`. If the source directory is not specified, the role skips this step. In ipmi_local.conf user can describe what modules to use for metric collection.
 
-ipmi_up{collector="<NAME>"} is 1 if the data for this collector could successfully be retrieved from the remote host, 0 otherwise. The following collectors are available and can be enabled or disabled in the config:
+ipmi_up{collector="<NAME>"} is 1 if the data for this collector could successfully be retrieved from the remote host, 0 otherwise.
+
+The following collectors are available and can be enabled or disabled in the config:
 - ipmi: collects IPMI sensor data. If it fails, sensor metrics (see below) will not be available
 - dcmi: collects DCMI data, currently only power consumption. If it fails, power consumption metrics (see below) will not be available
 - bmc: collects BMC details. If it fails, BMC info metrics (see below) will not be available
@@ -22,17 +28,18 @@ ipmi_up{collector="<NAME>"} is 1 if the data for this collector could successful
 - sel-events: collects metrics for user-defined events in system event log (SEL). If it fails, SEL entries metrics (see below) will not be available
 - sm-lan-mode: collects the "LAN mode" setting in the current BMC config. If it fails, the LAN mode metric (see below) will not be available
 
-```yaml
+- `ipmi_exporter_version`: release version of the exporter
-ipmi_exp_version: 1.10.1
+- `ipmi_exporter_config_dir`: where to put configuration files
-ipmi_exp_dir: "/etc/exporters"
+- `ipmi_exporter_args`:
-ipmi_exp_config_dir: "/etc/exporters/config"
+    - `--[no-]native-ipmi`: Use native IPMI implementation instead of FreeIPMI (EXPERIMENTAL)
-ipmi_exp_args: "" # --[no-]native-ipmi Use native IPMI implementation instead of FreeIPMI (EXPERIMENTAL)
+    - `--[no-]web.systemd-socket`: Use systemd socket activation listeners instead of port listeners (Linux only).
-                  # --[no-]web.systemd-socket Use systemd socket activation listeners instead of port listeners (Linux only).
+- `ipmi_exporter_log_level`: "info" # Only log messages with the given severity or above. One of: [debug, info, warn, error]
-ipmi_exp_log_level: "info" # Only log messages with the given severity or above. One of: [debug, info, warn, error]
+- `ipmi_exporter_log_format`: "logfmt" # Output format of log messages. One of: [logfmt, json]
-ipmi_exp_log_format: "logfmt" # Output format of log messages. One of: [logfmt, json]
+- `ipmi_exporter_web_listen_address`: Addresses on which to expose metrics and web interface. Repeatable for multiple addresses.    
-ipmi_exp_web_listen_address: "localhost:9290" # Addresses on which to expose metrics and web interface. Repeatable for multiple addresses. Examples: `:9100` or `[::1]:9100` for http, vsock://:9100` for vsock
+    - `:9100` or `[::1]:9100` for HTTP
-ipmi_exp_source_dir: ipmi_local.conf # Path to configuration file. See: https://github.com/prometheus-community/ipmi_exporter/blob/master/docs/configuration.md
+    - `vsock://:9100` for vsock
-ipmi_exp_web_source_dir: web_conf.yaml # Path to configuration file that can enable TLS or authentication. See: https://github.com/prometheus/exporter-toolkit/blob/master/docs/web-configuration.md
+- `ipmi_exporter_local_conf`: (optional) Path to local configuration file. See: https://github.com/prometheus-community/ipmi_exporter/blob/master/docs/configuration.md
+- `ipmi_exporter_web_conf`: (optional) Path to web configuration file that can enable TLS or authentication. See: https://github.com/prometheus/exporter-toolkit/blob/master/docs/web-configuration.md
 ```
 
 Dependencies
@@ -43,12 +50,7 @@ None
 Example Playbook
 ----------------
 
-```yaml
+See: [converge.yml](molecule/default/converge.yml)
-  roles:
-    - role: genlab.ipmi_exporter
-      ipmi_exp_version: "1.10.1"
-      ipmi_exp_source_dir: "molecule/default/"
-```
 
 License
 -------

roles/ipmi_exporter/defaults/main.yml

@@ -1,8 +1,7 @@
 ---
 ipmi_exporter_version: 1.10.1
-ipmi_exporter_dir: "/etc/exporters"
+ipmi_exporter_config_dir: "/etc/ipmi_exporter"
-ipmi_exporter_config_dir: "/etc/exporters/config"
 ipmi_exporter_log_level: "info"
 ipmi_exporter_log_format: "logfmt"
-ipmi_exporter_web_listen_address: "localhost:9290"
+ipmi_exporter_web_listen_address: "0.0.0.0:9290"
 ipmi_exporter_args: ""

roles/ipmi_exporter/meta/main.yml

@@ -10,7 +10,7 @@ galaxy_info:
 
   platforms:
     - name: "Ubuntu"
-      versions: ["focal", "jammy", "noble"]
+      versions: ["jammy", "noble"]
 
   galaxy_tags: []
 

