cloudfall 0.2.0__py3-none-any.whl

cloudfall_engine/_bundled/ansible/roles/cloudfall_logging_backend/tasks/main.yml

@@ -0,0 +1,487 @@
+---
+- name: Validate logging backend target and migration guard
+  ansible.builtin.assert:
+    that:
+      - ansible_facts["distribution"] == "Debian"
+      - ansible_facts["service_mgr"] == "systemd"
+      - cloudfall_logging_backend_stack.backend.server == cloudfall_server_id
+      - cloudfall_logging_backend_stack.migration.mode == "parallel"
+      - cloudfall_logging_backend_stack.migration.preserveLegacyAgents | bool
+      - cloudfall_logging_backend_stack.backend.listenAddress == "127.0.0.1"
+      - cloudfall_logging_backend_stack.grafana.listenAddress == "127.0.0.1"
+      - >-
+        cloudfall_logging_backend_stack.metrics.backend.listenAddress
+        == "127.0.0.1"
+    fail_msg: >-
+      Logging deployment requires its declared Debian backend and the guarded
+      parallel migration mode
+
+- name: Inspect pre-provisioned backend secret files
+  ansible.builtin.stat:
+    path: "{{ item }}"
+    follow: true
+  loop:
+    - "{{ cloudfall_logging_backend_stack.gateway.tls.certificatePath }}"
+    - "{{ cloudfall_logging_backend_stack.gateway.tls.keyPath }}"
+    - "{{ cloudfall_logging_backend_stack.gateway.tls.clientCaPath }}"
+    - "{{ cloudfall_logging_backend_stack.grafana.adminPasswordPath }}"
+  register: cloudfall_logging_backend_secret_files
+
+- name: Require backend secret files before mutation
+  ansible.builtin.assert:
+    that:
+      - item.stat.exists
+      - item.stat.isreg
+    fail_msg: "Required logging secret file is missing: {{ item.item }}"
+  loop: "{{ cloudfall_logging_backend_secret_files.results }}"
+  loop_control:
+    label: "{{ item.item }}"
+
+- name: Inspect backend private files
+  ansible.builtin.stat:
+    path: "{{ item }}"
+    follow: true
+  loop:
+    - "{{ cloudfall_logging_backend_stack.gateway.tls.keyPath }}"
+    - "{{ cloudfall_logging_backend_stack.grafana.adminPasswordPath }}"
+  register: cloudfall_logging_backend_private_files
+
+- name: Reject world-readable backend private files
+  ansible.builtin.assert:
+    that:
+      - item.stat.mode is match('^0?[46][04]0$')
+    fail_msg: "Logging private file permissions are too broad: {{ item.item }}"
+  loop: "{{ cloudfall_logging_backend_private_files.results }}"
+  loop_control:
+    label: "{{ item.item }}"
+
+- name: Install Grafana repository prerequisites
+  ansible.builtin.apt:
+    name:
+      - ca-certificates
+      - gnupg
+      - python3-debian
+    state: present
+    update_cache: true
+    cache_valid_time: 3600
+
+- name: Create APT keyring directory
+  ansible.builtin.file:
+    path: /etc/apt/keyrings
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Install Grafana repository signing key
+  ansible.builtin.get_url:
+    url: "{{ cloudfall_logging_backend_grafana_repository_key_url }}"
+    dest: "{{ cloudfall_logging_backend_grafana_repository_key_path }}"
+    owner: root
+    group: root
+    mode: "0644"
+
+- name: Configure stable Grafana package repository
+  ansible.builtin.deb822_repository:
+    name: grafana
+    types:
+      - deb
+    uris:
+      - "{{ cloudfall_logging_backend_grafana_repository_url }}"
+    suites:
+      - stable
+    components:
+      - main
+    signed_by: "{{ cloudfall_logging_backend_grafana_repository_key_path }}"
+    state: present
+  register: cloudfall_logging_backend_repository
+
+# Not a handler: the refreshed index must exist before the pinned
+# install below runs, and handlers only flush later.
+- name: Refresh APT cache after repository changes  # noqa: no-handler
+  ansible.builtin.apt:
+    update_cache: true
+  when: cloudfall_logging_backend_repository is changed
+
+- name: Create Loki service group before package configuration
+  ansible.builtin.group:
