diff --git a/.gitignore b/.gitignore index 58d3b79e6..5185d7a24 100644 --- a/.gitignore +++ b/.gitignore @@ -68,3 +68,5 @@ package-lock.json # Ignore built assets generated by Tailwind CSS during compilation process /app/assets/builds/* !/app/assets/builds/.keep + +secrets.yml \ No newline at end of file diff --git a/ansible/README.md b/ansible/README.md new file mode 100644 index 000000000..b60b98eb7 --- /dev/null +++ b/ansible/README.md @@ -0,0 +1,38 @@ +## Documentation: Using Ansible to Configure Monit on a Server + +## Introduction + +This documentation provides a guide on configuring Monit on a server using Ansible. Monit is a process supervision tool that monitors services and restarts them if they fail. Ansible automates the setup of Monit configurations, ensuring consistency across environments. + +## Prerequisites + +- Ansible installed on your local machine +- SSH access to the target server + +## Ansible Playbook Breakdown + +The playbook for Monit setup typically consists of the following tasks: + +- Install Monit: Installs the Monit package on the server. +- Copy Monit Configuration Templates: Places your custom Monit configuration files in the appropriate directory. +- Start and Enable Monit: Ensures Monit is started and set to start on boot. + +## Running the Ansible Playbook + +Run the playbook from the Ansible directory with the following command for production environment: + +``` +ansible-playbook -i ./inventory-prod.yml ./monit-role.yml +``` + +or + +``` +ansible-playbook -i ./inventory-dev.yml ./monit-role.yml +``` + +for development environment + +## Accessing to monit + +Monit is accessible on the port `2812` diff --git a/ansible/inventory-dev.yml b/ansible/inventory-dev.yml new file mode 100644 index 000000000..7a6325880 --- /dev/null +++ b/ansible/inventory-dev.yml @@ -0,0 +1,7 @@ +webservers: + hosts: + monit: + ansible_host: 34.133.234.147 + ansible_user: andrii_khomik + ansible_ssh_private_key: ~/.ssh/gcp + diff --git a/ansible/inventory-prod.yml b/ansible/inventory-prod.yml new file mode 100644 index 000000000..e5697182c --- /dev/null +++ b/ansible/inventory-prod.yml @@ -0,0 +1,6 @@ +webservers: + hosts: + monit: + ansible_host: 34.136.62.183 + ansible_user: andrii_khomik + ansible_ssh_private_key: ~/.ssh/gcp diff --git a/ansible/monit-role.yml b/ansible/monit-role.yml new file mode 100644 index 000000000..79725b714 --- /dev/null +++ b/ansible/monit-role.yml @@ -0,0 +1,8 @@ +--- +- name: use monit role playbook + hosts: monit + become: true + + roles: + - role: monit + system_manager: engineering.zerowaste@gmail.com diff --git a/ansible/monit/README.md b/ansible/monit/README.md new file mode 100644 index 000000000..225dd44b9 --- /dev/null +++ b/ansible/monit/README.md @@ -0,0 +1,38 @@ +Role Name +========= + +A brief description of the role goes here. + +Requirements +------------ + +Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required. + +Role Variables +-------------- + +A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well. + +Dependencies +------------ + +A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles. + +Example Playbook +---------------- + +Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too: + + - hosts: servers + roles: + - { role: username.rolename, x: 42 } + +License +------- + +BSD + +Author Information +------------------ + +An optional section for the role authors to include contact information, or a website (HTML is not allowed). diff --git a/ansible/monit/defaults/main.yml b/ansible/monit/defaults/main.yml new file mode 100644 index 000000000..530398b86 --- /dev/null +++ b/ansible/monit/defaults/main.yml @@ -0,0 +1,2 @@ +--- +# defaults file for monit diff --git a/ansible/monit/files/nginx b/ansible/monit/files/nginx new file mode 100644 index 000000000..f5dd8d3b9 --- /dev/null +++ b/ansible/monit/files/nginx @@ -0,0 +1,5 @@ +check process nginx with pidfile /run/nginx.pid + start program = "/usr/sbin/service nginx start" with timeout 60 seconds + stop program = "/usr/sbin/service nginx stop" + if failed host 127.0.0.1 port 443 protocol https for 3 cycles then alert + if failed host 127.0.0.1 port 443 protocol https for 3 cycles then restart \ No newline at end of file diff --git a/ansible/monit/files/postgresql b/ansible/monit/files/postgresql