Initial LisgloSIPS V2 implementation
This commit is contained in:
hectorzhao
@@ -0,0 +1,5 @@
|
||||
GRAFANA_VERSION=13.0.2
|
||||
GRAFANA_PACKAGE=grafana_13.0.2_26816849631_linux_amd64.deb
|
||||
GRAFANA_SHA256=ce64458852e49b897cabe7dee32741c9cf1bb623092ee4c6f7250aa7c6b83453
|
||||
GRAFANA_MIRROR=https://mirrors.tuna.tsinghua.edu.cn/grafana/apt
|
||||
|
||||
@@ -0,0 +1,12 @@
|
||||
{
|
||||
"registry-mirrors": [
|
||||
"https://docker.m.daocloud.io"
|
||||
],
|
||||
"live-restore": true,
|
||||
"log-driver": "local",
|
||||
"log-opts": {
|
||||
"max-size": "20m",
|
||||
"max-file": "3"
|
||||
},
|
||||
"no-new-privileges": true
|
||||
}
|
||||
@@ -0,0 +1,12 @@
|
||||
apiVersion: 1
|
||||
|
||||
providers:
|
||||
- name: LisgloSIPS
|
||||
orgId: 1
|
||||
folder: LisgloSIPS
|
||||
type: file
|
||||
disableDeletion: true
|
||||
editable: false
|
||||
options:
|
||||
path: /etc/grafana/provisioning/dashboards/lisglosips
|
||||
|
||||
@@ -0,0 +1,32 @@
|
||||
apiVersion: 1
|
||||
|
||||
deleteDatasources:
|
||||
- name: Prometheus
|
||||
orgId: 1
|
||||
- name: HOMER PostgreSQL
|
||||
orgId: 1
|
||||
|
||||
datasources:
|
||||
- name: Prometheus
|
||||
uid: lisglosips-prometheus
|
||||
type: prometheus
|
||||
access: proxy
|
||||
url: http://127.0.0.1:9090
|
||||
isDefault: true
|
||||
editable: false
|
||||
|
||||
- name: HOMER PostgreSQL
|
||||
uid: lisglosips-homer-postgres
|
||||
type: postgres
|
||||
access: proxy
|
||||
url: 127.0.0.1:5432
|
||||
user: homer_user
|
||||
database: homer_data
|
||||
editable: false
|
||||
jsonData:
|
||||
sslmode: disable
|
||||
postgresVersion: 1600
|
||||
timescaledb: false
|
||||
secureJsonData:
|
||||
password: $HOMER_DB_PASSWORD
|
||||
|
||||
@@ -0,0 +1,13 @@
|
||||
GRAFANA_USER=grafana
|
||||
GRAFANA_GROUP=grafana
|
||||
GRAFANA_HOME=/usr/share/grafana
|
||||
LOG_DIR=/var/log/grafana
|
||||
DATA_DIR=/data/grafana
|
||||
MAX_OPEN_FILES=10000
|
||||
CONF_DIR=/etc/grafana
|
||||
CONF_FILE=/etc/grafana/grafana.ini
|
||||
RESTART_ON_UPGRADE=true
|
||||
PLUGINS_DIR=/data/grafana/plugins
|
||||
PROVISIONING_CFG_DIR=/etc/grafana/provisioning
|
||||
PID_FILE_DIR=/run/grafana
|
||||
|
||||
@@ -0,0 +1,35 @@
|
||||
{
|
||||
"annotations": {"list": []},
|
||||
"editable": false,
|
||||
"panels": [
|
||||
{
|
||||
"type": "stat",
|
||||
"title": "Targets Up",
|
||||
"datasource": {"type": "prometheus", "uid": "lisglosips-prometheus"},
|
||||
"targets": [{"expr": "sum(up)", "refId": "A"}],
|
||||
"gridPos": {"h": 8, "w": 8, "x": 0, "y": 0}
|
||||
},
|
||||
{
|
||||
"type": "timeseries",
|
||||
"title": "A/B CPU Usage",
|
||||
"datasource": {"type": "prometheus", "uid": "lisglosips-prometheus"},
|
||||
"targets": [{"expr": "100 - avg by (server) (rate(node_cpu_seconds_total{mode=\"idle\"}[5m])) * 100", "legendFormat": "{{server}}", "refId": "A"}],
|
||||
"gridPos": {"h": 8, "w": 16, "x": 8, "y": 0}
|
||||
},
|
||||
{
|
||||
"type": "timeseries",
|
||||
"title": "A/B Memory Usage",
|
||||
"datasource": {"type": "prometheus", "uid": "lisglosips-prometheus"},
|
||||
"targets": [{"expr": "100 * (1 - node_memory_MemAvailable_bytes / node_memory_MemTotal_bytes)", "legendFormat": "{{server}}", "refId": "A"}],
|
||||
"gridPos": {"h": 8, "w": 24, "x": 0, "y": 8}
|
||||
}
|
||||
],
|
||||
"schemaVersion": 41,
|
||||
"tags": ["lisglosips", "infrastructure"],
|
||||
"templating": {"list": []},
|
||||
"time": {"from": "now-1h", "to": "now"},
|
||||
"title": "LisgloSIPS Infrastructure Overview",
|
||||
"uid": "lisglosips-infra-overview",
|
||||
"version": 1
|
||||
}
|
||||
|
||||
@@ -0,0 +1,23 @@
|
||||
HEPLIFYSERVER_HEPADDR=100.90.90.91:9060
|
||||
HEPLIFYSERVER_HEPTCPADDR=
|
||||
HEPLIFYSERVER_HEPTLSADDR=