+    name: loki
+    system: true
+    state: present
+
+- name: Create Loki service account before package configuration
+  ansible.builtin.user:
+    name: loki
+    group: loki
+    shell: /usr/sbin/nologin
+    create_home: false
+    system: true
+    state: present
+
+- name: Create Loki configuration directory before package configuration
+  ansible.builtin.file:
+    path: /etc/loki
+    state: directory
+    owner: root
+    group: loki
+    mode: "0750"
+
+- name: Create Loki storage directories before package configuration
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: loki
+    group: loki
+    mode: "0750"
+  loop:
+    - "{{ cloudfall_logging_backend_stack.backend.storage.path }}"
+    - "{{ cloudfall_logging_backend_stack.backend.storage.path }}/chunks"
+    - "{{ cloudfall_logging_backend_stack.backend.storage.path }}/rules"
+    - "{{ cloudfall_logging_backend_stack.backend.storage.path }}/compactor"
+
+- name: Create Loki systemd override directory before package configuration
+  ansible.builtin.file:
+    path: /etc/systemd/system/loki.service.d
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Install safe Loki configuration before package configuration
+  ansible.builtin.template:
+    src: loki.yaml.j2
+    dest: "/etc/loki/cloudfall-{{ cloudfall_logging_backend_stack.id }}.yaml"
+    owner: root
+    group: loki
+    mode: "0640"
+  notify: Restart Loki
+
+- name: Install Loki systemd guard before package configuration
+  ansible.builtin.template:
+    src: loki-systemd-override.conf.j2
+    dest: /etc/systemd/system/loki.service.d/cloudfall.conf
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Restart Loki
+
+- name: Create Prometheus service group before package configuration
+  ansible.builtin.group:
+    name: prometheus
+    system: true
+    state: present
+
+- name: Create Prometheus service account before package configuration
+  ansible.builtin.user:
+    name: prometheus
+    group: prometheus
+    shell: /usr/sbin/nologin
+    create_home: false
+    system: true
+    state: present
+
+- name: Create Prometheus configuration directory before package configuration
+  ansible.builtin.file:
+    path: /etc/prometheus
+    state: directory
+    owner: root
+    group: prometheus
+    mode: "0750"
+
+- name: Create Prometheus storage directory before package configuration
+  ansible.builtin.file:
+    path: "{{ cloudfall_logging_backend_stack.metrics.backend.storagePath }}"
+    state: directory
+    owner: prometheus
+    group: prometheus
+    mode: "0750"
+
+- name: Install managed Prometheus configuration before package configuration
+  ansible.builtin.template:
+    src: prometheus.yaml.j2
+    dest: /etc/prometheus/cloudfall.yaml
+    owner: root
+    group: prometheus
+    mode: "0640"
+  notify: Restart Prometheus
+
+- name: Install declared Prometheus alert rules before package configuration
+  ansible.builtin.template:
+    src: prometheus-rules.yaml.j2
+    dest: /etc/prometheus/cloudfall-rules.yaml
+    owner: root
+    group: prometheus
+    mode: "0640"
+  notify: Restart Prometheus
+
+- name: Install managed Prometheus arguments before package configuration
+  ansible.builtin.template:
+    src: prometheus-defaults.j2
+    dest: /etc/default/prometheus
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Restart Prometheus
+
+- name: Inspect pre-provisioned SMTP credential files
+  ansible.builtin.stat:
+    path: "{{ item.email.authPasswordFile }}"
+    follow: true
+  loop: >-
+    {{
+      cloudfall_logging_backend_stack.alerting.receivers
+      | selectattr('email', 'defined')
+      | selectattr('email.authPasswordFile', 'defined')
+      | list
+      if 'alerting' in cloudfall_logging_backend_stack
+      else []
+    }}
+  loop_control:
+    label: "{{ item.id }}"
+  register: cloudfall_logging_backend_smtp_files