roles/ipmi_exporter/molecule/default/converge.yml

@@ -3,4 +3,4 @@
   hosts: all
   roles:
     - role: genlab.common.ipmi_exporter
-      ipmi_exp_source_dir: "molecule/default/"
+      ipmi_exporter_local_conf: "configs/local.conf"

roles/ipmi_exporter/tasks/configure.yml

@@ -1,20 +1,20 @@
 ---
-- name: "Upload ipmi_exporter local configure file"
+- name: "Configure | Upload local configuration file"
   notify: "(Re)start and enable ipmi_exporter"
-  when: ipmi_exp_source_dir is defined and ipmi_exp_source_dir | length > 0
+  when: ipmi_exporter_local_conf is defined
   ansible.builtin.template:
-    src: "{{ ipmi_exp_source_dir }}/ipmi_local.conf"
+    src: "{{ ipmi_exporter_local_conf }}"
-    dest: "{{ ipmi_exporter_config_dir }}/ipmi_local.conf"
+    dest: "{{ ipmi_exporter_config_dir }}/local.conf"
     owner: root
     group: root
     mode: '0640'
 
-- name: "Upload ipmi_exporter web configure file"
+- name: "Configure | Upload web configuration file"
   notify: "(Re)start and enable ipmi_exporter"
-  when: ipmi_exp_web_source_dir is defined and ipmi_exp_web_source_dir | length > 0
+  when: ipmi_exporter_web_conf is defined
   ansible.builtin.template:
-    src: "{{ ipmi_exp_web_source_dir }}/web_conf.yaml"
+    src: "{{ ipmi_exporter_web_conf }}"
-    dest: "{{ ipmi_exporter_config_dir }}/web_conf.yaml"
+    dest: "{{ ipmi_exporter_config_dir }}/web.yaml"
     owner: root
     group: root
     mode: '0640'

roles/ipmi_exporter/tasks/install.yml

@@ -1,48 +1,49 @@
 ---
-- name: "Install ipmi_exporter from binary"
+- name: "Install | Install ipmi_exporter binary"
   block:
-    - name: "Check ipmi_exporter version"
+    - name: "Install | Check ipmi_exporter availability"
       changed_when: false
+      register: ipmi_exporter_ver
       ansible.builtin.command:
         cmd: "ipmi_exporter --version"
-      register: ipmi_exporter_ver
 
-    - name: "Assert version correctness"
+    - name: "Install | Assert version correctness"
       ansible.builtin.assert:
         that: "ipmi_exporter_ver.stdout is regex('{{ ipmi_exporter_version }}')"
         success_msg: "ipmi_exporter version {{ ipmi_exporter_version }} is installed and working"
         fail_msg: "ipmi_exporter version {{ ipmi_exporter_version }} is not installed or not working correctly"
 
   rescue:
-    - name: "Create ipmi_exporter directories"
+    - name: "Install | Create directories"
+      loop:
+        - "{{ ipmi_exporter_config_dir }}"
       ansible.builtin.file:
         path: "{{ item }}"
         state: directory
         owner: root
         group: root
         mode: "0755"
-      with_items:
-        - "{{ ipmi_exporter_dir }}"
-        - "{{ ipmi_exporter_config_dir }}"
 
-    - name: "Unarchive ipmi_exporter tar file"
+    - name: "Install | Fetch and unarchive the release tarball"
       notify: "(Re)start and enable ipmi_exporter"
+      delay: 3
+      retries: 3
       ansible.builtin.unarchive:
         src: "https://github.com/prometheus-community/ipmi_exporter/releases/\
             download/v{{ ipmi_exporter_version }}/ipmi_exporter-{{ ipmi_exporter_version }}.linux-amd64.tar.gz"
-        dest: "{{ ipmi_exporter_dir }}"
+        dest: "/tmp/"
         remote_src: true
 
-    - name: "Move ipmi_exporter binary"
+    - name: "Install | Rename and move the binary under PATH"
       ansible.builtin.copy:
-        src: "{{ ipmi_exporter_dir }}/ipmi_exporter-{{ ipmi_exporter_version }}.linux-amd64/ipmi_exporter"
+        src: "/tmp/ipmi_exporter-{{ ipmi_exporter_version }}.linux-amd64/ipmi_exporter"
-        dest: "/usr/local/bin/ipmi_exporter"
+        dest: "/usr/sbin/ipmi_exporter"
         mode: "0755"
         owner: root
         group: root
         remote_src: true
 
-- name: Create systemd service file
+- name: "Install | Create a systemd service file"
   ansible.builtin.template:
     src: ipmi_exporter.service.j2
     dest: /etc/systemd/system/ipmi_exporter.service

roles/ipmi_exporter/templates/ipmi_exporter.service.j2

@@ -7,18 +7,18 @@ StartLimitBurst=5
 
 [Service]
 Type=simple
-ExecStart=/usr/local/bin/ipmi_exporter \
+ExecStart=/usr/sbin/ipmi_exporter \
     --web.listen-address={{ ipmi_exporter_web_listen_address }} \
     --log.level={{ ipmi_exporter_log_level }} \
     --log.format={{ ipmi_exporter_log_format }} \
 {% if ipmi_exporter_args is defined and ipmi_exporter_args | length > 0 %}
       {{ ipmi_exporter_args }} \
 {% endif %}
-{% if ipmi_exporter_source_dir is defined and ipmi_exporter_source_dir | length > 0 %}