|
||||
HEPLIFYSERVER_DBSHEMA=homer7
|
||||
HEPLIFYSERVER_DBDRIVER=postgres
|
||||
HEPLIFYSERVER_DBADDR=127.0.0.1:5432
|
||||
HEPLIFYSERVER_DBUSER=homer_user
|
||||
HEPLIFYSERVER_DBPASS=<HOMER_DB_PASSWORD>
|
||||
HEPLIFYSERVER_DBDATATABLE=homer_data
|
||||
HEPLIFYSERVER_DBCONFTABLE=homer_config
|
||||
HEPLIFYSERVER_DBDROPDAYS=7
|
||||
HEPLIFYSERVER_DBROTATE=true
|
||||
HEPLIFYSERVER_DBBUFFER=200000
|
||||
HEPLIFYSERVER_DBBULK=200
|
||||
HEPLIFYSERVER_DBWORKER=4
|
||||
HEPLIFYSERVER_DBTIMER=2
|
||||
HEPLIFYSERVER_LOGLVL=info
|
||||
HEPLIFYSERVER_LOGSTD=true
|
||||
HEPLIFYSERVER_PROMADDR=127.0.0.1:9096
|
||||
HEPLIFYSERVER_PROMTARGETIP=100.90.90.91
|
||||
HEPLIFYSERVER_PROMTARGETNAME=server-b
|
||||
HEPLIFYSERVER_DEDUP=false
|
||||
|
||||
@@ -0,0 +1,15 @@
|
||||
<!doctype html>
|
||||
<html lang="zh-CN">
|
||||
<head>
|
||||
<meta charset="utf-8" />
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1" />
|
||||
<title>LisgloSIPS HOMER</title>
|
||||
</head>
|
||||
<body>
|
||||
<main>
|
||||
<h1>LisgloSIPS HOMER</h1>
|
||||
<p>HOMER API 与 HEP 存储服务已就绪。</p>
|
||||
</main>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
@@ -0,0 +1,73 @@
|
||||
{
|
||||
"database_data": {
|
||||
"LocalNode": {
|
||||
"node": "LocalNode",
|
||||
"user": "homer_user",
|
||||
"pass": "<HOMER_DB_PASSWORD>",
|
||||
"name": "homer_data",
|
||||
"keepalive": true,
|
||||
"host": "127.0.0.1"
|
||||
}
|
||||
},
|
||||
"database_config": {
|
||||
"node": "LocalConfig",
|
||||
"user": "homer_user",
|
||||
"pass": "<HOMER_DB_PASSWORD>",
|
||||
"name": "homer_config",
|
||||
"keepalive": true,
|
||||
"host": "127.0.0.1"
|
||||
},
|
||||
"hep_relay": {
|
||||
"host": "100.90.90.91",
|
||||
"port": 9060
|
||||
},
|
||||
"prometheus_config": {
|
||||
"enable": true,
|
||||
"host": "http://127.0.0.1:9090",
|
||||
"api": "api/v1"
|
||||
},
|
||||
"influxdb_config": {
|
||||
"enable": false
|
||||
},
|
||||
"loki_config": {
|
||||
"enable": false
|
||||
},
|
||||
"grafana_config": {
|
||||
"enable": true,
|
||||
"host": "http://127.0.0.1:3001",
|
||||
"path": "grafana",
|
||||
"proxy_control": false
|
||||
},
|
||||
"http_settings": {
|
||||
"host": "127.0.0.1",
|
||||
"port": 9080,
|
||||
"root": "/usr/local/homer/dist",
|
||||
"gzip": false,
|
||||
"gzip_static": false,
|
||||
"path": "/",
|
||||
"debug": false
|
||||
},
|
||||
"swagger": {
|
||||
"enable": true,
|
||||
"api_json": "/etc/homer/swagger.json",
|
||||
"api_host": "homer.lisglosips.local"
|
||||
},
|
||||
"system_settings": {
|
||||
"logpath": "/var/log/homer",
|
||||
"logname": "homer-app.log",
|
||||
"loglevel": "info",
|
||||
"logstdout": true
|
||||
},
|
||||
"auth_settings": {
|
||||
"type": "internal",
|
||||
"jwt_secret": "<HOMER_JWT_SECRET>",
|
||||
"gravatar": false,
|
||||
"token_expire": 1200,
|
||||
"user_groups": ["admin", "user", "support"]
|
||||
},
|
||||
"api_settings": {
|
||||
"enable_token_access": false,
|
||||
"add_captid_to_resolve": false
|
||||
}
|
||||
}
|
||||
|
||||
@@ -0,0 +1,34 @@
|
||||
server {
|
||||
listen 443 ssl;
|
||||
listen [::]:443 ssl;
|
||||
server_name grafana.lisglosips.local;
|
||||
|
||||
include /etc/nginx/snippets/lisglosips-tls.conf;
|
||||
add_header Strict-Transport-Security "max-age=300" always;
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
add_header X-Frame-Options "DENY" always;
|
||||
add_header Referrer-Policy "same-origin" always;
|
||||
|
||||
location / {
|
||||
include /etc/nginx/snippets/lisglosips-proxy.conf;
|
||||
proxy_pass http://127.0.0.1:3001;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl;
|
||||
listen [::]:443 ssl;
|
||||
server_name homer.lisglosips.local;
|
||||
|
||||
