infra/ansible/roles/alloy/tasks/main.yml at d7e8750676e435a39e68e91f991e035d14800ba1 · python-discord/infra · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
---

- name: Add Grafana apt repository (Rocky)
  yum_repository:
    name: grafana
    description: Grafana Repository
    baseurl: "{{ alloy_rocky_grafana_repository }}"
    gpgcheck: true
    gpgkey: "{{ alloy_rocky_grafana_signing_key }}"
  when: ansible_facts["distribution"] == "Rocky"
  tags:
    - role::alloy

- name: Add Grafana apt repository with key (Debian)
  deb822_repository:
    name: grafana
    types: deb
    uris: "{{ alloy_debian_grafana_repository }}"
    state: present
    suites: [stable]
    components: [main]
    signed_by: "{{ alloy_debian_grafana_signing_key }}"
  when: ansible_facts["distribution"] == "Debian"
  tags:
    - role::alloy

- name: Install Alloy package from Grafana repository
  package:
    name: alloy
    state: present
  tags:
    - role::alloy

- name: Template Alloy configuration file into Alloy configuration
  template:
    src: config.alloy.j2
    dest: /etc/alloy/config.alloy
    group: root
    owner: root
    mode: "0644"
  tags:
    - role::alloy
  notify:
    - Reload the alloy service

- name: Create service override directory
  file:
    path: /etc/systemd/system/alloy.service.d
    state: directory
    owner: root
    group: root
    mode: "0755"
  tags:
    - role::alloy

- name: Create service dropin with security overrides
  copy:
    src: alloy-override.conf
    dest: /etc/systemd/system/alloy.service.d/override.conf
    owner: root
    group: root
    mode: "0444"
  tags:
    - role::alloy
  notify:
    - Reload the systemd daemon
    - Restart the alloy service

- name: Start and enable the Alloy service
  service:
    name: alloy
    state: started
    enabled: true
  tags:
    - role::alloy

- name: Add user to extra groups for Alloy
  user:
    name: "alloy"
    groups: "{{ alloy_extra_groups }}"
    append: true
  when: alloy_extra_groups | length > 0
  tags:
    - role::alloy
  notify:
    - Restart the alloy service

# We need to add cap_dac_read_search=+ep to the Alloy binary.

- name: Get Alloy binary path
  command: "which alloy"
  register: alloy_binary_path
  changed_when: false
  tags:
    - role::alloy

- name: Get the current capabilities of the Alloy binary
  command: "getcap {{ alloy_binary_path.stdout }}"
  register: alloy_getcap_output
  changed_when: false
  tags:
    - role::alloy

- name: Set capabilities on the Alloy binary
  command: "setcap cap_dac_read_search=ep {{ alloy_binary_path.stdout }}"
  changed_when: true
  when: "'cap_dac_read_search=ep' not in alloy_getcap_output.stdout"
  tags:
    - role::alloy
  notify:
    - Restart the alloy service