+
+- name: Require SMTP credential files before mutation
+  ansible.builtin.assert:
+    that:
+      - item.stat.exists
+      - item.stat.isreg
+    fail_msg: "Required SMTP credential file is missing: {{ item.item.id }}"
+  loop: "{{ cloudfall_logging_backend_smtp_files.results | default([]) }}"
+  loop_control:
+    label: "{{ item.item.id }}"
+
+- name: Install declared Alertmanager configuration before package configuration
+  ansible.builtin.template:
+    src: alertmanager.yaml.j2
+    dest: /etc/prometheus/cloudfall-alertmanager.yaml
+    owner: root
+    group: prometheus
+    mode: "0640"
+  when: "'alerting' in cloudfall_logging_backend_stack"
+  notify: Restart Alertmanager
+
+- name: Install declared Alertmanager arguments before package configuration
+  ansible.builtin.template:
+    src: alertmanager-defaults.j2
+    dest: /etc/default/prometheus-alertmanager
+    owner: root
+    group: root
+    mode: "0644"
+  when: "'alerting' in cloudfall_logging_backend_stack"
+  notify: Restart Alertmanager
+
+- name: Install the pinned Alertmanager package
+  ansible.builtin.apt:
+    name: >-
+      {{
+        'prometheus-alertmanager=' ~
+        cloudfall_logging_backend_stack.alerting.alertmanager.packageVersion
+        if 'packageVersion'
+        in cloudfall_logging_backend_stack.alerting.alertmanager
+        else 'prometheus-alertmanager'
+      }}
+    state: present
+    update_cache: true
+    cache_valid_time: 3600
+    policy_rc_d: 101
+  when: "'alerting' in cloudfall_logging_backend_stack"
+
+- name: Install pinned logging backend packages
+  ansible.builtin.apt:
+    name:
+      - "loki={{ cloudfall_logging_backend_stack.software.lokiPackageVersion }}"
+      - "grafana={{ cloudfall_logging_backend_stack.software.grafanaPackageVersion }}"
+      - nginx
+    state: present
+    update_cache: true
+    cache_valid_time: 3600
+    policy_rc_d: 101
+
+- name: Install the Prometheus metrics backend
+  ansible.builtin.apt:
+    name: >-
+      {{
+        'prometheus=' ~
+        cloudfall_logging_backend_stack.software.prometheusPackageVersion
+        if 'prometheusPackageVersion'
+        in cloudfall_logging_backend_stack.software
+        else 'prometheus'
+      }}
+    state: present
+    update_cache: true
+    cache_valid_time: 3600
+    policy_rc_d: 101
+
+- name: Create logging secret directory
+  ansible.builtin.file:
+    path: /etc/cloudfall/logging
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Secure gateway certificate material
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: file
+    owner: root
+    group: root
+    mode: "0644"
+  loop:
+    - "{{ cloudfall_logging_backend_stack.gateway.tls.certificatePath }}"
+    - "{{ cloudfall_logging_backend_stack.gateway.tls.clientCaPath }}"
+
+- name: Secure gateway private key
+  ansible.builtin.file:
+    path: "{{ cloudfall_logging_backend_stack.gateway.tls.keyPath }}"
+    state: file
+    owner: root
+    group: root
+    mode: "0600"
+
+- name: Grant Grafana access to its bootstrap password
+  ansible.builtin.file:
+    path: "{{ cloudfall_logging_backend_stack.grafana.adminPasswordPath }}"
+    state: file
+    owner: root
+    group: grafana
+    mode: "0640"
+
+- name: Install managed Grafana configuration
+  ansible.builtin.template:
+    src: grafana.ini.j2
+    dest: /etc/grafana/grafana.ini
+    owner: root
+    group: grafana
+    mode: "0640"
+    backup: true
+  notify: Restart Grafana
+
+- name: Provision the local Loki Grafana data source
+  ansible.builtin.template:
+    src: loki-datasource.yml.j2
+    dest: /etc/grafana/provisioning/datasources/cloudfall-loki.yml
+    owner: root
+    group: grafana
+    mode: "0640"
+  notify: Restart Grafana
+
+- name: Provision the local Prometheus Grafana data source
+  ansible.builtin.template:
+    src: prometheus-datasource.yml.j2