include /etc/nginx/snippets/lisglosips-tls.conf;
|
||||
add_header Strict-Transport-Security "max-age=300" always;
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
add_header X-Frame-Options "DENY" always;
|
||||
add_header Referrer-Policy "same-origin" always;
|
||||
|
||||
location / {
|
||||
include /etc/nginx/snippets/lisglosips-proxy.conf;
|
||||
proxy_pass http://127.0.0.1:9080;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -0,0 +1,24 @@
|
||||
data_directory = '/data/homer/postgresql'
|
||||
listen_addresses = '127.0.0.1'
|
||||
port = 5432
|
||||
password_encryption = 'scram-sha-256'
|
||||
timezone = 'UTC'
|
||||
log_timezone = 'UTC'
|
||||
|
||||
max_connections = 100
|
||||
shared_buffers = '512MB'
|
||||
effective_cache_size = '2GB'
|
||||
maintenance_work_mem = '128MB'
|
||||
work_mem = '8MB'
|
||||
min_wal_size = '256MB'
|
||||
max_wal_size = '2GB'
|
||||
checkpoint_completion_target = 0.9
|
||||
random_page_cost = 1.1
|
||||
|
||||
logging_collector = on
|
||||
log_directory = '/var/log/postgresql'
|
||||
log_filename = 'postgresql-homer-%Y-%m-%d.log'
|
||||
log_rotation_age = '1d'
|
||||
log_truncate_on_rotation = on
|
||||
log_min_duration_statement = 1000
|
||||
|
||||
@@ -0,0 +1,2 @@
|
||||
ARGS=--web.listen-address=127.0.0.1:9100 --collector.systemd --collector.processes
|
||||
|
||||
@@ -0,0 +1,2 @@
|
||||
ARGS=--config.file=/etc/prometheus/prometheus.yml --storage.tsdb.path=/data/prometheus --storage.tsdb.retention.time=15d --storage.tsdb.retention.size=10GB --web.listen-address=127.0.0.1:9090 --web.enable-lifecycle
|
||||
|
||||
@@ -0,0 +1,40 @@
|
||||
global:
|
||||
scrape_interval: 15s
|
||||
evaluation_interval: 15s
|
||||
external_labels:
|
||||
environment: development
|
||||
platform: lisglosips
|
||||
|
||||
rule_files:
|
||||
- /etc/prometheus/rules/*.yml
|
||||
|
||||
scrape_configs:
|
||||
- job_name: prometheus
|
||||
static_configs:
|
||||
- targets: ["127.0.0.1:9090"]
|
||||
|
||||
- job_name: node
|
||||
static_configs:
|
||||
- targets: ["100.90.90.90:9100"]
|
||||
labels:
|
||||
server: server-a
|
||||
- targets: ["127.0.0.1:9100"]
|
||||
labels:
|
||||
server: server-b
|
||||
|
||||
- job_name: mysql
|
||||
static_configs:
|
||||
- targets: ["127.0.0.1:9104"]
|
||||
|
||||
- job_name: postgresql_homer
|
||||
static_configs:
|
||||
- targets: ["127.0.0.1:9187"]
|
||||
|
||||
- job_name: redis
|
||||
static_configs:
|
||||
- targets: ["127.0.0.1:9121"]
|
||||
|
||||
- job_name: heplify_server
|
||||
static_configs:
|
||||
- targets: ["127.0.0.1:9096"]
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
groups:
|
||||
- name: lisglosips-base
|
||||
rules:
|
||||
- alert: LisgloSIPSTargetDown
|
||||
expr: up == 0
|
||||
for: 2m
|
||||
labels:
|
||||
severity: warning
|
||||
annotations:
|
||||
summary: "Prometheus target {{ $labels.instance }} is down"
|
||||
|
||||
- alert: LisgloSIPSDiskLow
|
||||
expr: 100 * node_filesystem_avail_bytes{fstype!~"tmpfs|overlay"} / node_filesystem_size_bytes{fstype!~"tmpfs|overlay"} < 15
|
||||
for: 10m
|
||||
labels:
|
||||
severity: warning
|
||||
annotations:
|
||||
summary: "Disk free space below 15% on {{ $labels.instance }}"
|
||||
|
||||
Executable
+187
@@ -0,0 +1,187 @@
|
||||
#!/bin/bash
|
||||
set -euo pipefail
|
||||
|
||||
: "${HOMER_DB_PASSWORD:?missing HOMER_DB_PASSWORD}"
|
||||
: "${HOMER_UI_PASSWORD:?missing HOMER_UI_PASSWORD}"
|
||||
: "${HOMER_JWT_SECRET:?missing HOMER_JWT_SECRET}"
|
||||
: "${GRAFANA_ADMIN_PASSWORD:?missing GRAFANA_ADMIN_PASSWORD}"
|
||||
: "${MYSQL_EXPORTER_PASSWORD:?missing MYSQL_EXPORTER_PASSWORD}"
|
||||
: "${REDIS_EXPORTER_PASSWORD:?missing REDIS_EXPORTER_PASSWORD}"
|
||||
