84 lines
2.9 KiB
YAML
84 lines
2.9 KiB
YAML
---
|
|
# Ships the whole journal to VictoriaLogs. The uploader keeps the cursor of the last uploaded
|
|
# entry in its state directory, so a restart resumes where it stopped.
|
|
- name: Require the endpoint and the credential
|
|
ansible.builtin.assert:
|
|
that:
|
|
- journal_upload.host | length > 0
|
|
- journal_upload.addresses | length > 0
|
|
- journal_upload.user | length > 0
|
|
- journal_upload.password | length > 0
|
|
fail_msg: journal_upload.host, addresses, user and password must be set
|
|
|
|
- name: Install the journal uploader
|
|
ansible.builtin.apt:
|
|
name: systemd-journal-remote
|
|
install_recommends: false
|
|
state: present
|
|
|
|
# A node reaching its own address arrives at Traefik from its cilium_host address, which the
|
|
# NetBird allowlist rejects; it takes the other nodes.
|
|
- name: Pin the ingest name to the NetBird addresses
|
|
ansible.builtin.blockinfile:
|
|
path: /etc/hosts
|
|
marker: "# {mark} journal_upload"
|
|
block: |
|
|
{% for address in journal_upload.addresses | reject('in', ansible_facts.all_ipv4_addresses) %}
|
|
{{ address }} {{ journal_upload.host }}
|
|
{% endfor %}
|
|
notify: Restart systemd-journal-upload
|
|
|
|
- name: Create the uploader config directory
|
|
ansible.builtin.file:
|
|
path: /etc/systemd/journal-upload.conf.d
|
|
state: directory
|
|
mode: "0755"
|
|
|
|
# The service runs as a dynamic user, which reads the file after the manager dropped privileges.
|
|
- name: Configure the upload URL
|
|
ansible.builtin.copy:
|
|
dest: /etc/systemd/journal-upload.conf.d/10-victorialogs.conf
|
|
mode: "0644"
|
|
content: |
|
|
[Upload]
|
|
URL=https://{{ journal_upload.user }}:{{ journal_upload.password }}@{{ journal_upload.host }}{{ journal_upload.path }}
|
|
# No client certificate; the server certificate is checked against the system CAs.
|
|
ServerKeyFile=-
|
|
ServerCertificateFile=-
|
|
TrustedCertificateFile=/etc/ssl/certs/ca-certificates.crt
|
|
notify: Restart systemd-journal-upload
|
|
no_log: true
|
|
|
|
# The default start limit (5 starts within 10 seconds) gives up during an ingest outage. The
|
|
# uploader resumes from its cursor, so it keeps retrying.
|
|
- name: Create the uploader unit drop-in directory
|
|
ansible.builtin.file:
|
|
path: /etc/systemd/system/systemd-journal-upload.service.d
|
|
state: directory
|
|
mode: "0755"
|
|
|
|
- name: Keep the uploader retrying through ingest outages
|
|
ansible.builtin.copy:
|
|
dest: /etc/systemd/system/systemd-journal-upload.service.d/restart.conf
|
|
mode: "0644"
|
|
content: |
|
|
[Unit]
|
|
StartLimitIntervalSec=0
|
|
|
|
[Service]
|
|
Restart=always
|
|
RestartSec=30s
|
|
notify: Reload systemd manager
|
|
|
|
# The reload has to precede the start below, which otherwise hits the default start limit.
|
|
- name: Load the uploader drop-in
|
|
ansible.builtin.meta: flush_handlers
|
|
|
|
- name: Enable the journal uploader
|
|
ansible.builtin.systemd:
|
|
name: systemd-journal-upload
|
|
enabled: true
|
|
state: started
|
|
# Check mode does not install the package.
|
|
ignore_errors: "{{ ansible_check_mode }}"
|