+    dest: /etc/grafana/provisioning/datasources/cloudfall-prometheus.yml
+    owner: root
+    group: grafana
+    mode: "0640"
+  notify: Restart Grafana
+
+- name: Install mTLS-only Loki ingestion gateway
+  ansible.builtin.template:
+    src: nginx-loki-gateway.conf.j2
+    dest: "/etc/nginx/sites-available/cloudfall-loki-{{ cloudfall_logging_backend_stack.id }}.conf"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Reload Nginx
+
+- name: Enable mTLS-only Loki ingestion gateway
+  ansible.builtin.file:
+    src: "/etc/nginx/sites-available/cloudfall-loki-{{ cloudfall_logging_backend_stack.id }}.conf"
+    dest: "/etc/nginx/sites-enabled/cloudfall-loki-{{ cloudfall_logging_backend_stack.id }}.conf"
+    state: link
+  notify: Reload Nginx
+
+- name: Validate Loki configuration
+  ansible.builtin.command:
+    argv:
+      - /usr/bin/loki
+      - "-config.file=/etc/loki/cloudfall-{{ cloudfall_logging_backend_stack.id }}.yaml"
+      - -verify-config
+  changed_when: false
+  when: not ansible_check_mode
+
+- name: Validate Prometheus configuration
+  ansible.builtin.command:
+    argv:
+      - /usr/bin/promtool
+      - check
+      - config
+      - /etc/prometheus/cloudfall.yaml
+  changed_when: false
+  when: not ansible_check_mode
+
+- name: Validate Nginx configuration
+  ansible.builtin.command:
+    argv:
+      - /usr/sbin/nginx
+      - -t
+  changed_when: false
+  when: not ansible_check_mode
+
+- name: Apply validated logging backend configuration
+  ansible.builtin.meta: flush_handlers
+
+- name: Enable logging backend services
+  ansible.builtin.systemd_service:
+    name: "{{ item }}"
+    enabled: true
+    state: started
+    daemon_reload: true
+  loop: >-
+    {{
+      ['loki.service', 'prometheus.service', 'nginx.service',
+       'grafana-server.service']
+      + (['prometheus-alertmanager.service']
+         if 'alerting' in cloudfall_logging_backend_stack else [])
+    }}
+
+- name: Wait for Loki readiness
+  ansible.builtin.uri:
+    url: "http://{{ cloudfall_logging_backend_stack.backend.listenAddress }}:{{ cloudfall_logging_backend_stack.backend.port }}/ready"
+    status_code: 200
+    return_content: false
+  register: cloudfall_logging_backend_loki_readiness
+  retries: 12
+  delay: 5
+  until: cloudfall_logging_backend_loki_readiness.status == 200
+  when: not ansible_check_mode
+
+- name: Wait for Prometheus readiness
+  ansible.builtin.uri:
+    url: "http://{{ cloudfall_logging_backend_stack.metrics.backend.listenAddress }}:{{ cloudfall_logging_backend_stack.metrics.backend.port }}/-/ready"
+    status_code: 200
+    return_content: false
+  register: cloudfall_logging_backend_prometheus_readiness
+  retries: 12
+  delay: 5
+  until: cloudfall_logging_backend_prometheus_readiness.status == 200
+  when: not ansible_check_mode
+
+- name: Wait for Alertmanager readiness
+  ansible.builtin.uri:
+    url: >-
+      http://{{
+        cloudfall_logging_backend_stack.alerting.alertmanager.listenAddress
+      }}:{{
+        cloudfall_logging_backend_stack.alerting.alertmanager.port
+      }}/-/ready
+    status_code: 200
+    return_content: false
+  register: cloudfall_logging_backend_alertmanager_readiness
+  retries: 12
+  delay: 5
+  until: cloudfall_logging_backend_alertmanager_readiness.status == 200
+  when:
+    - not ansible_check_mode
+    - "'alerting' in cloudfall_logging_backend_stack"
+
+- name: Wait for Grafana readiness
+  ansible.builtin.uri:
+    url: "http://{{ cloudfall_logging_backend_stack.grafana.listenAddress }}:{{ cloudfall_logging_backend_stack.grafana.port }}/api/health"
+    status_code: 200
+    return_content: false
+  register: cloudfall_logging_backend_grafana_readiness
+  retries: 12
+  delay: 5
+  until: cloudfall_logging_backend_grafana_readiness.status == 200
+  when: not ansible_check_mode