: "${POSTGRES_EXPORTER_PASSWORD:?missing POSTGRES_EXPORTER_PASSWORD}"
|
||||
|
||||
STAGE=${STAGE:-/tmp/lisglosips-s06-stage-202606202230}
|
||||
BUILD=/var/tmp/lisglosips-s06-go-20260620/bin
|
||||
HOMER_SOURCE=/var/tmp/lisglosips-s06-go-20260620/pkg/mod/github.com/sipcapture/homer-app@v0.0.0-20251021161517-9b1336352aa0
|
||||
|
||||
test -d "$STAGE/systemd"
|
||||
|
||||
export DEBIAN_FRONTEND=noninteractive
|
||||
systemctl mask prometheus-postgres-exporter.service 2>/dev/null || true
|
||||
apt-get install -y prometheus-postgres-exporter=0.15.0-1ubuntu0.3
|
||||
apt-mark hold prometheus-postgres-exporter >/dev/null
|
||||
|
||||
for account in homer heplify redis-exporter; do
|
||||
if ! getent passwd "$account" >/dev/null; then
|
||||
useradd --system --home-dir /nonexistent --no-create-home --shell /usr/sbin/nologin "$account"
|
||||
fi
|
||||
done
|
||||
|
||||
install -o root -g root -m 0755 "$BUILD/heplify-server" /usr/local/bin/heplify-server
|
||||
install -o root -g root -m 0755 "$BUILD/homer-app" /usr/local/bin/homer-app
|
||||
install -o root -g root -m 0755 "$BUILD/redis_exporter" /usr/local/bin/redis_exporter
|
||||
install -o root -g root -m 0644 "$STAGE/versions.env" /etc/lisglosips/monitoring-versions.env
|
||||
|
||||
systemctl stop postgresql.service
|
||||
chown root:postgres /data/homer
|
||||
chmod 0750 /data/homer
|
||||
install -d -o postgres -g postgres -m 0700 /data/homer/postgresql
|
||||
if [ -z "$(find /data/homer/postgresql -mindepth 1 -maxdepth 1 -print -quit)" ]; then
|
||||
rsync -aHAX /var/lib/postgresql/16/main/ /data/homer/postgresql/
|
||||
fi
|
||||
chown -R postgres:postgres /data/homer/postgresql
|
||||
chmod 0700 /data/homer/postgresql
|
||||
install -d -o root -g postgres -m 0750 /etc/postgresql/16/main/conf.d
|
||||
install -o root -g postgres -m 0640 "$STAGE/postgresql/lisglosips-homer.conf" /etc/postgresql/16/main/conf.d/lisglosips-homer.conf
|
||||
grep -Eq "^[[:space:]]*include_dir[[:space:]]*=[[:space:]]*'conf.d'" /etc/postgresql/16/main/postgresql.conf
|
||||
systemctl start postgresql.service
|
||||
pg_isready -h 127.0.0.1 -p 5432
|
||||
|
||||
runuser -u postgres -- psql -v ON_ERROR_STOP=1 -v homer_pw="$HOMER_DB_PASSWORD" -v exporter_pw="$POSTGRES_EXPORTER_PASSWORD" <<'SQL'
|
||||
SELECT format('CREATE ROLE homer_user LOGIN PASSWORD %L', :'homer_pw')
|
||||
WHERE NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'homer_user') \gexec
|
||||
SELECT format('ALTER ROLE homer_user LOGIN PASSWORD %L', :'homer_pw') \gexec
|
||||
SELECT 'CREATE DATABASE homer_config OWNER homer_user'
|
||||
WHERE NOT EXISTS (SELECT 1 FROM pg_database WHERE datname = 'homer_config') \gexec
|
||||
SELECT 'CREATE DATABASE homer_data OWNER homer_user'
|
||||
WHERE NOT EXISTS (SELECT 1 FROM pg_database WHERE datname = 'homer_data') \gexec
|
||||
SELECT format('CREATE ROLE postgres_exporter LOGIN PASSWORD %L', :'exporter_pw')
|
||||
WHERE NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'postgres_exporter') \gexec
|
||||
SELECT format('ALTER ROLE postgres_exporter LOGIN PASSWORD %L', :'exporter_pw') \gexec
|
||||
GRANT pg_monitor TO postgres_exporter;
|
||||
SQL
|
||||
|
||||
mysql --protocol=socket <<SQL
|
||||
CREATE USER IF NOT EXISTS 'mysqld_exporter'@'127.0.0.1' IDENTIFIED WITH caching_sha2_password BY '$MYSQL_EXPORTER_PASSWORD';
|
||||
ALTER USER 'mysqld_exporter'@'127.0.0.1' IDENTIFIED WITH caching_sha2_password BY '$MYSQL_EXPORTER_PASSWORD';
|
||||
GRANT PROCESS, REPLICATION CLIENT ON *.* TO 'mysqld_exporter'@'127.0.0.1';
|
||||
GRANT SELECT ON performance_schema.* TO 'mysqld_exporter'@'127.0.0.1';
|
||||
FLUSH PRIVILEGES;
|
||||
SQL
|
||||
|
||||
sed -i '/^user redis_exporter /d' /etc/redis/users.acl
