cloudfall 0.2.0__py3-none-any.whl

cloudfall_engine/_bundled/ansible/roles/cloudfall_logging_backend/templates/prometheus.yaml.j2

@@ -0,0 +1,24 @@
+# Managed by Cloudfall. Local changes will be overwritten.
+global:
+  scrape_interval: {{ cloudfall_logging_backend_stack.metrics.collection.intervalSeconds }}s
+  evaluation_interval: {{ cloudfall_logging_backend_stack.metrics.collection.intervalSeconds }}s
+
+rule_files:
+  - /etc/prometheus/cloudfall-rules.yaml
+{% if cloudfall_logging_backend_stack.alerting is defined %}
+
+alerting:
+  alertmanagers:
+    - static_configs:
+        - targets:
+            - "{{ cloudfall_logging_backend_stack.alerting.alertmanager.listenAddress }}:{{ cloudfall_logging_backend_stack.alerting.alertmanager.port }}"
+{% endif %}
+
+scrape_configs:
+  - job_name: prometheus
+    static_configs:
+      - targets:
+          - "{{ cloudfall_logging_backend_stack.metrics.backend.listenAddress }}:{{ cloudfall_logging_backend_stack.metrics.backend.port }}"
+        labels:
+          environment: "{{ cloudfall_logging_backend_stack.environment }}"
+          server: "{{ cloudfall_logging_backend_stack.backend.server }}"

cloudfall_engine/_bundled/ansible/roles/cloudfall_logging_collector/defaults/main.yml

@@ -0,0 +1,7 @@
+---
+cloudfall_logging_collector_stack: {}
+cloudfall_logging_collector_metrics_role: alloy
+cloudfall_logging_collector_grafana_repository_key_url: >-
+  https://apt.grafana.com/gpg-full.key
+cloudfall_logging_collector_grafana_repository_key_path: /etc/apt/keyrings/grafana.asc
+cloudfall_logging_collector_grafana_repository_url: https://apt.grafana.com

cloudfall_engine/_bundled/ansible/roles/cloudfall_logging_collector/handlers/main.yml

@@ -0,0 +1,6 @@
+---
+- name: Restart Alloy
+  ansible.builtin.systemd_service:
+    name: alloy.service
+    state: restarted
+    daemon_reload: true

cloudfall_engine/_bundled/ansible/roles/cloudfall_logging_collector/meta/argument_specs.yml

@@ -0,0 +1,122 @@
+---
+argument_specs:
+  main:
+    short_description: Install Alloy without removing legacy log agents
+    options:
+      cloudfall_logging_collector_stack:
+        type: dict
+        required: true
+        options:
+          id:
+            type: str
+            required: true
+          environment:
+            type: str
+            required: true
+          migration:
+            type: dict
+            required: true
+            options:
+              mode:
+                type: str
+                choices:
+                  - parallel
+                required: true
+              preserveLegacyAgents:
+                type: bool
+                required: true
+          software:
+            type: dict
+            required: true
+            options:
+              lokiPackageVersion:
+                type: str
+                required: true
+              grafanaPackageVersion:
+                type: str
+                required: true
+              alloyPackageVersion:
+                type: str
+                required: true
+              prometheusPackageVersion:
+                type: str
+          metrics:
+            type: dict
+            required: true
+            options:
+              backend:
+                type: dict
+                required: true
+              collection:
+                type: dict
+                required: true
+                options:
+                  intervalSeconds:
+                    type: int
+                    required: true
+          backend:
+            type: dict
+            required: true
+          gateway:
+            type: dict
+            required: true
+            options:
+              serverName:
+                type: str
+                required: true
+              listenAddress:
+                type: str
+                required: true
+              port:
+                type: int
+                required: true
+              tls:
+                type: dict
+                required: true
+          grafana:
+            type: dict
+            required: true
+          alerting:
+            type: dict
+          collectors:
+            type: dict
+            required: true
+            options:
+              servers:
+                type: list
+                elements: str
+                required: true
+              clientTls:
+                type: dict
+                required: true
+                options:
+                  caPath:
+                    type: path
+                    required: true
+                  certificatePath:
+                    type: path
+                    required: true
+                  keyPath:
+                    type: path
+                    required: true
+              journal:
+                type: dict
+                required: true
+                options:
+                  enabled:
+                    type: bool
+                    required: true
+                  maxAgeHours:
+                    type: int
+                    required: true
+              files:
+                type: list
+                elements: dict
+                required: true
+      cloudfall_services:
+        type: list
+        elements: dict
+        default: []
+      cloudfall_logging_collector_metrics_role:
+        type: str
+        default: alloy

