Capture current Ansible control plane state

Commit the accumulated infrastructure work that was living only in the working tree: monitoring stack, emergency access/bot, gyro allocator, grimmory, adguard, backup audit and the OpenCode agent definitions. Also ignore Python bytecode, local archives and Nix/direnv artifacts. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GTocXkGUUazHdKKd3r9k71
2026-08-26 21:39:28 +03:00
parent 4bafa7d09e
commit c676be81ec
126 changed files with 10583 additions and 44 deletions
@@ -0,0 +1,3 @@
+---
+monitoring_blackbox_listen_address: 127.0.0.1:9115
+monitoring_pushgateway_url: http://192.168.1.30:9091
@@ -0,0 +1,9 @@
+---
+- name: reload systemd
+  ansible.builtin.systemd:
+    daemon_reload: true
+
+- name: restart blackbox exporter
+  ansible.builtin.systemd:
+    name: prometheus-blackbox-exporter
+    state: restarted
@@ -0,0 +1,96 @@
+---
+- name: Install Blackbox Exporter
+  ansible.builtin.apt:
+    name:
+      - curl
+      - prometheus-blackbox-exporter
+    state: present
+    update_cache: true
+
+- name: Install external probe configuration
+  ansible.builtin.template:
+    src: blackbox.yml.j2
+    dest: /etc/prometheus/blackbox.yml
+    owner: root
+    group: root
+    mode: "0644"
+  notify: restart blackbox exporter
+
+- name: Create Blackbox Exporter systemd override directory
+  ansible.builtin.file:
+    path: /etc/systemd/system/prometheus-blackbox-exporter.service.d
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Configure Blackbox Exporter listen address
+  ansible.builtin.copy:
+    dest: /etc/systemd/system/prometheus-blackbox-exporter.service.d/override.conf
+    owner: root
+    group: root
+    mode: "0644"
+    content: |
+      [Service]
+      ExecStart=
+      ExecStart=/usr/bin/prometheus-blackbox-exporter --config.file=/etc/prometheus/blackbox.yml --web.listen-address={{ monitoring_blackbox_listen_address }}
+  notify:
+    - reload systemd
+    - restart blackbox exporter
+
+- name: Install ru-vps metrics push script
+  ansible.builtin.template:
+    src: push-metrics.sh.j2
+    dest: /usr/local/sbin/homelab-monitoring-push
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Install ru-vps metrics push service
+  ansible.builtin.copy:
+    dest: /etc/systemd/system/homelab-monitoring-push.service
+    owner: root
+    group: root
+    mode: "0644"
+    content: |
+      [Unit]
+      Description=Push ru-vps monitoring metrics through OpenVPN
+      Wants=network-online.target
+      After=network-online.target
+
+      [Service]
+      Type=oneshot
+      ExecStart=/usr/local/sbin/homelab-monitoring-push
+  notify: reload systemd
+
+- name: Install ru-vps metrics push timer
+  ansible.builtin.copy:
+    dest: /etc/systemd/system/homelab-monitoring-push.timer
+    owner: root
+    group: root
+    mode: "0644"
+    content: |
+      [Unit]
+      Description=Run ru-vps monitoring metric push every minute
+
+      [Timer]
+      OnBootSec=2m
+      OnUnitActiveSec=1m
+      Persistent=true
+
+      [Install]
+      WantedBy=timers.target
+  notify: reload systemd
+
+- name: Ensure Blackbox Exporter is enabled and running
+  ansible.builtin.systemd:
+    name: prometheus-blackbox-exporter
+    enabled: true
+    state: started
+
+- name: Enable ru-vps metrics push timer
+  ansible.builtin.systemd:
+    name: homelab-monitoring-push.timer
+    daemon_reload: true
+    enabled: true
+    state: started
@@ -0,0 +1,13 @@
+modules:
+  http_2xx:
+    prober: http
+    timeout: 10s
+    http:
+      preferred_ip_protocol: ip4
+      valid_status_codes: [200, 301, 302]
+  tcp_connect:
+    prober: tcp
+    timeout: 10s
+  icmp:
+    prober: icmp
+    timeout: 10s
@@ -0,0 +1,37 @@
+#!/bin/sh
+# Managed by Ansible. Push local ru-vps metrics through the OpenVPN route.
+set -eu
+
+PUSHGATEWAY_URL="{{ monitoring_pushgateway_url }}"
+NOW=$(date +%s)
+NODE_METRICS=$(mktemp)
+
+trap 'rm -f "$NODE_METRICS"' EXIT
+
+push_stdin() {
+  path="$1"
+  curl --fail --silent --show-error --data-binary @- "$PUSHGATEWAY_URL/metrics/$path"
+}
+
+curl --fail --silent --show-error http://127.0.0.1:9100/metrics > "$NODE_METRICS"
+push_stdin "job/node/instance/ru-vps" < "$NODE_METRICS"
+
+probe() {
+  name="$1"
+  module="$2"
+  target="$3"
+  payload=$(curl --fail --silent --show-error --get \
+    --data-urlencode "module=$module" \
+    --data-urlencode "target=$target" \
+    http://127.0.0.1:9115/probe || printf 'probe_success 0\n')
+  payload=$(printf '%s\nhomelab_vps_probe_timestamp_seconds %s\n' "$payload" "$NOW")
+  printf '%s\n' "$payload" | push_stdin "job/blackbox-vps/probe_name/$name"
+}
+
+probe vaultwarden http_2xx https://pass.ada-dev.ru
+probe gitea http_2xx https://git.ada-dev.ru
+probe grimmory http_2xx https://books.ada-dev.ru/api/v1/healthcheck
+probe ovpn_gateway tcp_connect 10.78.0.2:22
+probe cloud_pve tcp_connect 192.168.1.5:8006
+probe mini_pve tcp_connect 192.168.1.10:8006
+probe pbs tcp_connect 192.168.1.20:8007