Merge branch 'master' into add-grafana-alloy-role

roles/grafana_alloy/README.md

@@ -7,11 +7,11 @@ Install Grafana Alloy from the release binary and configures it to scrape log fi
 ## Variables
 
 ```yaml
-alloy_version: "1.17.1"
-alloy_config_dir: "/etc/alloy"
-alloy_data_dir: "/var/lib/alloy"
-alloy_loki_url: "http://localhost:3100/loki/api/v1/push"
-alloy_log_paths:
+grafana_alloy_version: "1.17.1"
+grafana_alloy_config_dir: "/etc/alloy"
+grafana_alloy_data_dir: "/var/lib/alloy"
+grafana_alloy_loki_url: "http://localhost:3100/loki/api/v1/push"
+grafana_alloy_log_paths:
   - "/var/log/*.log"
 ```
 
@@ -23,8 +23,8 @@ alloy_log_paths:
   roles:
     - role: grafana_alloy
       vars:
-        alloy_loki_url: "http://loki.example.com:3100/loki/api/v1/push"
-        alloy_log_paths:
+        grafana_alloy_loki_url: "http://loki.example.com:3100/loki/api/v1/push"
+        grafana_alloy_log_paths:
           - "/var/log/*.log"
           - "/var/log/myapp/*.log"
 ```

roles/grafana_alloy/defaults/main.yml

@@ -2,6 +2,7 @@
 grafana_alloy_version: "1.17.1"
 grafana_alloy_config_dir: "/etc/alloy"
 grafana_alloy_data_dir: "/var/lib/alloy"
-grafana_alloy_loki_url: "http://localhost:3100/loki/api/v1/push"
+grafana_alloy_loki_port: 3100
+grafana_alloy_loki_url: "http://localhost:{{ grafana_alloy_loki_port }}/loki/api/v1/push"
 grafana_alloy_log_paths:
   - "/var/log/*.log"

roles/grafana_alloy/tasks/install.yml

@@ -4,8 +4,7 @@
     name: "alloy"
     system: true
     shell: "/sbin/nologin"
-    groups: "adm,systemd-journal"
-    append: true
+    groups: "adm"
     create_home: false
     state: present
 

roles/grafana_alloy/templates/alloy.service.j2

@@ -16,7 +16,7 @@ ExecStart=/usr/bin/alloy run {{ grafana_alloy_config_dir }}/config.alloy \
 ExecReload=/bin/kill -HUP $MAINPID
 
 # Security hardening
-ReadWritePaths={{ grafana_alloy_data_dir }}
+ReadWritePaths={{ grafana_alloy_data_dir }} {{ grafana_alloy_config_dir }} 
 ProtectSystem=strict
 NoNewPrivileges=true
 PrivateTmp=true