cloudfall_engine/_bundled/ansible/roles/cloudfall_logging_collector/meta/main.yml

@@ -0,0 +1,11 @@
+---
+galaxy_info:
+  author: Cloudfall
+  description: Install the Cloudfall Grafana Alloy log collector
+  license: AGPL-3.0-or-later
+  min_ansible_version: "2.21"
+  platforms:
+    - name: Debian
+      versions:
+        - bookworm
+dependencies: []

cloudfall_engine/_bundled/ansible/roles/cloudfall_logging_collector/tasks/main.yml

@@ -0,0 +1,224 @@
+---
+- name: Validate logging collector target and migration guard
+  ansible.builtin.assert:
+    that:
+      - ansible_facts["distribution"] == "Debian"
+      - ansible_facts["service_mgr"] == "systemd"
+      - cloudfall_server_id in cloudfall_logging_collector_stack.collectors.servers
+      - cloudfall_logging_collector_stack.migration.mode == "parallel"
+      - cloudfall_logging_collector_stack.migration.preserveLegacyAgents | bool
+      - cloudfall_logging_collector_stack.collectors.journal.enabled | bool
+    fail_msg: >-
+      Logging collection requires a declared Debian collector and the guarded
+      parallel migration mode
+
+- name: Inspect pre-provisioned collector TLS files
+  ansible.builtin.stat:
+    path: "{{ item }}"
+    follow: true
+  loop:
+    - "{{ cloudfall_logging_collector_stack.collectors.clientTls.caPath }}"
+    - "{{ cloudfall_logging_collector_stack.collectors.clientTls.certificatePath }}"
+    - "{{ cloudfall_logging_collector_stack.collectors.clientTls.keyPath }}"
+  register: cloudfall_logging_collector_tls_files
+
+- name: Require collector TLS files before mutation
+  ansible.builtin.assert:
+    that:
+      - item.stat.exists
+      - item.stat.isreg
+    fail_msg: "Required collector TLS file is missing: {{ item.item }}"
+  loop: "{{ cloudfall_logging_collector_tls_files.results }}"
+  loop_control:
+    label: "{{ item.item }}"
+
+- name: Reject world-readable collector private key
+  ansible.builtin.assert:
+    that:
+      - item.stat.mode is match('^0?[46][04]0$')
+    fail_msg: >-
+      Collector private key permissions are too broad:
+      {{ cloudfall_logging_collector_stack.collectors.clientTls.keyPath }}
+  loop: "{{ cloudfall_logging_collector_tls_files.results }}"
+  when: item.item == cloudfall_logging_collector_stack.collectors.clientTls.keyPath
+
+- name: Install Grafana repository prerequisites
+  ansible.builtin.apt:
+    name:
+      - ca-certificates
+      - gnupg
+      - python3-debian
+    state: present
+    update_cache: true
+    cache_valid_time: 3600
+
+- name: Create APT keyring directory
+  ansible.builtin.file:
+    path: /etc/apt/keyrings
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Install Grafana repository signing key
+  ansible.builtin.get_url:
+    url: "{{ cloudfall_logging_collector_grafana_repository_key_url }}"
+    dest: "{{ cloudfall_logging_collector_grafana_repository_key_path }}"
+    owner: root
+    group: root
+    mode: "0644"
+
+- name: Configure stable Grafana package repository
+  ansible.builtin.deb822_repository:
+    name: grafana
+    types:
+      - deb
+    uris:
+      - "{{ cloudfall_logging_collector_grafana_repository_url }}"
+    suites:
+      - stable
+    components:
+      - main
+    signed_by: "{{ cloudfall_logging_collector_grafana_repository_key_path }}"
+    state: present
+  register: cloudfall_logging_collector_repository
+
+# Not a handler: the refreshed index must exist before the pinned
+# install below runs, and handlers only flush later.
+- name: Refresh APT cache after repository changes  # noqa: no-handler
+  ansible.builtin.apt:
+    update_cache: true