|
||||
printf 'user redis_exporter on >%s ~* -@all +ping +info +client +config|get +latency +memory +select +slowlog +scan +type +strlen +llen +scard +zcard +xlen +hscan +sscan +zscan +get\n' "$REDIS_EXPORTER_PASSWORD" >>/etc/redis/users.acl
|
||||
chown root:redis /etc/redis/users.acl
|
||||
chmod 0640 /etc/redis/users.acl
|
||||
systemctl restart redis-server.service
|
||||
|
||||
install -d -o root -g root -m 0755 /etc/lisglosips/secrets
|
||||
sed "s/<HOMER_DB_PASSWORD>/$HOMER_DB_PASSWORD/g" "$STAGE/heplify/heplify.env.example" >/etc/lisglosips/secrets/heplify.env
|
||||
chown root:heplify /etc/lisglosips/secrets/heplify.env
|
||||
chmod 0640 /etc/lisglosips/secrets/heplify.env
|
||||
|
||||
cat >/etc/lisglosips/secrets/grafana.env <<EOF
|
||||
GF_SECURITY_ADMIN_USER=admin
|
||||
GF_SECURITY_ADMIN_PASSWORD=$GRAFANA_ADMIN_PASSWORD
|
||||
GF_USERS_ALLOW_SIGN_UP=false
|
||||
GF_AUTH_ANONYMOUS_ENABLED=false
|
||||
GF_SERVER_HTTP_ADDR=127.0.0.1
|
||||
GF_SERVER_HTTP_PORT=3001
|
||||
GF_SERVER_DOMAIN=grafana.lisglosips.local
|
||||
GF_SERVER_ROOT_URL=https://grafana.lisglosips.local/
|
||||
GF_SECURITY_COOKIE_SECURE=true
|
||||
GF_SECURITY_COOKIE_SAMESITE=strict
|
||||
GF_SECURITY_DISABLE_GRAVATAR=true
|
||||
GF_ANALYTICS_REPORTING_ENABLED=false
|
||||
GF_ANALYTICS_CHECK_FOR_UPDATES=false
|
||||
GF_PLUGINS_PREINSTALL_DISABLED=true
|
||||
GF_PLUGINS_CHECK_FOR_PLUGIN_UPDATES=false
|
||||
GF_PLUGINS_PLUGIN_ADMIN_ENABLED=false
|
||||
HOMER_DB_PASSWORD=$HOMER_DB_PASSWORD
|
||||
EOF
|
||||
chown root:grafana /etc/lisglosips/secrets/grafana.env
|
||||
chmod 0640 /etc/lisglosips/secrets/grafana.env
|
||||
|
||||
cat >/etc/prometheus/mysqld-exporter.cnf <<EOF
|
||||
[client]
|
||||
user=mysqld_exporter
|
||||
password=$MYSQL_EXPORTER_PASSWORD
|
||||
host=127.0.0.1
|
||||
port=3306
|
||||
EOF
|
||||
chown root:prometheus /etc/prometheus/mysqld-exporter.cnf
|
||||
chmod 0640 /etc/prometheus/mysqld-exporter.cnf
|
||||
|
||||
cat >/etc/lisglosips/secrets/postgres-exporter.env <<EOF
|
||||
DATA_SOURCE_NAME=postgresql://postgres_exporter:$POSTGRES_EXPORTER_PASSWORD@127.0.0.1:5432/postgres?sslmode=disable
|
||||
EOF
|
||||
chown root:prometheus /etc/lisglosips/secrets/postgres-exporter.env
|
||||
chmod 0640 /etc/lisglosips/secrets/postgres-exporter.env
|
||||
|
||||
cat >/etc/lisglosips/secrets/redis-exporter.env <<EOF
|
||||
REDIS_ADDR=redis://127.0.0.1:6379
|
||||
REDIS_USER=redis_exporter
|
||||
REDIS_PASSWORD=$REDIS_EXPORTER_PASSWORD
|
||||
REDIS_EXPORTER_WEB_LISTEN_ADDRESS=127.0.0.1:9121
|
||||
EOF
|
||||
chown root:redis-exporter /etc/lisglosips/secrets/redis-exporter.env
|
||||
chmod 0640 /etc/lisglosips/secrets/redis-exporter.env
|
||||
|
||||
install -d -o root -g homer -m 0750 /etc/homer
|
||||
sed -e "s/<HOMER_DB_PASSWORD>/$HOMER_DB_PASSWORD/g" -e "s/<HOMER_JWT_SECRET>/$HOMER_JWT_SECRET/g" "$STAGE/homer/webapp_config.json.example" >/etc/homer/webapp_config.json
|
||||
install -o root -g homer -m 0640 "$HOMER_SOURCE/swagger.json" /etc/homer/swagger.json
|
||||
chown homer:homer /etc/homer/webapp_config.json
|
||||
chmod 0600 /etc/homer/webapp_config.json
|
||||
install -d -o root -g homer -m 0750 /usr/local/homer/dist
|
||||
install -o root -g homer -m 0640 "$STAGE/homer/index.html" /usr/local/homer/dist/index.html
|
||||
install -d -o homer -g homer -m 0750 /var/log/homer
|
||||
|
||||
install -d -o prometheus -g prometheus -m 0750 /data/prometheus
|
||||
install -d -o root -g prometheus -m 0750 /etc/prometheus/rules
|
||||
install -o root -g prometheus -m 0640 "$STAGE/prometheus/prometheus.yml" /etc/prometheus/prometheus.yml
|
||||
install -o root -g prometheus -m 0640 "$STAGE/prometheus/rules/lisglosips.yml" /etc/prometheus/rules/lisglosips.yml
