feat: 补齐共享数据备份、证书续签与开发实例监控

2026-09-27 17:05:24 +00:00
parent 06943d4c65
commit 0988f5c37e
12 changed files with 642 additions and 1 deletions
@@ -0,0 +1,145 @@
+---
+- name: 采集共享数据服务维护指标
+  hosts: shared_data_monitoring
+  become: true
+  gather_facts: false
+  vars:
+    data_monitor_root: /opt/homelab-data-monitoring
+    data_monitor_exporter_version: 1.9.1
+    data_monitor_download_base: https://github.com/prometheus/node_exporter/releases/download
+    data_monitor_archive: "node_exporter-{{ data_monitor_exporter_version }}.linux-amd64"
+  tasks:
+    - name: 检查仅支持 amd64
+      ansible.builtin.command: uname -m
+      register: data_monitor_arch
+      changed_when: false
+    - name: 拒绝错误架构
+      ansible.builtin.assert:
+        that: data_monitor_arch.stdout == 'x86_64'
+    - name: 创建 root 管理目录
+      ansible.builtin.file:
+        path: "{{ item }}"
+        state: directory
+        owner: root
+        group: root
+        mode: '0755'
+      loop:
+        - "{{ data_monitor_root }}"
+        - /etc/homelab-data-monitoring
+        - /var/lib/homelab-data-monitoring
+    - name: 下载已固定校验和的上游 exporter
+      ansible.builtin.get_url:
+        url: >-
+          {{ data_monitor_download_base }}/v{{ data_monitor_exporter_version }}/{{ data_monitor_archive }}.tar.gz
+        dest: "{{ data_monitor_root }}/node_exporter.tar.gz"
+        checksum: sha256:becb950ee80daa8ae7331d77966d94a611af79ad0d3307380907e0ec08f5b4e8
+        owner: root
+        group: root
+        mode: '0644'
+    - name: 解压 exporter（保留上游许可证）
+      ansible.builtin.unarchive:
+        src: "{{ data_monitor_root }}/node_exporter.tar.gz"
+        dest: "{{ data_monitor_root }}"
+        remote_src: true
+        creates: "{{ data_monitor_root }}/node_exporter-{{ data_monitor_exporter_version }}.linux-amd64/node_exporter"
+    - name: 安装只读采集程序
+      ansible.builtin.copy:
+        src: ../files/collect.py
+        dest: "{{ data_monitor_root }}/collect.py"
+        owner: root
+        group: root
+        mode: '0755'
+    - name: 配置明确的证书与检查清单
+      ansible.builtin.template:
+        src: config.json.j2
+        dest: /etc/homelab-data-monitoring/config.json
+        owner: root
+        group: root
+        mode: '0644'
+    - name: 安装采集 service
+      ansible.builtin.copy:
+        dest: /etc/systemd/system/homelab-data-collect.service
+        mode: '0644'
+        content: |
+          [Unit]
+          Description=Read-only shared data maintenance checks
+          [Service]
+          Type=oneshot
+          ExecStart=/usr/bin/python3 {{ data_monitor_root }}/collect.py \
+            --config /etc/homelab-data-monitoring/config.json \
+            --output /var/lib/homelab-data-monitoring/health.prom
+          Environment=LC_ALL=C
+          Environment=PGCONNECT_TIMEOUT=5
+          Environment="PGOPTIONS=-c statement_timeout=5000"
+          TimeoutStartSec=50
+          UMask=0022
+          ProtectSystem=strict
+          ReadWritePaths=/var/lib/homelab-data-monitoring
+          PrivateTmp=true
+          MemoryMax=96M
+          Nice=10
+    - name: 安装每分钟采集 timer
+      ansible.builtin.copy:
+        dest: /etc/systemd/system/homelab-data-collect.timer
+        mode: '0644'
+        content: |
+          [Unit]
+          Description=Collect shared data maintenance metrics every minute
+          [Timer]
+          OnBootSec=30s
+          OnUnitActiveSec=60s
+          AccuracySec=5s
+          [Install]
+          WantedBy=timers.target
+    - name: 安装仅内网 textfile exporter
+      ansible.builtin.copy:
+        dest: /etc/systemd/system/homelab-data-exporter.service
+        mode: '0644'
+        content: |
+          [Unit]
+          Description=Shared data textfile metrics
+          After=network-online.target
+          Wants=network-online.target
+          [Service]
+          DynamicUser=true
+          ExecStart={{ data_monitor_root }}/{{ data_monitor_archive }}/node_exporter \
+            --web.listen-address={{ ansible_host }}:9109 \
+            --collector.disable-defaults --collector.textfile \
+            --collector.textfile.directory=/var/lib/homelab-data-monitoring --web.disable-exporter-metrics
+          Restart=on-failure
+          NoNewPrivileges=true
+          ProtectSystem=strict
+          ProtectHome=true
+          PrivateTmp=true
+          MemoryMax=64M
+          [Install]
+          WantedBy=multi-user.target
+      notify: Restart shared data exporter
+    - name: 重载 unit 声明
+      ansible.builtin.systemd_service:
+        daemon_reload: true
+    - name: 首次只读采集并检查程序能够完成
+      ansible.builtin.command:
+        argv:
+          - /usr/bin/python3
+          - "{{ data_monitor_root }}/collect.py"
+          - --config
+          - /etc/homelab-data-monitoring/config.json
+          - --output
+          - /var/lib/homelab-data-monitoring/health.prom
+      environment:
+        LC_ALL: C
+        PGCONNECT_TIMEOUT: '5'
+        PGOPTIONS: '-c statement_timeout=5000'
+      changed_when: false
+    - name: 启用监控服务
+      ansible.builtin.systemd_service:
+        name: "{{ item }}"
+        enabled: true
+        state: started
+      loop: [homelab-data-collect.timer, homelab-data-exporter.service]
+  handlers:
+    - name: Restart shared data exporter
+      ansible.builtin.systemd_service:
+        name: homelab-data-exporter.service
+        state: restarted