+  when: cloudfall_logging_collector_repository is changed
+
+- name: Create Alloy service group before package configuration
+  ansible.builtin.group:
+    name: alloy
+    system: true
+    state: present
+
+- name: Create Alloy service account before package configuration
+  ansible.builtin.user:
+    name: alloy
+    group: alloy
+    groups:
+      - adm
+      - systemd-journal
+    append: true
+    shell: /usr/sbin/nologin
+    create_home: false
+    system: true
+    state: present
+
+- name: Create Alloy configuration directory before package configuration
+  ansible.builtin.file:
+    path: /etc/alloy
+    state: directory
+    owner: root
+    group: alloy
+    mode: "0750"
+
+- name: Create Alloy state directory before package configuration
+  ansible.builtin.file:
+    path: /var/lib/alloy
+    state: directory
+    owner: alloy
+    group: alloy
+    mode: "0750"
+
+- name: Create Alloy systemd override directory before package configuration
+  ansible.builtin.file:
+    path: /etc/systemd/system/alloy.service.d
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Install safe Alloy configuration before package configuration
+  ansible.builtin.template:
+    src: config.alloy.j2
+    dest: /etc/alloy/cloudfall.alloy
+    owner: root
+    group: alloy
+    mode: "0640"
+  notify: Restart Alloy
+
+- name: Install Alloy systemd guard before package configuration
+  ansible.builtin.template:
+    src: alloy-systemd-override.conf.j2
+    dest: /etc/systemd/system/alloy.service.d/cloudfall.conf
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Restart Alloy
+
+- name: Install pinned Alloy package
+  ansible.builtin.apt:
+    name: "alloy={{ cloudfall_logging_collector_stack.software.alloyPackageVersion }}"
+    state: present
+    update_cache: true
+    cache_valid_time: 3600
+    policy_rc_d: 101
+
+- name: Create logging secret directory
+  ansible.builtin.file:
+    path: /etc/cloudfall/logging
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Grant Alloy access to collector TLS material
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: file
+    owner: root
+    group: alloy
+    mode: "0640"
+  loop:
+    - "{{ cloudfall_logging_collector_stack.collectors.clientTls.caPath }}"
+    - "{{ cloudfall_logging_collector_stack.collectors.clientTls.certificatePath }}"
+    - "{{ cloudfall_logging_collector_stack.collectors.clientTls.keyPath }}"
+
+- name: Grant Alloy journal access
+  ansible.builtin.user:
+    name: alloy
+    groups:
+      - adm
+      - systemd-journal
+    append: true
+
+- name: Validate Alloy configuration
+  ansible.builtin.command:
+    argv:
+      - /usr/bin/alloy
+      - validate
+      - /etc/alloy/cloudfall.alloy
+  changed_when: false
+  when: not ansible_check_mode
+
+- name: Apply validated Alloy configuration
+  ansible.builtin.meta: flush_handlers
+
+- name: Enable Alloy without changing legacy agents
+  ansible.builtin.systemd_service:
+    name: alloy.service
+    enabled: true
+    state: started
+
+- name: Wait for Alloy readiness
+  ansible.builtin.uri:
+    url: http://127.0.0.1:12345/-/ready
+    status_code: 200
+    return_content: false
+  register: cloudfall_logging_collector_alloy_readiness
+  retries: 12
+  delay: 5
+  until: cloudfall_logging_collector_alloy_readiness.status == 200
+  when: not ansible_check_mode
+
+- name: Verify Alloy component health
+  ansible.builtin.uri:
+    url: http://127.0.0.1:12345/-/healthy
+    status_code: 200
+    return_content: false
+  when: not ansible_check_mode

cloudfall_engine/_bundled/ansible/roles/cloudfall_logging_collector/templates/alloy-systemd-override.conf.j2