|
||||
install -o root -g prometheus -m 0640 "$STAGE/prometheus/prometheus.env" /etc/default/lisglosips-prometheus
|
||||
install -o root -g prometheus -m 0640 "$STAGE/prometheus/node-exporter-b.env" /etc/default/lisglosips-node-exporter
|
||||
promtool check config /etc/prometheus/prometheus.yml
|
||||
promtool check rules /etc/prometheus/rules/lisglosips.yml
|
||||
|
||||
install -d -o grafana -g grafana -m 0750 /data/grafana /data/grafana/plugins
|
||||
install -o root -g root -m 0644 "$STAGE/grafana/grafana-server.default" /etc/default/grafana-server
|
||||
install -d -o root -g grafana -m 0750 /etc/grafana/provisioning/datasources /etc/grafana/provisioning/dashboards /etc/grafana/provisioning/dashboards/lisglosips
|
||||
install -o root -g grafana -m 0640 "$STAGE/grafana/datasources.yml" /etc/grafana/provisioning/datasources/lisglosips.yml
|
||||
install -o root -g grafana -m 0640 "$STAGE/grafana/dashboards.yml" /etc/grafana/provisioning/dashboards/lisglosips.yml
|
||||
install -o root -g grafana -m 0640 "$STAGE/grafana/lisglosips-overview.json" /etc/grafana/provisioning/dashboards/lisglosips/lisglosips-overview.json
|
||||
|
||||
for unit in heplify-server homer-app lisglosips-prometheus lisglosips-node-exporter lisglosips-mysqld-exporter lisglosips-postgres-exporter lisglosips-redis-exporter; do
|
||||
install -o root -g root -m 0644 "$STAGE/systemd/$unit.service" "/etc/systemd/system/$unit.service"
|
||||
done
|
||||
install -d -o root -g root -m 0755 /etc/systemd/system/grafana-server.service.d
|
||||
install -o root -g root -m 0644 "$STAGE/systemd/grafana-override.conf" /etc/systemd/system/grafana-server.service.d/lisglosips.conf
|
||||
systemctl unmask grafana-server.service
|
||||
|
||||
install -o root -g root -m 0644 "$STAGE/nginx/monitoring.conf" /etc/nginx/sites-available/lisglosips-monitoring.conf
|
||||
ln -sfn /etc/nginx/sites-available/lisglosips-monitoring.conf /etc/nginx/sites-enabled/lisglosips-monitoring.conf
|
||||
install -o root -g root -m 0755 /tmp/lisglosips-issue-dev-cert.s06 /usr/local/sbin/lisglosips-issue-dev-cert
|
||||
rm -f /tmp/lisglosips-issue-dev-cert.s06
|
||||
/usr/local/sbin/lisglosips-issue-dev-cert >/dev/null 2>&1
|
||||
nginx -t
|
||||
|
||||
runuser -u homer -- /usr/local/bin/homer-app -webapp-config-path=/etc/homer -create-table-db-config >/var/log/homer/init-config.log 2>&1
|
||||
runuser -u homer -- /usr/local/bin/homer-app -webapp-config-path=/etc/homer -populate-table-db-config -force-password="$HOMER_UI_PASSWORD" >>/var/log/homer/init-config.log 2>&1
|
||||
chmod 0640 /var/log/homer/init-config.log
|
||||
|
||||
systemctl daemon-reload
|
||||
systemctl disable --now prometheus-node-exporter.service prometheus-node-exporter.socket 2>/dev/null || true
|
||||
systemctl mask prometheus-node-exporter.service 2>/dev/null || true
|
||||
systemctl disable --now openipmi.service 2>/dev/null || true
|
||||
systemctl mask openipmi.service 2>/dev/null || true
|
||||
systemctl enable --now heplify-server.service homer-app.service lisglosips-node-exporter.service lisglosips-mysqld-exporter.service lisglosips-postgres-exporter.service lisglosips-redis-exporter.service lisglosips-prometheus.service grafana-server.service
|
||||
systemctl reload nginx.service
|
||||
|
||||
sleep 5
|
||||
for unit in postgresql heplify-server homer-app lisglosips-node-exporter lisglosips-mysqld-exporter lisglosips-postgres-exporter lisglosips-redis-exporter lisglosips-prometheus grafana-server nginx; do
|
||||
systemctl is-active "$unit" >/dev/null
|
||||
done
|
||||
curl -fsS http://127.0.0.1:9090/-/ready
|
||||