new file mode 100644 index 000000000..12ede6c81 --- /dev/null +++ b/ansible/monit/files/postgresql @@ -0,0 +1,4 @@ +check process postgresql with pidfile /var/run/postgresql/12-main.pid + start program = "/bin/systemctl postgresql start" + stop program = "/bin/systemctl postgresql stop" + if failed port 5432 then alert \ No newline at end of file diff --git a/ansible/monit/files/redis b/ansible/monit/files/redis new file mode 100644 index 000000000..1797e46bf --- /dev/null +++ b/ansible/monit/files/redis @@ -0,0 +1,8 @@ +check process redis with pidfile /var/run/redis/redis-server.pid + start program = "/usr/sbin/service redis-server start" + stop program = "/usr/sbin/service redis-server stop" + + if failed host 127.0.0.1 port 6379 + then restart + if 5 restarts within 5 cycles + then alert diff --git a/ansible/monit/handlers/main.yml b/ansible/monit/handlers/main.yml new file mode 100644 index 000000000..a08334a45 --- /dev/null +++ b/ansible/monit/handlers/main.yml @@ -0,0 +1,5 @@ +--- +- name: Restart monit + service: + name: monit + state: restarted diff --git a/ansible/monit/meta/main.yml b/ansible/monit/meta/main.yml new file mode 100644 index 000000000..5ab185557 --- /dev/null +++ b/ansible/monit/meta/main.yml @@ -0,0 +1,34 @@ +galaxy_info: + author: your name + description: your role description + company: your company (optional) + + # If the issue tracker for your role is not on github, uncomment the + # next line and provide a value + # issue_tracker_url: http://example.com/issue/tracker + + # Choose a valid license ID from https://spdx.org - some suggested licenses: + # - BSD-3-Clause (default) + # - MIT + # - GPL-2.0-or-later + # - GPL-3.0-only + # - Apache-2.0 + # - CC-BY-4.0 + license: license (GPL-2.0-or-later, MIT, etc) + + min_ansible_version: 2.16.3 + + # If this a Container Enabled role, provide the minimum Ansible Container version. + # min_ansible_container_version: + + galaxy_tags: [] + # List tags for your role here, one per line. A tag is a keyword that describes + # and categorizes the role. Users find roles by searching for tags. Be sure to + # remove the '[]' above, if you add tags to this list. + # + # NOTE: A tag is limited to a single word comprised of alphanumeric characters. + # Maximum 20 tags per role. + +dependencies: [] + # List your role dependencies here, one per line. Be sure to remove the '[]' above, + # if you add dependencies to this list. diff --git a/ansible/monit/tasks/main.yml b/ansible/monit/tasks/main.yml new file mode 100644 index 000000000..cf06deb05 --- /dev/null +++ b/ansible/monit/tasks/main.yml @@ -0,0 +1,40 @@ +--- +- name: Install Monit + apt: + name: monit + state: present + +- name: Ensure Monit is enabled and started + systemd: + name: monit + enabled: yes + state: started + +- name: Copy Redis Monit config + copy: + dest: /etc/monit/conf.d/redis + src: files/redis + +- name: Copy Postgres Monit config + copy: + dest: /etc/monit/conf.d/postgresql + src: files/postgresql + +- name: Copy Redis Nginx config + copy: + dest: /etc/monit/conf.d/nginx + src: files/nginx + +- name: Include encrypted secrets + include_vars: + file: vars/secrets.yml + +- name: Copy monit template config files + template: + src: "templates/monitrc.j2" + dest: "/etc/monit/monitrc" + +- name: Reload monit to apply configuration + command: monit reload + notify: + - Restart monit diff --git a/ansible/monit/templates/monitrc.j2 b/ansible/monit/templates/monitrc.j2 new file mode 100644 index 000000000..06820ed2e --- /dev/null +++ b/ansible/monit/templates/monitrc.j2 @@ -0,0 +1,316 @@ +############################################################################### +## Monit control file +############################################################################### +## +## Comments begin with a '#' and extend through the end of the line. Keywords +## are case insensitive. All path's MUST BE FULLY QUALIFIED, starting with '/'. +## +## Below you will find examples of some frequently used statements. For +## information about the control file and a complete list of statements and +## options, please have a look in the Monit manual. +## +## +############################################################################### +## Global section +############################################################################### +## +## Start Monit in the background (run as a daemon): +# + set daemon 60 # check services at 2-minute intervals +# with start delay 240 # optional: delay the first check by 4-minutes (by +# # default Monit check immediately after Monit start) +# +# +## Set syslog logging. If you want to log to a standalone log file instead, +## specify the full path to the log file +# + set log /var/log/monit.log + +# +# +## Set the location of the Monit lock file which stores the process id of the +## running Monit instance. By default this file is stored in $HOME/.monit.pid +# +# set pidfile /var/run/monit.pid +# +## Set the location of the Monit id file which stores the unique id for the +## Monit instance. The id is generated and stored on first Monit start. By +## default the file is placed in $HOME/.monit.id. +# +# set idfile /var/.monit.id + set idfile /var/lib/monit/id +# +## Set the location of the Monit state file which saves monitoring states +## on each cycle. By default the file is placed in $HOME/.monit.state. If +## the state file is stored on a persistent filesystem, Monit will recover +## the monitoring state across reboots. If it is on temporary filesystem, the +## state will be lost on reboot which may be convenient in some situations. +# + set statefile /var/lib/monit/state +# +# + +## Set limits for various tests. The following example shows the default values: +## +# set limits { +# programOutput: 512 B, # check program's output truncate limit +# sendExpectBuffer: 256 B, # limit for send/expect protocol test +# fileContentBuffer: 512 B, # limit for file content test +# httpContentBuffer: 1 MB, # limit for HTTP content test +# networkTimeout: 5 seconds # timeout for network I/O +# programTimeout: 300 seconds # timeout for check program +# stopTimeout: 30 seconds # timeout for service stop +# startTimeout: 30 seconds # timeout for service start +# restartTimeout: 30 seconds # timeout for service restart +# } + +## Set global SSL options (just most common options showed, see manual for +## full list). +# +# set ssl { +# verify : enable, # verify SSL certificates (disabled by default but STRONGLY RECOMMENDED) +# selfsigned : allow # allow self signed SSL certificates (reject by default) +# } +# +# +## Set the list of mail servers for alert delivery. Multiple servers may be +## specified using a comma separator. If the first mail server fails, Monit +# will use the second mail server in the list and so on. By default Monit uses +# port 25 - it is possible to override this with the PORT option. +# + +set mailserver smtp.gmail.com port 587 + username "{{ smtp_user }}" password "{{ smtp_pass }}" + using tls + +{% for email in alert_emails %} +set alert {{ email }} +{% endfor %} + + +# backup.bar.baz port 10025, # backup mailserver on port 10025 +# localhost # fallback relay +# +# +## By default Monit will drop alert events if no mail servers are available. +## If you want to keep the alerts for later delivery retry, you can use the +## EVENTQUEUE statement. The base directory where undelivered alerts will be +## stored is specified by the BASEDIR option. You can limit the queue size +## by using the SLOTS option (if omitted, the queue is limited by space +## available in the back end filesystem). +# + set eventqueue + basedir /var/lib/monit/events # set the base directory where events will be stored + slots 100 # optionally limit the queue size +# +# +## Send status and events to M/Monit (for more informations about M/Monit +## see https://mmonit.com/). By default Monit registers credentials with +## M/Monit so M/Monit can smoothly communicate back to Monit and you don't +## have to register Monit credentials manually in M/Monit. It is possible to +## disable credential registration using the commented out option below. +## Though, if safety is a concern we recommend instead using https when +## communicating with M/Monit and send credentials encrypted. The password +## should be URL encoded if it contains URL-significant characters like +## ":", "?", "@". Default timeout is 5 seconds, you can customize it by +## adding the timeout option. +# + +# # with timeout 30 seconds # Default timeout is 5 seconds +# # and register without credentials # Don't register credentials +# +# +## Monit by default uses the following format for alerts if the mail-format +## statement is missing:: +## --8<-- +## set mail-format { +## from: Monit +## subject: monit alert -- $EVENT $SERVICE +## message: $EVENT Service $SERVICE +## Date: $DATE +## Action: $ACTION +## Host: $HOST +## Description: $DESCRIPTION +## +## Your faithful employee, +## Monit +## } +## --8<-- +## +## You can override this message format or parts of it, such as subject +## or sender using the MAIL-FORMAT statement. Macros such as $DATE, etc. +## are expanded at runtime. For example, to override the sender, use: +# +# set mail-format { from: monit@foo.bar } +# +# +## You can set alert recipients whom will receive alerts if/when a +## service defined in this file has errors. Alerts may be restricted on +## events by using a filter as in the second example below. +# +# set alert sysadm@foo.bar # receive all alerts +# +## Do not alert when Monit starts, stops or performs a user initiated action. +## This filter is recommended to avoid getting alerts for trivial cases. +# +# set alert your-name@your.domain not on { instance, action } +# +# +## Monit has an embedded HTTP interface which can be used to view status of +## services monitored and manage services from a web interface. The HTTP +## interface is also required if you want to issue Monit commands from the +## command line, such as 'monit status' or 'monit restart service' The reason +## for this is that the Monit client uses the HTTP interface to send these +## commands to a running Monit daemon. See the Monit Wiki if you want to +## enable SSL for the HTTP interface. +# +set httpd port 2812 and + use address 0.0.0.0 # only accept connection from localhost (drop if you use M/Monit) + allow 0.0.0.0/0 # allow localhost to connect to the server and + allow admin:monit # require user 'admin' with password 'monit' +# #with ssl { # enable SSL/TLS and set path to server certificate +# # pemfile: /etc/ssl/certs/monit.pem +# #} + +############################################################################### +## Services +############################################################################### +## +## Check general system resources such as load average, cpu and memory +## usage. Each test specifies a resource, conditions and the action to be +## performed should a test fail. +# +# check system $HOST +# if loadavg (1min) per core > 2 for 5 cycles then alert +# if loadavg (5min) per core > 1.5 for 10 cycles then alert +# if cpu usage > 95% for 10 cycles then alert +# if memory usage > 75% then alert +# if swap usage > 25% then alert +# +# +## Check if a file exists, checksum, permissions, uid and gid. In addition +## to alert recipients in the global section, customized alert can be sent to +## additional recipients by specifying a local alert handler. The service may +## be grouped using the GROUP option. More than one group can be specified by +## repeating the 'group name' statement. +# +# check file apache_bin with path /usr/local/apache/bin/httpd +# if failed checksum and +# expect the sum 8f7f419955cefa0b33a2ba316cba3659 then unmonitor +# if failed permission 755 then unmonitor +# if failed uid "root" then unmonitor +# if failed gid "root" then unmonitor +# alert security@foo.bar on { +# checksum, permission, uid, gid, unmonitor +# } with the mail-format { subject: Alarm! } +# group server +# +# +## Check that a process is running, in this case Apache, and that it respond +## to HTTP and HTTPS requests. Check its resource usage such as cpu and memory, +## and number of children. If the process is not running, Monit will restart +## it by default. In case the service is restarted very often and the +## problem remains, it is possible to disable monitoring using the TIMEOUT +## statement. This service depends on another service (apache_bin) which +## is defined above. +# +# check process apache with pidfile /usr/local/apache/logs/httpd.pid +# start program = "/etc/init.d/httpd start" with timeout 60 seconds +# stop program = "/etc/init.d/httpd stop" +# if cpu > 60% for 2 cycles then alert +# if cpu > 80% for 5 cycles then restart +# if totalmem > 200.0 MB for 5 cycles then restart +# if children > 250 then restart +# if disk read > 500 kb/s for 10 cycles then alert +# if disk