@@ -0,0 +1,3 @@
+[Service]
+ExecStart=
+ExecStart=/usr/bin/alloy run --storage.path=/var/lib/alloy/data /etc/alloy/cloudfall.alloy

cloudfall_engine/_bundled/ansible/roles/cloudfall_logging_collector/templates/config.alloy.j2

@@ -0,0 +1,127 @@
+logging {
+  level  = "info"
+  format = "logfmt"
+}
+
+loki.relabel "journal" {
+  forward_to = []
+
+  rule {
+    source_labels = ["__journal__systemd_unit"]
+    target_label  = "unit"
+  }
+}
+
+loki.write "cloudfall" {
+  external_labels = {
+    environment = "{{ cloudfall_logging_collector_stack.environment }}",
+    server      = "{{ cloudfall_server_id }}",
+  }
+
+  endpoint {
+    url = "https://{{ cloudfall_logging_collector_stack.gateway.serverName }}:{{ cloudfall_logging_collector_stack.gateway.port }}/loki/api/v1/push"
+
+    tls_config {
+      ca_file     = "{{ cloudfall_logging_collector_stack.collectors.clientTls.caPath }}"
+      cert_file   = "{{ cloudfall_logging_collector_stack.collectors.clientTls.certificatePath }}"
+      key_file    = "{{ cloudfall_logging_collector_stack.collectors.clientTls.keyPath }}"
+      server_name = "{{ cloudfall_logging_collector_stack.gateway.serverName }}"
+      min_version = "TLS12"
+    }
+  }
+}
+
+loki.source.journal "systemd" {
+  forward_to    = [loki.write.cloudfall.receiver]
+  relabel_rules = loki.relabel.journal.rules
+  max_age       = "{{ cloudfall_logging_collector_stack.collectors.journal.maxAgeHours }}h"
+  labels = {
+    source = "journal",
+  }
+}
+
+prometheus.exporter.unix "host" {
+}
+
+prometheus.scrape "host" {
+  targets         = prometheus.exporter.unix.host.targets
+  forward_to      = [prometheus.remote_write.cloudfall.receiver]
+  scrape_interval = "{{ cloudfall_logging_collector_stack.metrics.collection.intervalSeconds }}s"
+}
+
+prometheus.remote_write "cloudfall" {
+  external_labels = {
+    environment = "{{ cloudfall_logging_collector_stack.environment }}",
+    server      = "{{ cloudfall_server_id }}",
+  }
+
+  endpoint {
+    url = "https://{{ cloudfall_logging_collector_stack.gateway.serverName }}:{{ cloudfall_logging_collector_stack.gateway.port }}/api/v1/write"
+
+    tls_config {
+      ca_file     = "{{ cloudfall_logging_collector_stack.collectors.clientTls.caPath }}"
+      cert_file   = "{{ cloudfall_logging_collector_stack.collectors.clientTls.certificatePath }}"
+      key_file    = "{{ cloudfall_logging_collector_stack.collectors.clientTls.keyPath }}"
+      server_name = "{{ cloudfall_logging_collector_stack.gateway.serverName }}"
+      min_version = "TLS12"
+    }
+  }
+}
+{% for service in cloudfall_services | default([]) %}
+{% if service.metrics is defined and service.serviceKind in ('postgresql', 'redis') %}
+{% set component = service.id | replace('-', '_') %}
+
+{% if service.serviceKind == 'postgresql' %}
+prometheus.exporter.postgres "{{ component }}" {
+  data_source_names = [
+    "postgresql://{{ cloudfall_logging_collector_metrics_role }}@:{{ service.bind.port }}/postgres?host=/var/run/postgresql&sslmode=disable",
+  ]
+}
+{% else %}
+prometheus.exporter.redis "{{ component }}" {
+  redis_addr = "{{ service.bind.address }}:{{ service.bind.port }}"
+}
+{% endif %}
+
+prometheus.relabel "{{ component }}" {
+  forward_to = [prometheus.remote_write.cloudfall.receiver]
+
+  rule {
+    target_label = "service"
+    replacement  = "{{ service.id }}"
+  }
+}
+
+prometheus.scrape "{{ component }}" {
+  targets         = prometheus.exporter.{{ 'postgres' if service.serviceKind == 'postgresql' else 'redis' }}.{{ component }}.targets
+  forward_to      = [prometheus.relabel.{{ component }}.receiver]
+  scrape_interval = "{{ cloudfall_logging_collector_stack.metrics.collection.intervalSeconds }}s"
+}
+{% endif %}
+{% endfor %}
+{% for item in cloudfall_logging_collector_stack.collectors.files %}
+{% if cloudfall_server_id in item.servers %}
+
+local.file_match "{{ item.id | replace('-', '_') }}" {
+  path_targets = [
+    {
+      "__path__" = "{{ item.path }}",
+      "source"   = "file",
+      "job"      = "{{ item.id }}",
+{% if item.application is defined %}
+      "application"  = "{{ item.application }}",
+{% endif %}
+{% if item.component is defined %}
+      "component" = "{{ item.component }}",
+{% endif %}
+    },
+  ]
+}
+
+loki.source.file "{{ item.id | replace('-', '_') }}" {
+  targets       = local.file_match.{{ item.id | replace('-', '_') }}.targets
+  forward_to    = [loki.write.cloudfall.receiver]
+  tail_from_end = true
+}
+{% endif %}
+{% endfor %}