+{% if ipmi_exporter_local_conf is defined %}
-    --config.file={{ ipmi_exporter_config_dir }}/ipmi_local.conf \
+    --config.file={{ ipmi_exporter_config_dir }}/local.conf \
 {% endif %}
-{% if ipmi_exporter_web_source_dir is defined and ipmi_exporter_web_source_dir | length > 0 %}
+{% if ipmi_exporter_web_conf is defined %}
-    --web.config.file={{ ipmi_exporter_config_dir }}/web_conf.yaml
+    --web.config.file={{ ipmi_exporter_config_dir }}/web.yaml
 {% endif %}
 
 SyslogIdentifier=ipmi_exporter

roles/karma/.gitignore

@@ -1,2 +0,0 @@
-.vscode
-.idea

roles/karma/README.md

@@ -1,13 +1,8 @@
-genlab.karma
+karma
 =========
-This is the ansible role to install and configure Karma - alert dashboard for Prometheus Alertmanager (https://github.com/prymitive/karma)
 
-------------
+Install and configure Karma - an alert dashboard for Prometheus Alertmanager (https://github.com/prymitive/karma)
-⚠️ Do not forget to update:
 
-- `meta/main.yml`
-- Conda/Mamba manifests
-- this README =) including *the name at the top* and *maintainers*.
 
 Requirements
 ------------
@@ -33,14 +28,7 @@ None
 Example Playbook
 ----------------
 
-```yaml
+See: [converge.yml](molecule/default/converge.yml)
-roles:
-    - role: genlab.karma
-      karma_version: "0.121"
-      config_source_dir: "karma/"
-      karma_dir: "/etc/karma"
-      karma_config_dir: "/etc/karma/config"
-```
 
 License
 -------

roles/karma/meta/main.yml

@@ -10,7 +10,7 @@ galaxy_info:
 
   platforms:
     - name: "Ubuntu"
-      versions: ["focal", "jammy", "noble"]
+      versions: ["jammy", "noble"]
 
   galaxy_tags: [monitoring]
 

roles/loki/README.md

@@ -1,5 +1,5 @@
 loki
-=========
+====
 
 Installs Loki as a `systemd` service.
 
@@ -23,11 +23,7 @@ No
 Example Playbook
 ----------------
 
-```yaml
+See: [converge.yml](molecule/default/converge.yml)
-roles:
-  - role: loki
-    loki_version: 2.7.3
-```
       
 
 License

roles/loki/meta/main.yml

@@ -10,7 +10,7 @@ galaxy_info:
 
   platforms:
     - name: "Ubuntu"
-      versions: ["focal", "jammy"]
+      versions: ["jammy", "noble"]
 
   galaxy_tags: []
 

roles/mkfs/README.md

@@ -1,5 +1,5 @@
-Role Name
+mkfs
-=========
+====
 
 Create a filesystem on the target device (thinly wraps `community.general.filesystem` module).
 

roles/mount_device/README.md

@@ -1,5 +1,5 @@
-ansible-mount-device
+mount_device
-=========
+============
 
 Mount the given block device.
 

roles/nginx/.gitignore

@@ -1,2 +0,0 @@
-.vscode
-.idea

roles/nginx/README.md

@@ -1,5 +1,5 @@
-ansible-nginx
+nginx
-=========
+=====
 
 Deploy NGINX with a minimal configuration.
 
@@ -21,10 +21,7 @@ None
 Example Playbook
 ----------------
 
-```yaml
+See: [converge.yml](molecule/default/converge.yml)
-roles:
-    - role: genlab.nginx
-```
 
 License
 -------

roles/nginx/meta/main.yml

@@ -10,7 +10,7 @@ galaxy_info:
 
   platforms:
     - name: "Ubuntu"
-      versions: ["focal", "jammy", "noble"]
+      versions: ["jammy", "noble"]
 
   galaxy_tags: []
 

roles/node_exporter/README.md

@@ -1,17 +1,21 @@
-Role Name
+node_exporter
-=========
+=============
 
 Deploy `prometheus/node_exporter` binary as a systemd unit.
 
 Requirements
 ------------
 
-None
+Target node:
+
+- `tar`
+- `gzip`
+
 
 Role Variables
 --------------
 
-`node_exporter_bin_path`: where to install the binary (default: `/usr/bin`).
+- `node_exporter_bin_path`: where to install the binary (default: `/usr/bin`).
 
 Dependencies
 ------------

roles/node_exporter/meta/main.yml

@@ -10,7 +10,7 @@ galaxy_info:
 
   platforms:
     - name: "Ubuntu"
-      versions: ["focal", "jammy"]
+      versions: ["jammy", "noble"]
 
   galaxy_tags: ["prometheus"]
 

roles/postgres1c/README.md

@@ -0,0 +1,40 @@
+postgres1c
+=========
+
+Installs postgrespro1c (https://1c.postgres.ru/) as a system service.
+
+Requirements
+------------
+
+Linux (tested on Ubuntu 22.04)
+
+Role Variables
+--------------
+
+`postgres1c_major_ver`: major version of the distribution to be installed
+`postgres1c_postgres_pw`: password for user 'postgres'
+`postgres1c_postgres_pw_path`: path to the (Ansible-encrypted) YAML file containing a password (see `molecule/default/secrets/`)
+
+Dependencies
+------------
+
+- community.postgresql
+
+Example Playbook
+----------------
+
+See `molecule/default/coverge.yaml` for an example.
+
+License
+-------
+
+BSD
+
+Author Information
+------------------
+
+Danilkin Danila (MIPT) and Alexander Gorelyshev
+
+Genlab, LLC
+
+corvus-migratorius@proton.me

