Initial LisgloSIPS V2 implementation

infra/server-b/s06/systemd/grafana-override.conf

@@ -0,0 +1,4 @@
+[Service]
+EnvironmentFile=/etc/lisglosips/secrets/grafana.env
+ReadWritePaths=/data/grafana /var/log/grafana
+

infra/server-b/s06/systemd/heplify-server.service

@@ -0,0 +1,32 @@
+[Unit]
+Description=LisgloSIPS Heplify Server
+After=network-online.target postgresql.service
+Wants=network-online.target
+Requires=postgresql.service
+
+[Service]
+Type=simple
+User=heplify
+Group=heplify
+EnvironmentFile=/etc/lisglosips/secrets/heplify.env
+ExecStart=/usr/local/bin/heplify-server
+Restart=on-failure
+RestartSec=3s
+TimeoutStopSec=30s
+UMask=0027
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+LockPersonality=true
+CapabilityBoundingSet=
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+
+[Install]
+WantedBy=multi-user.target
+

infra/server-b/s06/systemd/homer-app.service

@@ -0,0 +1,31 @@
+[Unit]
+Description=LisgloSIPS HOMER App
+After=network-online.target postgresql.service
+Wants=network-online.target
+Requires=postgresql.service
+
+[Service]
+Type=simple
+User=homer
+Group=homer
+ExecStart=/usr/local/bin/homer-app -webapp-config-path=/etc/homer
+Restart=on-failure
+RestartSec=3s
+TimeoutStopSec=30s
+UMask=0027
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+LockPersonality=true
+CapabilityBoundingSet=
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+ReadWritePaths=/etc/homer /var/log/homer
+
+[Install]
+WantedBy=multi-user.target

infra/server-b/s06/systemd/lisglosips-mysqld-exporter.service

@@ -0,0 +1,27 @@
+[Unit]
+Description=LisgloSIPS MySQL Exporter
+After=mysql.service
+Requires=mysql.service
+
+[Service]
+Type=simple
+User=prometheus
+Group=prometheus
+ExecStart=/usr/bin/prometheus-mysqld-exporter --config.my-cnf=/etc/prometheus/mysqld-exporter.cnf --web.listen-address=127.0.0.1:9104
+Restart=on-failure
+RestartSec=3s
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+LockPersonality=true
+CapabilityBoundingSet=
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+
+[Install]
+WantedBy=multi-user.target

infra/server-b/s06/systemd/lisglosips-node-exporter.service

@@ -0,0 +1,30 @@
+[Unit]
+Description=LisgloSIPS Node Exporter
+After=network-online.target lisglosips-exporter-firewall.service
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=prometheus
+Group=prometheus
+EnvironmentFile=/etc/default/lisglosips-node-exporter
+ExecStart=/usr/bin/prometheus-node-exporter $ARGS
+Restart=on-failure
+RestartSec=3s
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+LockPersonality=true
+CapabilityBoundingSet=
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+IPAddressDeny=any
+IPAddressAllow=127.0.0.0/8
+IPAddressAllow=100.90.90.91/32
+
+[Install]
+WantedBy=multi-user.target

infra/server-b/s06/systemd/lisglosips-postgres-exporter.service

@@ -0,0 +1,29 @@
+[Unit]
+Description=LisgloSIPS PostgreSQL Exporter
+After=postgresql.service
+Requires=postgresql.service
+
+[Service]
+Type=simple
+User=prometheus
+Group=prometheus
+EnvironmentFile=/etc/lisglosips/secrets/postgres-exporter.env
+ExecStart=/usr/bin/prometheus-postgres-exporter --web.listen-address=127.0.0.1:9187
+Restart=on-failure
+RestartSec=3s
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+LockPersonality=true
+CapabilityBoundingSet=
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+
+[Install]
+WantedBy=multi-user.target
+

infra/server-b/s06/systemd/lisglosips-prometheus.service

@@ -0,0 +1,33 @@
+[Unit]
+Description=LisgloSIPS Prometheus
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=prometheus
+Group=prometheus
+EnvironmentFile=/etc/default/lisglosips-prometheus
+ExecStart=/usr/bin/prometheus $ARGS
+ExecReload=/bin/kill -HUP $MAINPID
+Restart=on-failure
+RestartSec=3s
+TimeoutStopSec=30s
+UMask=0027
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectSystem=full
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+LockPersonality=true
+CapabilityBoundingSet=
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+ReadWritePaths=/data/prometheus
+
+[Install]
+WantedBy=multi-user.target
+

infra/server-b/s06/systemd/lisglosips-redis-exporter.service

@@ -0,0 +1,28 @@
+[Unit]
+Description=LisgloSIPS Redis Exporter
+After=redis-server.service
+Requires=redis-server.service
+
+[Service]
+Type=simple
+User=redis-exporter
+Group=redis-exporter
+EnvironmentFile=/etc/lisglosips/secrets/redis-exporter.env
+ExecStart=/usr/local/bin/redis_exporter
+Restart=on-failure
+RestartSec=3s
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+LockPersonality=true
+CapabilityBoundingSet=
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+
+[Install]
+WantedBy=multi-user.target