cloudfall_engine/_bundled/ansible/roles/cloudfall_nginx_site/defaults/main.yml

@@ -0,0 +1,4 @@
+---
+cloudfall_nginx_site_issue_certificate: false
+cloudfall_nginx_site_acme_webroot: /var/lib/letsencrypt
+cloudfall_nginx_site_receipt_directory: ""

cloudfall_engine/_bundled/ansible/roles/cloudfall_nginx_site/handlers/main.yml

@@ -0,0 +1,5 @@
+---
+- name: Reload Nginx
+  ansible.builtin.systemd_service:
+    name: nginx.service
+    state: reloaded

cloudfall_engine/_bundled/ansible/roles/cloudfall_nginx_site/meta/argument_specs.yml

@@ -0,0 +1,69 @@
+---
+argument_specs:
+  main:
+    short_description: Converge one declared public domain route
+    options:
+      cloudfall_nginx_site_domain:
+        type: dict
+        required: true
+        options:
+          id:
+            type: str
+            required: true
+          primaryName:
+            type: str
+            required: true
+          aliases:
+            type: list
+            elements: str
+            required: true
+          proxy:
+            type: dict
+            required: true
+            options:
+              server:
+                type: str
+                required: true
+              configurationPath:
+                type: path
+                required: true
+              service:
+                type: str
+                required: true
+              upstream:
+                type: dict
+                options:
+                  address:
+                    type: str
+                    required: true
+                  port:
+                    type: int
+                    required: true
+          origin:
+            type: dict
+            required: true
+          edge:
+            type: dict
+            required: true
+          tls:
+            type: dict
+            required: true
+            options:
+              mode:
+                type: str
+                choices:
+                  - disabled
+                  - required
+                required: true
+          healthCheck:
+            type: dict
+            required: true
+      cloudfall_nginx_site_issue_certificate:
+        type: bool
+        default: false
+      cloudfall_nginx_site_acme_webroot:
+        type: path
+        default: /var/lib/letsencrypt
+      cloudfall_nginx_site_receipt_directory:
+        type: str
+        default: ""

cloudfall_engine/_bundled/ansible/roles/cloudfall_nginx_site/meta/main.yml

@@ -0,0 +1,13 @@
+---
+galaxy_info:
+  role_name: cloudfall_nginx_site
+  author: Cloudfall
+  description: Render one declared Domain as a managed Nginx virtual host
+  license: AGPL-3.0-or-later
+  min_ansible_version: "2.21"
+  platforms:
+    - name: Debian
+      versions:
+        - bookworm
+        - trixie
+dependencies: []