roles/postgres1c/defaults/main.yml

@@ -0,0 +1 @@
+---

roles/postgres1c/files/postgres1c_backup.service

@@ -0,0 +1,9 @@
+[Unit]
+Description=Backup 1C script
+Documentation=https://github.com/corvus-migratorius/genlab-ansible
+
+[Service]
+User=postgres
+Group=postgres
+Type=oneshot
+ExecStart=/bin/bash /opt/postgres1c_backup/backup.sh

roles/postgres1c/handlers/main.yml

@@ -0,0 +1,2 @@
+---
+# handlers file for oneget

roles/postgres1c/meta/main.yml

@@ -0,0 +1,14 @@
+---
+galaxy_info:
+  role_name: postgres1c
+  namespace: genlab
+  author: Danila Danilkin
+  description: Install PostgreSQL (1C version) as a system service
+  platforms:
+    - name: "Ubuntu"
+      versions: ["jammy", "noble"]
+  company: Genlab, LLC
+  license: BSD
+  min_ansible_version: "2.1"
+  galaxy_tags: []
+dependencies: []

roles/postgres1c/molecule/default/converge.yml

@@ -0,0 +1,10 @@
+---
+- name: Converge
+  hosts: all
+  roles:
+    - role: genlab.common.postgres1c
+      postgres1c_version: 15
+      postgres1c_postgres_pw_path: "secrets/postgresql.yaml"
+      postgres1c_backup_timer: "Sat *-*-* 02:00:00"
+      postgres1c_backup_compression: "5"
+      # backup enabled by default at /var/backups/postgres1c/backup_<db_name>.dump

roles/postgres1c/molecule/default/molecule.yml

@@ -0,0 +1,22 @@
+---
+dependency:
+  name: galaxy
+driver:
+  name: docker
+platforms:
+  - name: ubuntu
+    image: geerlingguy/docker-${MOLECULE_DISTRO:-ubuntu2204}-ansible:latest
+    pre_build_image: true
+    command: ${MOLECULE_DOCKER_COMMAND:-""}
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+    cgroupns_mode: host
+    privileged: true
+provisioner:
+  name: ansible
+verifier:
+  name: ansible
+lint: |
+  set -e
+  yamllint .
+  ansible-lint .

roles/postgres1c/molecule/default/secrets/postgresql.yaml

@@ -0,0 +1,2 @@
+---
+postgres1c_postgres_pw: 12345

roles/postgres1c/molecule/default/verify.yml

@@ -0,0 +1,61 @@
+---
+- name: Verify
+  hosts: all
+  gather_facts: false
+  vars:
+    postgres1c_major_ver: 15
+    postgres1c_version: 15
+  tasks:
+    - name: "Include default role vars"
+      ansible.builtin.include_vars:
+        dir: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/defaults/"
+        extensions: ['yml']
+
+    - name: "Get 'postgres' user password"
+      tags: [postgres1c]
+      ansible.builtin.include_vars:
+        file: "secrets/postgresql.yaml"
+
+    - name: "Check that PostgreSQL server responds to the 'postgres' user credentials"
+      register: postgres1c__verify_db_version
+      community.postgresql.postgresql_info:
+        login_host: localhost
+        login_user: postgres
+        login_password: "{{ postgres1c_postgres_pw }}"
+        filter: "version"
+
+    - name: "Verify that correct PostgreSQL version is installed"
+      ansible.builtin.assert:
+        that: postgres1c__verify_db_version.version.major == postgres1c_major_ver
+        success_msg: >
+          Detected expected PostgreSQL version
+          '{{ postgres1c__verify_db_version.version.major }}'
+          ({{ postgres1c__verify_db_version.version }})"
+        fail_msg: >
+          Expected PostgreSQL version '{{ postgres1c_major_ver }}';
+          Actual '{{ postgres1c__verify_db_version.version.major }}'
+          ({{ postgres1c__verify_db_version.version.major }})"
+
+    - name: Start service postgrespro-1c (i.e. do nothing and throw fail if it start)
+      ansible.builtin.service:
+        name: "postgrespro-1c-{{ postgres1c_version }}"
+        state: started
+      register: postgres1c_start_postgrespro1c
+      failed_when: postgres1c_start_postgrespro1c.changed
+
+    - name: Create a new database with name "test"
+      tags: [postgres1c]
+      become: true
+      become_user: postgres
+      community.postgresql.postgresql_db:
+        name: test
+        comment: "test-db"
+        login_unix_socket: "/tmp"
+
+    - name: Test backup without cron
+      tags: [postgres1c]
+      become: true
+      become_user: postgres
+      ansible.builtin.command: /opt/postgres1c_backup/backup.sh
+      args:
+        creates: /var/backups/postgres1c/backup_test.tar

roles/postgres1c/tasks/backup.yaml

@@ -0,0 +1,40 @@
+- name: "Create opt script directory and backup directory"
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: postgres
+    group: postgres
+    mode: "0770"
+  loop:
+    - "/var/backups/postgres1c"
+    - "/opt/postgres1c_backup"
+
+- name: "Copy backup script"
+  ansible.builtin.template:
+    src: "backup.sh.j2"
