fluent-bit.yml (5192B)
1 --- 2 - name: Validate Fluent Bit platform and configuration 3 ansible.builtin.assert: 4 that: 5 - ansible_facts['distribution'] == 'Debian' 6 - ansible_facts['distribution_major_version'] == '13' 7 - ansible_facts['architecture'] in ['x86_64', 'aarch64'] 8 - monitoring_fluent_bit_version is match('^[0-9]+\.[0-9]+\.[0-9]+$') 9 - monitoring_fluent_bit_queue_limit is match('^[1-9][0-9]*[KMG]$') 10 - monitoring_fluent_bit_url is match('^https://[A-Za-z0-9][A-Za-z0-9.-]*(?::[0-9]{1,5})?/jsonline$') 11 - >- 12 (monitoring_fluent_bit_url | urlsplit('port')) is none 13 or (monitoring_fluent_bit_url | urlsplit('port')) | int > 0 14 - ((monitoring_fluent_bit_url | urlsplit('port')) or 443) | int < 65536 15 - "'fluent-bit.service' in monitoring_fluent_bit_excluded_units" 16 - >- 17 (monitoring_fluent_bit_excluded_units + monitoring_fluent_bit_receiver_units) 18 | select('match', '^[A-Za-z0-9_.@-]+\.service$') | list | length 19 == (monitoring_fluent_bit_excluded_units + monitoring_fluent_bit_receiver_units) | length 20 fail_msg: Fluent Bit requires Debian 13 amd64/arm64 and valid HTTPS, buffer and exclusion settings. 21 22 - name: Discover installed packages for check mode 23 ansible.builtin.package_facts: 24 manager: auto 25 26 - name: Install Fluent Bit repository prerequisites 27 ansible.builtin.apt: 28 name: ca-certificates 29 state: present 30 update_cache: true 31 cache_valid_time: 3600 32 policy_rc_d: 101 33 34 - name: Install the Fluent Bit repository signing key 35 ansible.builtin.get_url: 36 url: https://packages.fluentbit.io/fluentbit.key 37 dest: /usr/share/keyrings/fluentbit.asc 38 checksum: sha256:df248e2d7103ca62cb683c20a077198d0fb0a7f79dbf53a604af0317de3b4711 39 owner: root 40 group: root 41 mode: "0644" 42 43 - name: Configure the signed Fluent Bit repository 44 ansible.builtin.copy: 45 content: >- 46 deb [signed-by=/usr/share/keyrings/fluentbit.asc] 47 https://packages.fluentbit.io/debian/trixie trixie main 48 dest: /etc/apt/sources.list.d/fluent-bit.list 49 owner: root 50 group: root 51 mode: "0644" 52 register: monitoring_fluent_bit_repository 53 54 - name: Pin Fluent Bit to the tested release 55 ansible.builtin.copy: 56 content: | 57 Package: fluent-bit 58 Pin: version {{ monitoring_fluent_bit_version }} 59 Pin-Priority: 1001 60 dest: /etc/apt/preferences.d/taler-fluent-bit 61 owner: root 62 group: root 63 mode: "0644" 64 65 - name: Install Fluent Bit without starting the package configuration 66 ansible.builtin.apt: 67 name: "fluent-bit={{ monitoring_fluent_bit_version }}" 68 state: present 69 allow_downgrade: true 70 update_cache: "{{ monitoring_fluent_bit_repository.changed }}" 71 install_recommends: false 72 policy_rc_d: 101 73 notify: Restart monitoring Fluent Bit 74 when: not ansible_check_mode or 'fluent-bit' in ansible_facts.packages 75 76 - name: Create private Fluent Bit state and systemd configuration directories 77 ansible.builtin.file: 78 path: "{{ item.path }}" 79 state: directory 80 owner: root 81 group: root 82 mode: "{{ item.mode }}" 83 loop: 84 - { path: /var/lib/fluent-bit, mode: "0700" } 85 - { path: /var/lib/fluent-bit/buffer, mode: "0700" } 86 - { path: /etc/systemd/journald.conf.d, mode: "0755" } 87 - { path: /etc/systemd/system/fluent-bit.service.d, mode: "0755" } 88 89 - name: Configure persistent journald storage without syslog forwarding 90 ansible.builtin.copy: 91 content: | 92 # Managed by Ansible. Keep host-specific journal retention settings. 93 [Journal] 94 Storage=persistent 95 ForwardToSyslog=no 96 dest: /etc/systemd/journald.conf.d/60-taler-monitoring.conf 97 owner: root 98 group: root 99 mode: "0644" 100 notify: Restart monitoring journal 101 102 - name: Configure Fluent Bit service recovery and private state 103 ansible.builtin.copy: 104 content: | 105 [Service] 106 Restart=on-failure 107 RestartSec=5s 108 UMask=0077 109 TimeoutStopSec=45s 110 dest: /etc/systemd/system/fluent-bit.service.d/monitoring.conf 111 owner: root 112 group: root 113 mode: "0644" 114 notify: Restart monitoring Fluent Bit 115 116 - name: Install exchange latency collector configuration 117 ansible.builtin.template: 118 src: "{{ item }}.j2" 119 dest: "/etc/fluent-bit/{{ item }}" 120 owner: root 121 group: root 122 mode: "0600" 123 loop: 124 - exchange-latency.lua 125 - exchange-latency.conf 126 when: monitoring_nginx_latency_enabled 127 notify: Restart monitoring Fluent Bit 128 129 - name: Install logrotate for exchange timing logs 130 ansible.builtin.apt: 131 name: logrotate 132 state: present 133 install_recommends: false 134 when: monitoring_nginx_latency_enabled 135 136 - name: Rotate the exchange timing log alongside standard nginx logs 137 ansible.builtin.template: 138 src: exchange-timing-logrotate.j2 139 dest: /etc/logrotate.d/taler-exchange-timing 140 owner: root 141 group: root 142 mode: "0644" 143 when: monitoring_nginx_latency_enabled 144 145 - name: Configure buffered JSON Lines forwarding 146 ansible.builtin.template: 147 src: fluent-bit.conf.j2 148 dest: /etc/fluent-bit/fluent-bit.conf 149 owner: root 150 group: root 151 mode: "0600" 152 validate: /opt/fluent-bit/bin/fluent-bit --dry-run -c %s 153 notify: Restart monitoring Fluent Bit