cloudfall_engine/_bundled/ansible/roles/cloudfall_logging_backend/templates/alertmanager-defaults.j2

@@ -0,0 +1,2 @@
+# Managed by Cloudfall. Local changes will be overwritten.
+ARGS="--config.file=/etc/prometheus/cloudfall-alertmanager.yaml --web.listen-address={{ cloudfall_logging_backend_stack.alerting.alertmanager.listenAddress }}:{{ cloudfall_logging_backend_stack.alerting.alertmanager.port }} --cluster.listen-address="

cloudfall_engine/_bundled/ansible/roles/cloudfall_logging_backend/templates/alertmanager.yaml.j2

@@ -0,0 +1,33 @@
+# Managed by Cloudfall. Local changes will be overwritten.
+{% set alerting = cloudfall_logging_backend_stack.alerting %}
+route:
+  receiver: cloudfall
+  group_by:
+    - alertname
+    - environment
+  group_wait: 30s
+  group_interval: 5m
+  repeat_interval: 4h
+
+receivers:
+  - name: cloudfall
+{% set webhooks = alerting.receivers | selectattr('webhook', 'defined') | list %}
+{% set emails = alerting.receivers | selectattr('email', 'defined') | list %}
+{% if webhooks %}
+    webhook_configs:
+{% for receiver in webhooks %}
+      - url: {{ receiver.webhook.url | tojson }}
+{% endfor %}
+{% endif %}
+{% if emails %}
+    email_configs:
+{% for receiver in emails %}
+      - to: {{ receiver.email.to | tojson }}
+        from: {{ receiver.email['from'] | tojson }}
+        smarthost: {{ receiver.email.smarthost | tojson }}
+{% if receiver.email.authUsername is defined %}
+        auth_username: {{ receiver.email.authUsername | tojson }}
+        auth_password_file: {{ receiver.email.authPasswordFile | tojson }}
+{% endif %}
+{% endfor %}
+{% endif %}

cloudfall_engine/_bundled/ansible/roles/cloudfall_logging_backend/templates/grafana.ini.j2

@@ -0,0 +1,20 @@
+[server]
+protocol = http
+http_addr = {{ cloudfall_logging_backend_stack.grafana.listenAddress }}
+http_port = {{ cloudfall_logging_backend_stack.grafana.port }}
+
+[security]
+admin_user = admin
+admin_password = {{ '$__file{' ~ cloudfall_logging_backend_stack.grafana.adminPasswordPath ~ '}' }}
+disable_gravatar = true
+
+[users]
+allow_sign_up = false
+
+[analytics]
+reporting_enabled = false
+check_for_updates = false
+check_for_plugin_updates = false
+
+[log]
+mode = console

cloudfall_engine/_bundled/ansible/roles/cloudfall_logging_backend/templates/loki-datasource.yml.j2

@@ -0,0 +1,11 @@
+---
+apiVersion: 1
+prune: true
+datasources:
+  - name: Cloudfall Loki
+    uid: cloudfall-loki
+    type: loki
+    access: proxy
+    url: "http://{{ cloudfall_logging_backend_stack.backend.listenAddress }}:{{ cloudfall_logging_backend_stack.backend.port }}"
+    isDefault: true
+    editable: false

cloudfall_engine/_bundled/ansible/roles/cloudfall_logging_backend/templates/loki-systemd-override.conf.j2

@@ -0,0 +1,3 @@
+[Service]
+ExecStart=
+ExecStart=/usr/bin/loki -config.file=/etc/loki/cloudfall-{{ cloudfall_logging_backend_stack.id }}.yaml

cloudfall_engine/_bundled/ansible/roles/cloudfall_logging_backend/templates/loki.yaml.j2

@@ -0,0 +1,49 @@
+---
+auth_enabled: false
+
+server:
+  http_listen_address: {{ cloudfall_logging_backend_stack.backend.listenAddress }}
+  http_listen_port: {{ cloudfall_logging_backend_stack.backend.port }}
+  grpc_listen_address: 127.0.0.1
+  grpc_listen_port: 9096
+
+common:
+  instance_addr: 127.0.0.1
+  path_prefix: {{ cloudfall_logging_backend_stack.backend.storage.path }}
+  storage:
+    filesystem:
+      chunks_directory: {{ cloudfall_logging_backend_stack.backend.storage.path }}/chunks
+      rules_directory: {{ cloudfall_logging_backend_stack.backend.storage.path }}/rules
+  replication_factor: 1
+  ring:
+    kvstore:
+      store: inmemory
+
+query_range:
+  results_cache:
+    cache:
+      embedded_cache:
+        enabled: true
+        max_size_mb: 100
+
+schema_config:
+  configs:
+    - from: "2024-04-01"
+      store: tsdb
+      object_store: filesystem
+      schema: v13
+      index:
+        prefix: index_
+        period: 24h
+
+compactor:
+  working_directory: {{ cloudfall_logging_backend_stack.backend.storage.path }}/compactor
+  retention_enabled: true
+  delete_request_store: filesystem
+
+limits_config:
+  allow_structured_metadata: true
+  retention_period: {{ cloudfall_logging_backend_stack.backend.retentionHours }}h
+
+analytics:
+  reporting_enabled: false

cloudfall_engine/_bundled/ansible/roles/cloudfall_logging_backend/templates/nginx-loki-gateway.conf.j2