+    dest: "/opt/postgres1c_backup/backup.sh"
+    owner: postgres
+    group: postgres
+    mode: "0770"
+
+- name: "Copy backup service"
+  ansible.builtin.copy:
+    src: "postgres1c_backup.service"
+    dest: "/etc/systemd/system/"
+    owner: root
+    group: root
+    mode: "0770"
+
+- name: "Copy backup timer"
+  ansible.builtin.template:
+    src: "postgres1c_backup.timer.j2"
+    dest: "/etc/systemd/system/postgres1c_backup.timer"
+    owner: root
+    group: root
+    mode: "0770"
+
+- name: "Start backup timer"
+  ansible.builtin.systemd_service:
+    name: "postgres1c_backup.timer"
+    state: started
+    enabled: true

roles/postgres1c/tasks/main.yml

@@ -0,0 +1,88 @@
+---
+- name: "Ensure ACL is installed"
+  tags: [postgres1c]
+  ansible.builtin.apt:
+    name: acl
+    state: present
+    update_cache: true
+    cache_valid_time: 3600
+
+- name: "Install PostgreSQL distribution for 1C"
+  tags: [postgres1c]
+  block:
+    - name: "Сheck if already installed"
+      tags: [postgres1c]
+      check_mode: true
+      ansible.builtin.package:
+        name: "postgrespro-1c-{{ postgres1c_version }}-contrib"
+        state: present
+
+  rescue:
+    - name: "Download the offical postgrespro1c installation script"
+      tags: [postgres1c]
+      ansible.builtin.get_url:
+        url: "https://repo.postgrespro.ru/1c/1c-{{ postgres1c_version }}/keys/pgpro-repo-add.sh"
+        dest: "/root/pgpro-repo-add.sh"
+        mode: '0755'
+
+    - name: "Add repos using the installation script"
+      tags: [postgres1c]
+      changed_when: false
+      ansible.builtin.command:
+        cmd: "/root/pgpro-repo-add.sh"
+
+    - name: "Install the 'postgrespro1c' package (and force apt update)"
+      tags: [postgres1c]
+      ansible.builtin.apt:
+        name: "postgrespro-1c-{{ postgres1c_version }}-contrib"
+        state: present
+        update_cache: true # we just added new repo, so we need to apt update
+
+    - name: "Ensure the 'ru_RU.UTF-8' locale exists"
+      tags: [postgres1c]
+      community.general.locale_gen:
+        name: ru_RU.UTF-8
+        state: present
+
+    - name: "Run initdb"
+      tags: [postgres1c]
+      changed_when: false
+      ansible.builtin.command:
+        cmd: "/opt/pgpro/1c-{{ postgres1c_version }}/bin/pg-setup initdb --locale ru_RU.UTF-8"
+
+    - name: "Enable postgrespro1c service"
+      tags: [postgres1c]
+      changed_when: false
+      ansible.builtin.command:
+        cmd: "/opt/pgpro/1c-{{ postgres1c_version }}/bin/pg-setup service enable"
+
+    - name: "Start postgrespro1c service"
+      tags: [postgres1c]
+      changed_when: false
+      ansible.builtin.command:
+        cmd: "/opt/pgpro/1c-{{ postgres1c_version }}/bin/pg-setup service start"
+
+- name: "Install psycopg2 (to connect to postgres)"
+  tags: [postgres1c]
+  ansible.builtin.package:
+    name: "python3-psycopg2"
+    state: present
+
+- name: "Get 'postgres' user password"
+  tags: [postgres1c]
+  ansible.builtin.include_vars:
+    file: "{{ postgres1c_postgres_pw_path }}"
+
+- name: "Set password for user 'postgres' via the Unix socket"
+  tags: [postgres1c]
+  become: true
+  become_user: postgres
+  community.postgresql.postgresql_user:
+    db: "postgres"
+    name: "postgres"
+    password: "{{ postgres1c_postgres_pw }}"
+    login_unix_socket: "/tmp"
+
+- name: "Create local postgres1c backup with systemd-timer"
+  tags: [postgres1c, postgres1c-backup]
+  ansible.builtin.include_tasks: backup.yaml

roles/postgres1c/templates/backup.sh.j2

@@ -0,0 +1,35 @@
+#!/bin/bash
+
+set -eu -o pipefail
+
+readonly POSTGRES_VER={{ postgres1c_version }}
+readonly POSTGRES_COMPRESS={{ postgres1c_backup_compression }}
+
+echo "Starting 1C backup at $(date +F'%Y-%m-%d %H:%M:%S')"
+
+# db list array
+echo "getting a list of database names via psql ..."
+databases=($(/opt/pgpro/1c-${POSTGRES_VER}/bin/psql -t -A -c "SELECT datname FROM pg_database WHERE datname <> ALL ('{template0,template1,postgres}')"))
+echo "database names: ${databases[@]}"
+
+# get current seconds since shell invocation
+start_time=$SECONDS
+
+# iterate over the db list array
+for db in "${databases[@]}"; do
+  start_one_time=$SECONDS
+  echo "${db} - backup started"
+
+  # local backup command (don't forget to sync to a remote server by borg or some other tool)
+  # -Fc: "custom format" https://www.postgresql.org/docs/current/app-pgdump.html
+  # -Z: compression
+  /opt/pgpro/1c-${POSTGRES_VER}/bin/pg_dump -d ${db} -Fc -Z ${POSTGRES_COMPRESS} -f /var/backups/postgres1c/backup_${db}.dump
