Joakim
1f3f111d88
Implement complete monitoring infrastructure following rick-infra principles: Components: - VictoriaMetrics: Prometheus-compatible TSDB (7x less RAM usage) - Grafana: Visualization dashboard with Authentik OAuth/OIDC integration - node_exporter: System metrics collection (CPU, memory, disk, network) Architecture: - All services run as native systemd binaries (no containers) - localhost-only binding for security - Grafana uses native OAuth integration with Authentik (not forward_auth) - Full systemd security hardening enabled - Proxied via Caddy at metrics.jnss.me with HTTPS Role Features: - Unified metrics role (single role for complete stack) - Automatic role mapping via Authentik groups: - authentik Admins OR grafana-admins -> Admin access - grafana-editors -> Editor access - All others -> Viewer access - VictoriaMetrics auto-provisioned as default Grafana datasource - 12-month metrics retention by default - Comprehensive documentation included Security: - OAuth/OIDC SSO via Authentik - All metrics services bind to 127.0.0.1 only - systemd hardening (NoNewPrivileges, ProtectSystem, etc.) - Grafana accessible only via Caddy HTTPS proxy Documentation: - roles/metrics/README.md: Complete role documentation - docs/metrics-deployment-guide.md: Step-by-step deployment guide Configuration: - Updated rick-infra.yml to include metrics deployment - Grafana port set to 3001 (Gitea uses 3000) - Ready for multi-host expansion (designed for future node_exporter deployment to production hosts)
56 lines
1.4 KiB
YAML
56 lines
1.4 KiB
YAML
---
|
|
# Homelab Infrastructure Deployment
|
|
#
|
|
# Deploys personal homelab services to arch-vps including:
|
|
# - PostgreSQL database
|
|
# - Valkey cache/session store
|
|
# - Podman container runtime
|
|
# - Caddy web server
|
|
# - Nextcloud cloud storage
|
|
# - Authentik SSO/authentication
|
|
# - Gitea git hosting
|
|
# - Vaultwarden password manager
|
|
# - Metrics (VictoriaMetrics, Grafana, node_exporter)
|
|
#
|
|
# Usage:
|
|
# ansible-playbook rick-infra.yml
|
|
# ansible-playbook rick-infra.yml --tags metrics
|
|
|
|
# - import_playbook: playbooks/security.yml
|
|
- name: Deploy Homelab Infrastructure
|
|
hosts: homelab
|
|
become: true
|
|
gather_facts: true
|
|
|
|
tasks:
|
|
# - name: Deploy Caddy
|
|
# include_role:
|
|
# name: caddy
|
|
# tags: ['caddy']
|
|
|
|
- name: Deploy Metrics Stack
|
|
include_role:
|
|
name: metrics
|
|
tags: ['metrics', 'monitoring', 'grafana', 'victoriametrics']
|
|
|
|
# - name: Deploy Authentik
|
|
# include_role:
|
|
# name: authentik
|
|
# tags: ['authentik', 'sso', 'auth']
|
|
|
|
# - name: Deploy Gitea
|
|
# include_role:
|
|
# name: gitea
|
|
# tags: ['gitea', 'git', 'development']
|
|
|
|
# - name: Deploy Nextcloud
|
|
# include_role:
|
|
# name: nextcloud
|
|
# tags: ['nextcloud', 'cloud', 'storage']
|
|
|
|
# - name: Deploy Vaultwarden
|
|
# include_role:
|
|
# name: vaultwarden
|
|
# tags: ['vaultwarden', 'vault', 'password-manager', 'security']
|
|
|