curl -fsS http://127.0.0.1:3001/api/health
|
||||
curl -fsS http://127.0.0.1:9096/metrics >/dev/null
|
||||
printf 'S06_SERVER_B_CONFIG=PASS\n'
|
||||
@@ -0,0 +1,4 @@
|
||||
[Service]
|
||||
EnvironmentFile=/etc/lisglosips/secrets/grafana.env
|
||||
ReadWritePaths=/data/grafana /var/log/grafana
|
||||
|
||||
@@ -0,0 +1,32 @@
|
||||
[Unit]
|
||||
Description=LisgloSIPS Heplify Server
|
||||
After=network-online.target postgresql.service
|
||||
Wants=network-online.target
|
||||
Requires=postgresql.service
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
User=heplify
|
||||
Group=heplify
|
||||
EnvironmentFile=/etc/lisglosips/secrets/heplify.env
|
||||
ExecStart=/usr/local/bin/heplify-server
|
||||
Restart=on-failure
|
||||
RestartSec=3s
|
||||
TimeoutStopSec=30s
|
||||
UMask=0027
|
||||
NoNewPrivileges=true
|
||||
PrivateTmp=true
|
||||
PrivateDevices=true
|
||||
ProtectSystem=strict
|
||||
ProtectHome=true
|
||||
ProtectKernelTunables=true
|
||||
ProtectKernelModules=true
|
||||
ProtectControlGroups=true
|
||||
RestrictSUIDSGID=true
|
||||
LockPersonality=true
|
||||
CapabilityBoundingSet=
|
||||
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
|
||||
@@ -0,0 +1,31 @@
|
||||
[Unit]
|
||||
Description=LisgloSIPS HOMER App
|
||||
After=network-online.target postgresql.service
|
||||
Wants=network-online.target
|
||||
Requires=postgresql.service
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
User=homer
|
||||
Group=homer
|
||||
ExecStart=/usr/local/bin/homer-app -webapp-config-path=/etc/homer
|
||||
Restart=on-failure
|
||||
RestartSec=3s
|
||||
TimeoutStopSec=30s
|
||||
UMask=0027
|
||||
NoNewPrivileges=true
|
||||
PrivateTmp=true
|
||||
PrivateDevices=true
|
||||
ProtectSystem=strict
|
||||
ProtectHome=true
|
||||
ProtectKernelTunables=true
|
||||
ProtectKernelModules=true
|
||||
ProtectControlGroups=true
|
||||
RestrictSUIDSGID=true
|
||||
LockPersonality=true
|
||||
CapabilityBoundingSet=
|
||||
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
|
||||
ReadWritePaths=/etc/homer /var/log/homer
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -0,0 +1,27 @@
|
||||
[Unit]
|
||||
Description=LisgloSIPS MySQL Exporter
|
||||
After=mysql.service
|
||||
Requires=mysql.service
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
User=prometheus
|
||||
Group=prometheus
|
||||
ExecStart=/usr/bin/prometheus-mysqld-exporter --config.my-cnf=/etc/prometheus/mysqld-exporter.cnf --web.listen-address=127.0.0.1:9104
|
||||
Restart=on-failure
|
||||
RestartSec=3s
|
||||
NoNewPrivileges=true
|
||||
PrivateTmp=true
|
||||
PrivateDevices=true
|
||||
ProtectSystem=strict
|
||||
ProtectHome=true
|
||||
ProtectKernelTunables=true
|
||||
ProtectKernelModules=true
|
||||
ProtectControlGroups=true
|
||||
RestrictSUIDSGID=true
|
||||
LockPersonality=true
|
||||
CapabilityBoundingSet=
|
||||
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -0,0 +1,30 @@
|
||||
[Unit]
|
||||
Description=LisgloSIPS Node Exporter
|
||||
After=network-online.target lisglosips-exporter-firewall.service
|
||||
Wants=network-online.target
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
User=prometheus
|
||||
Group=prometheus
|
||||
EnvironmentFile=/etc/default/lisglosips-node-exporter
|
||||
ExecStart=/usr/bin/prometheus-node-exporter $ARGS
|
||||
Restart=on-failure
|
||||
RestartSec=3s
|
||||
NoNewPrivileges=true
|
||||
PrivateTmp=true
|
||||
ProtectSystem=strict
|
||||
ProtectHome=true
|
||||
ProtectKernelTunables=true
|
||||
ProtectKernelModules=true
|
||||
ProtectControlGroups=true
|
||||
RestrictSUIDSGID=true
|
||||
LockPersonality=true
|
||||
CapabilityBoundingSet=
|
||||
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
|
||||