+
+  # notify about the db dump completion
+  echo "${db} - backup done"
+  total_one_time=$(($SECONDS - start_one_time))
+  echo "${db} - total time: ${total_one_time} sec"
+done
+
+total_time=$(($SECONDS - start_time))
+echo "job completed at $(date); total time elapsed: ${total_time} sec"

roles/postgres1c/templates/postgres1c_backup.timer.j2

@@ -0,0 +1,12 @@
+[Unit]
+Description=Run backup 1C script.
+Documentation=https://github.com/corvus-migratorius/genlab-ansible
+
+[Timer]
+Unit=postgres1c_backup.service
+OnCalendar={{ postgres1c_backup_timer }}
+Persistent=true
+AccuracySec=1min
+
+[Install]
+WantedBy=timers.target

roles/prometheus/README.md

@@ -1,14 +1,19 @@
-genlab.prometheus
+prometheus
-=========
+==========
 
-This ansible role installs [Prometheus](https://github.com/prometheus/prometheus) from binary distribution. Prometheus is a systems and service monitoring system. It collects metrics from configured targets at given intervals, evaluates rule expressions, displays the results, and can trigger alerts when specified conditions are observed.
+Install [Prometheus](https://github.com/prometheus/prometheus) binary from GitHub.
+
+Prometheus collects metrics from configured targets at given intervals, evaluates rule expressions, displays the results, and can trigger alerts when specified conditions are observed.
 
 Prometheus configuration files and rules should be placed in separate directories in the source. They must have a `*.yml` suffix. You'll need to manually specify the paths to your rule files in the main Prometheus configuration file (prometheus.yml) on the target machine
 
 Requirements
 ------------
 
-None
+Target node:
+
+- `tar`
+- `gzip`
 
 Role Variables
 --------------
@@ -31,13 +36,7 @@ None
 Example Playbook
 ----------------
 
-```yaml
+See: [converge.yml](molecule/default/converge.yml)
-roles:
-    - role: genlab.prometheus
-      prometheus_config_source_dir: mydir/configs
-      prometheus_alertrules_source_dir: mydir/configs/rules
-      prometheus_version: 3.2.1
-```
 
 License
 -------
@@ -48,3 +47,4 @@ Author Information
 ------------------
 
 corvus-migratorius@proton.me
+sayganova@genlab.llc

roles/prometheus/meta/main.yml

@@ -10,7 +10,7 @@ galaxy_info:
 
   platforms:
     - name: "Ubuntu"
-      versions: ["focal", "jammy", "noble"]
+      versions: ["jammy", "noble"]
 
   galaxy_tags: []
 

roles/promtail/README.md

@@ -1,7 +1,7 @@
 promtail
-=========
+========
 
-Installs promtail as systemd service.
+Installs `promtail` as a systemd service.
 
 Requirements
 ------------
@@ -19,15 +19,12 @@ Role Variables
 Dependencies
 ------------
 
-No
+None
 
 Example Playbook
 ----------------
 
-    - hosts: servers
+See: [converge.yml](molecule/default/converge.yml)
-      roles:
-         - role: promtail
-           promtail_version: 2.7.3
 
 License
 -------
@@ -39,6 +36,4 @@ Author Information
 
 Alexander Gorelyshev and Danilkin Danila (MIPT)
 
-Genlab LLC
-
 corvus-migratorius@proton.me

roles/promtail/meta/main.yml

@@ -9,6 +9,10 @@ galaxy_info:
 
   min_ansible_version: "2.1"
 
+  platforms:
+    - name: "Ubuntu"
+      versions: ["jammy", "noble"]
+
   galaxy_tags: []
 
 dependencies: []

roles/rclone_yandex/.gitignore

@@ -1,2 +0,0 @@
-.vscode
-.idea

roles/rclone_yandex/README.md

@@ -1,12 +1,12 @@
-Role Name
+rclone_yandex
-=========
+=============
 
-A brief description of the role goes here.
+Mount a Yandex Disk share via `rclone`. 
 
 Requirements
 ------------
 
-Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
+None
 
 Role Variables
 --------------
@@ -18,17 +18,12 @@ Role Variables
 Dependencies
 ------------
 
-A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
+None
 
 Example Playbook
 ----------------
 
-```yaml
+See: [converge.yml](molecule/default/converge.yml)
-roles:
-  - role: rclone_yandex
-    rclone_mountpoint: /mnt/yandex-disk
-    rclone_group: yandex
-```
 
 License
 -------

roles/rclone_yandex/meta/main.yml

@@ -10,7 +10,7 @@ galaxy_info:
 
   platforms:
     - name: "Ubuntu"
-      versions: ["focal", "jammy"]
+      versions: ["jammy", "noble"]
 
   galaxy_tags: []
 

roles/rustdesk/README.md

@@ -1,22 +1,22 @@
-Rustdesk Server
+rustdesk
-=========
+========
 
-Rustdesk server role for ansible
+Deploy a Rustdesk server
 
 Requirements
 ------------
 
 Ports:  
-```
+
-tcp 21115, 21116, 21117, 21118, 21119  
+- `tcp`: `21115, 21116, 21117, 21118, 21119`
-udp 21116
+- `udp`: `21116`
 ```
 