@@ -0,0 +1,45 @@
+server {
+{% if cloudfall_logging_backend_stack.gateway.listenAddress == '::' %}
+    listen [::]:{{ cloudfall_logging_backend_stack.gateway.port }} ssl;
+{% else %}
+    listen {{ cloudfall_logging_backend_stack.gateway.listenAddress }}:{{ cloudfall_logging_backend_stack.gateway.port }} ssl;
+{% endif %}
+    server_name {{ cloudfall_logging_backend_stack.gateway.serverName }};
+
+    ssl_certificate {{ cloudfall_logging_backend_stack.gateway.tls.certificatePath }};
+    ssl_certificate_key {{ cloudfall_logging_backend_stack.gateway.tls.keyPath }};
+    ssl_client_certificate {{ cloudfall_logging_backend_stack.gateway.tls.clientCaPath }};
+    ssl_verify_client on;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_session_tickets off;
+
+    client_max_body_size 16m;
+
+    location = /loki/api/v1/push {
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-Proto https;
+        proxy_pass http://{{ cloudfall_logging_backend_stack.backend.listenAddress }}:{{ cloudfall_logging_backend_stack.backend.port }};
+    }
+
+    location = /api/v1/write {
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-Proto https;
+        proxy_pass http://{{ cloudfall_logging_backend_stack.metrics.backend.listenAddress }}:{{ cloudfall_logging_backend_stack.metrics.backend.port }};
+    }
+
+    location = /api/v1/alerts {
+        limit_except GET {
+            deny all;
+        }
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-Proto https;
+        proxy_pass http://{{ cloudfall_logging_backend_stack.metrics.backend.listenAddress }}:{{ cloudfall_logging_backend_stack.metrics.backend.port }};
+    }
+
+    location / {
+        return 404;
+    }
+}

cloudfall_engine/_bundled/ansible/roles/cloudfall_logging_backend/templates/prometheus-datasource.yml.j2

@@ -0,0 +1,11 @@
+---
+apiVersion: 1
+prune: false
+datasources:
+  - name: Cloudfall Prometheus
+    uid: cloudfall-prometheus
+    type: prometheus
+    access: proxy
+    url: "http://{{ cloudfall_logging_backend_stack.metrics.backend.listenAddress }}:{{ cloudfall_logging_backend_stack.metrics.backend.port }}"
+    isDefault: false
+    editable: false

cloudfall_engine/_bundled/ansible/roles/cloudfall_logging_backend/templates/prometheus-defaults.j2

@@ -0,0 +1,2 @@
+# Managed by Cloudfall. Local changes will be overwritten.
+ARGS="--config.file=/etc/prometheus/cloudfall.yaml --web.listen-address={{ cloudfall_logging_backend_stack.metrics.backend.listenAddress }}:{{ cloudfall_logging_backend_stack.metrics.backend.port }} --web.enable-remote-write-receiver --storage.tsdb.path={{ cloudfall_logging_backend_stack.metrics.backend.storagePath }} --storage.tsdb.retention.time={{ cloudfall_logging_backend_stack.metrics.backend.retentionHours }}h"

cloudfall_engine/_bundled/ansible/roles/cloudfall_logging_backend/templates/prometheus-rules.yaml.j2

@@ -0,0 +1,20 @@
+# Managed by Cloudfall. Local changes will be overwritten.
+{% set cloudfall_rules = cloudfall_alert_rules | default([]) %}
+{% if cloudfall_rules %}
+groups:
+  - name: cloudfall
+    rules:
+{% for rule in cloudfall_rules %}
+      - alert: {{ rule.id | replace('-', '_') }}
+        expr: {{ rule.expr | tojson }}
+        for: {{ rule['for'] }}
+        labels:
+          severity: {{ rule.severity }}
+          environment: {{ rule.environment }}
+          cloudfall_rule: {{ rule.id }}
+        annotations:
+          summary: {{ rule.summary | tojson }}
+{% endfor %}
+{% else %}
+groups: []
+{% endif %}