write > 500 kb/s for 10 cycles then alert +# if failed host www.tildeslash.com port 80 protocol http and request "/somefile.html" then restart +# if failed port 443 protocol https with timeout 15 seconds then restart +# if 3 restarts within 5 cycles then unmonitor +# depends on apache_bin +# group server +# +# +## Check filesystem permissions, uid, gid, space usage, inode usage and disk I/O. +## Other services, such as databases, may depend on this resource and an automatically +## graceful stop may be cascaded to them before the filesystem will become full and data +## lost. +# +# check filesystem datafs with path /dev/sdb1 +# start program = "/bin/mount /data" +# stop program = "/bin/umount /data" +# if failed permission 660 then unmonitor +# if failed uid "root" then unmonitor +# if failed gid "disk" then unmonitor +# if space usage > 80% for 5 times within 15 cycles then alert +# if space usage > 99% then stop +# if inode usage > 30000 then alert +# if inode usage > 99% then stop +# if read rate > 1 MB/s for 5 cycles then alert +# if read rate > 500 operations/s for 5 cycles then alert +# if write rate > 1 MB/s for 5 cycles then alert +# if write rate > 500 operations/s for 5 cycles then alert +# if service time > 10 milliseconds for 3 times within 5 cycles then alert +# group server +# +# +## Check a file's timestamp. In this example, we test if a file is older +## than 15 minutes and assume something is wrong if its not updated. Also, +## if the file size exceed a given limit, execute a script +# +# check file database with path /data/mydatabase.db +# if failed permission 700 then alert +# if failed uid "data" then alert +# if failed gid "data" then alert +# if timestamp > 15 minutes then alert +# if size > 100 MB then exec "/my/cleanup/script" as uid dba and gid dba +# +# +## Check directory permission, uid and gid. An event is triggered if the +## directory does not belong to the user with uid 0 and gid 0. In addition, +## the permissions have to match the octal description of 755 (see chmod(1)). +# +# check directory bin with path /bin +# if failed permission 755 then unmonitor +# if failed uid 0 then unmonitor +# if failed gid 0 then unmonitor +# +# +## Check a remote host availability by issuing a ping test and check the +## content of a response from a web server. Up to three pings are sent and +## connection to a port and an application level network check is performed. +# +# check host myserver with address 192.168.1.1 +# if failed ping then alert +# if failed port 3306 protocol mysql with timeout 15 seconds then alert +# if failed port 80 protocol http +# and request /some/path with content = "a string" +# then alert +# +# +## Check a network link status (up/down), link capacity changes, saturation +## and bandwidth usage. +# +# check network public with interface eth0 +# if failed link then alert +# if changed link then alert +# if saturation > 90% then alert +# if download > 10 MB/s then alert +# if total uploaded > 1 GB in last hour then alert +# +# +## Check custom program status output. +# +# check program myscript with path /usr/local/bin/myscript.sh +# if status != 0 then alert +# +# +############################################################################### +## Includes +############################################################################### +## +## It is possible to include additional configuration parts from other files or +## directories. +# + include /etc/monit/conf.d/* + include /etc/monit/conf-enabled/* +# diff --git a/ansible/monit/tests/inventory b/ansible/monit/tests/inventory new file mode 100644 index 000000000..878877b07 --- /dev/null +++ b/ansible/monit/tests/inventory @@ -0,0 +1,2 @@ +localhost + diff --git a/ansible/monit/tests/test.yml b/ansible/monit/tests/test.yml new file mode 100644 index 000000000..a62a33777 --- /dev/null +++ b/ansible/monit/tests/test.yml @@ -0,0 +1,5 @@ +--- +- hosts: localhost + remote_user: root + roles: + - monit diff --git a/ansible/monit/vars/main.yml b/ansible/monit/vars/main.yml new file mode 100644 index 000000000..88a09d5c1 --- /dev/null +++ b/ansible/monit/vars/main.yml @@ -0,0 +1,7 @@ +--- +smtp_user: "engineering.zerowaste@gmail.com" + +alert_emails: + - andrii.khomik@gmail.com + - vanuha277@gmail.com + - olegiv.mail@gmail.com