 Role Variables
 --------------
 
-``` rustdesk_server_version ``` — contains rustdesk-server version to be installed  
+`rustdesk_server_version`: contains rustdesk-server version to be installed  
-``` rustdesk_client_version ``` — contains rustdesk-client version for executable to be configured
+`rustdesk_client_version`: contains rustdesk-client version for executable to be configured
 
 Dependencies
 ------------
@@ -26,10 +26,7 @@ None
 Example Playbook
 ----------------
 
-```yaml
+See: [converge.yml](molecule/default/converge.yml)
-roles:
-    - role: genlab.rustdesk_server
-```
 
 License
 -------

roles/rustdesk/meta/main.yml

@@ -10,7 +10,7 @@ galaxy_info:
 
   platforms:
     - name: "Ubuntu"
-      versions: ["focal", "jammy", "noble"]
+      versions: ["jammy", "noble"]
 
   galaxy_tags: []
 

roles/sftp_share/README.md

@@ -1,7 +1,7 @@
-SFTP Share Ansible Role
+sftp_share
 =========
 
-Creates a user account and directories for secured SFTP data exchange (one user = one share).
+Creates a user account and directories for a secured SFTP data exchange (one user = one share).
 
 The role creates a dedicated SSH config under `/etc/ssh/sshd_config.d/`, configuring:
 
@@ -60,7 +60,7 @@ None
 Example Playbook
 ----------------
 
-See `molecule/default/converge.yml` for an example role invocation.
+See: [converge.yml](molecule/default/converge.yml)
 
 License
 -------

roles/sftp_share/meta/main.yml

@@ -10,7 +10,7 @@ galaxy_info:
 
   platforms:
     - name: "Ubuntu"
-      versions: ["focal", "jammy", "noble"]
+      versions: ["jammy", "noble"]
 
   galaxy_tags: []
 

roles/smartctl_exporter/.gitignore

@@ -1,2 +0,0 @@
-.vscode
-.idea

roles/smartctl_exporter/README.md

@@ -1,18 +1,18 @@
-genlab.smartctl-exporter
+smartctl_exporter
-=========
+=================
 
-```smartctl``` is a command-line utility used to control and monitor the Self-Monitoring, Analysis and Reporting Technology (SMART) system in hard disk drives (HDDs) and solid-state drives (SSDs). ```smartctl-exporter``` exports ```smartctl``` statistics to Prometheus.
+`smartctl` is a command-line utility used to control and monitor the Self-Monitoring, Analysis and Reporting Technology (SMART) system in hard disk drives (HDDs) and solid-state drives (SSDs). `smartctl-exporter` exports `smartctl` statistics to Prometheus.
 