IPAddressDeny=any
|
||||
IPAddressAllow=127.0.0.0/8
|
||||
IPAddressAllow=100.90.90.91/32
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -0,0 +1,29 @@
|
||||
[Unit]
|
||||
Description=LisgloSIPS PostgreSQL Exporter
|
||||
After=postgresql.service
|
||||
Requires=postgresql.service
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
User=prometheus
|
||||
Group=prometheus
|
||||
EnvironmentFile=/etc/lisglosips/secrets/postgres-exporter.env
|
||||
ExecStart=/usr/bin/prometheus-postgres-exporter --web.listen-address=127.0.0.1:9187
|
||||
Restart=on-failure
|
||||
RestartSec=3s
|
||||
NoNewPrivileges=true
|
||||
PrivateTmp=true
|
||||
PrivateDevices=true
|
||||
ProtectSystem=strict
|
||||
ProtectHome=true
|
||||
ProtectKernelTunables=true
|
||||
ProtectKernelModules=true
|
||||
ProtectControlGroups=true
|
||||
RestrictSUIDSGID=true
|
||||
LockPersonality=true
|
||||
CapabilityBoundingSet=
|
||||
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
|
||||
@@ -0,0 +1,33 @@
|
||||
[Unit]
|
||||
Description=LisgloSIPS Prometheus
|
||||
After=network-online.target
|
||||
Wants=network-online.target
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
User=prometheus
|
||||
Group=prometheus
|
||||
EnvironmentFile=/etc/default/lisglosips-prometheus
|
||||
ExecStart=/usr/bin/prometheus $ARGS
|
||||
ExecReload=/bin/kill -HUP $MAINPID
|
||||
Restart=on-failure
|
||||
RestartSec=3s
|
||||
TimeoutStopSec=30s
|
||||
UMask=0027
|
||||
NoNewPrivileges=true
|
||||
PrivateTmp=true
|
||||
PrivateDevices=true
|
||||
ProtectSystem=full
|
||||
ProtectHome=true
|
||||
ProtectKernelTunables=true
|
||||
ProtectKernelModules=true
|
||||
ProtectControlGroups=true
|
||||
RestrictSUIDSGID=true
|
||||
LockPersonality=true
|
||||
CapabilityBoundingSet=
|
||||
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
|
||||
ReadWritePaths=/data/prometheus
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
|
||||
@@ -0,0 +1,28 @@
|
||||
[Unit]
|
||||
Description=LisgloSIPS Redis Exporter
|
||||
After=redis-server.service
|
||||
Requires=redis-server.service
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
User=redis-exporter
|
||||
Group=redis-exporter
|
||||
EnvironmentFile=/etc/lisglosips/secrets/redis-exporter.env
|
||||
ExecStart=/usr/local/bin/redis_exporter
|
||||
Restart=on-failure
|
||||
RestartSec=3s
|
||||
NoNewPrivileges=true
|
||||
PrivateTmp=true
|
||||
PrivateDevices=true
|
||||
ProtectSystem=strict
|
||||
ProtectHome=true
|
||||
ProtectKernelTunables=true
|
||||
ProtectKernelModules=true
|
||||
ProtectControlGroups=true
|
||||
RestrictSUIDSGID=true
|
||||
LockPersonality=true
|
||||
CapabilityBoundingSet=
|
||||
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -0,0 +1,18 @@
|
||||
POSTGRESQL_VERSION=16.14
|
||||
PROMETHEUS_VERSION=2.45.3
|
||||
NODE_EXPORTER_VERSION=1.7.0
|
||||
MYSQLD_EXPORTER_VERSION=0.15.0
|
||||
POSTGRES_EXPORTER_VERSION=0.15.0
|
||||
REDIS_EXPORTER_VERSION=1.86.0
|
||||
GRAFANA_VERSION=13.0.2
|
||||
GO_BOOTSTRAP_VERSION=1.22.2
|
||||
GO_BUILD_TOOLCHAIN_VERSION=1.25.11
|
||||
HEPLIFY_SERVER_SOURCE=github.com/sipcapture/heplify-server@v1.60.2-0.20260512101233-c74dc3d216ac
|
||||
HEPLIFY_SERVER_SHA256=feab75e8a970190ee41952bae74ce453188f6d7ea973017cbec1f5b75cc2b9c5
|
||||
HOMER_APP_SOURCE=github.com/sipcapture/homer-app@v0.0.0-20251021161517-9b1336352aa0
|
||||
HOMER_APP_SHA256=240436d1e666db8ca2173679adda9649037c6d5502182f96b25562b7cd757e94
|
||||
REDIS_EXPORTER_SHA256=5eda3529bf231a3c841d8261895bc09d2f750a3684c8a224edae71f4f80484db
|
||||
DOCKER_VERSION=29.1.3
|
||||
DOCKER_COMPOSE_VERSION=2.40.3
|
||||
DOCKER_RUNTIME_STATUS=installed-disabled
|
||||
|
||||
Reference in New Issue
Block a user