 Requirements
 ------------
 
-smartctl 
+- `smartctl` 
 
 Role Variables
 --------------
-The exporter will scan the system for available devices if no ```--smartctl.device``` flags are used. The format of web.config file id described [here](https://github.com/prometheus/exporter-toolkit/blob/master/docs/web-configuration.md). If ```smartctl_exp_source_web_config_dir``` is defined, role searches for ```web_smartctl.conf``` file and copy it to target host to ```smartctl_exp_web_config_dir``` directory
+The exporter will scan the system for available devices if no `--smartctl.device` flags are used. The format of web.config file id described [here](https://github.com/prometheus/exporter-toolkit/blob/master/docs/web-configuration.md). If `smartctl_exp_source_web_config_dir` is defined, role searches for `web_smartctl.conf` file and copy it to target host to `smartctl_exp_web_config_dir` directory
+
 ```yaml
----
 smartctl_exp_port: "localhost:9633"  # Addresses on which to expose metrics and web interface. Repeatable for multiple addresses.
 smartctl_exp_version: "0.14.0" # exporter version to install
 smartctl_exp_dir: "/etc/exporters" # where to download and unarchive expoter 
@@ -37,13 +37,7 @@ None
 Example Playbook
 ----------------
 
-```yaml
+See: [converge.yml](molecule/default/converge.yml)
-roles:
-- role: genlab.smartctl_exporter
-    smartctl_exp_version: "0.14.0"
-    smartctl_exp_dir: "/etc/exporters"
-    smartctl_exp_config_dir: "/etc/exporters/config"
-```
 
 License
 -------

roles/smartctl_exporter/meta/main.yml

@@ -10,7 +10,7 @@ galaxy_info:
 
   platforms:
     - name: "Ubuntu"
-      versions: ["focal", "jammy", "noble"]
+      versions: ["jammy", "noble"]
 
   galaxy_tags: []
 

roles/sshd/README.md

@@ -1,7 +1,7 @@
-ansible-sshd
+sshd
-=========
+====
 
-Deploy a hardened sshd server
+Deploy a hardened `sshd` server
 
 Requirements
 ------------
@@ -21,10 +21,7 @@ None
 Example Playbook
 ----------------
 
-```yaml
+See: [converge.yml](molecule/default/converge.yml)
-roles:
-    - role: genlab.common.sshd
-```
 
 License
 -------

roles/swapfile/README.md

@@ -1,5 +1,5 @@
-ansible-swapfile
+swapfile
-=========
+========
 
 Create/destroy a swapfile and run swapon/-off on it.
 
@@ -23,10 +23,7 @@ None
 Example Playbook
 ----------------
 
-```yaml
+See: [converge.yml](molecule/default/converge.yml)
-roles:
-    - role: genlab.swapfile
-```
 
 License
 -------

roles/swapfile/meta/main.yml

@@ -10,7 +10,7 @@ galaxy_info:
 
   platforms:
     - name: "Ubuntu"
-      versions: ["focal", "jammy"]
+      versions: ["jammy", "noble"]
 
   galaxy_tags: []
 

roles/ufw/README.md

@@ -1,5 +1,5 @@
-template
+ufw
-=========
+===
 
 Whitelist network ports with UFW
 
@@ -21,10 +21,7 @@ None
 Example Playbook
 ----------------
 
-```yaml
+See: [converge.yml](molecule/default/converge.yml)
-roles:
-    - role: genlab.ufw
-```
 
 License
 -------

roles/ufw/meta/main.yml

@@ -10,7 +10,7 @@ galaxy_info:
 
   platforms:
     - name: "Ubuntu"
-      versions: ["focal", "jammy"]
+      versions: ["jammy", "noble"]
 
   galaxy_tags: []
 

roles/users/README.md

@@ -1,9 +1,10 @@
-ansible-users
+users
-=========
+=====
 
 Create user accounts according to a YAML manifest.
 
 Controls:
+
   - username and UID
   - groupname and GID
   - homedir creation
@@ -20,8 +21,8 @@ Requirements
 
 Target node:
 
-- systemd
+- `systemd`
-- openssh
+- openssh client library
 
 Controller:
 
@@ -58,4 +59,4 @@ Author Information
 ------------------
 
 corvus-migratorius@proton.me
-masayganova@gmail.com
+sayganova@genlab.llc

roles/wg_hub/README.md

@@ -1,13 +1,5 @@
-template
+wg_hub
-=========
+======
-
-Template for Ansible role monorepos.
-
-⚠️ Do not forget to update:
-
-- `meta/main.yml`
-- Conda/Mamba manifests
-- this README =)
 
 Requirements
 ------------
@@ -27,10 +19,7 @@ None
 Example Playbook
 ----------------
 
-```yaml
+See: [converge.yml](molecule/default/converge.yml)
-roles:
-    - role: genlab.template
-```
 
 License
 -------

roles/wg_spoke/README.md

@@ -1,12 +1,12 @@
 wg_spoke
 =========
 
-Configure the host as a Spoke in Wireguard Spoke&Hub topology.
+Configure the host as a Spoke in the Wireguard Spoke-and-Hub topology.
 
 Requirements
 ------------
 
-Ubuntu 20.04, 22.04 or 24.04.
+Ubuntu 22.04 or 24.04.
 
 Role Variables
 --------------
@@ -33,7 +33,7 @@ None
 Example Playbook
 ----------------
 
-See `molecule/default/converge.yml`.
+See: [converge.yml](molecule/default/converge.yml)
 
 License
 -------

roles/wg_spoke/meta/main.yml

@@ -10,7 +10,7 @@ galaxy_info:
 
   platforms:
     - name: "Ubuntu"
-      versions: ["focal", "jammy", "noble"]
+      versions: ["jammy", "noble"]
 
   galaxy_tags: []