1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
# TODO Consolidate this into a basic playbook
- name: Basic requirements
  hosts: hopeless-masquerade
  become: true
  tasks:

    # The BirdNET-Pi installer adds this repository.
    - name: Caddy repository
      tags: always
      vars:
        # TODO Flip once Caddy's Cloudsmith quota is restored; its 402s fail
        # every apt cache update. https://github.com/caddyserver/dist/issues/142
        cloudsmith_available: false
      block:

        - name: Remove Caddy repository
          when: not cloudsmith_available
          ansible.builtin.file:
            path: /etc/apt/sources.list.d/caddy-stable.list
            state: absent

        - name: Restore Caddy repository
          when: cloudsmith_available
          ansible.builtin.copy:
            content: |
              # Source: Caddy
              # Site: https://github.com/caddyserver/caddy
              # Repository: Caddy / stable
              # Description: Fast, multi-platform web server with automatic HTTPS


              deb [signed-by=/usr/share/keyrings/caddy-stable-archive-keyring.gpg] https://dl.cloudsmith.io/public/caddy/stable/deb/debian any-version main

              deb-src [signed-by=/usr/share/keyrings/caddy-stable-archive-keyring.gpg] https://dl.cloudsmith.io/public/caddy/stable/deb/debian any-version main
            dest: /etc/apt/sources.list.d/caddy-stable.list
            mode: '0644'

    - name: Install basic packages
      ansible.builtin.apt:
        pkg:
          - git
          - net-tools # ifconfig
          - neovim
          - prometheus-node-exporter
        state: present
        update_cache: true

    # SSH forwards the client's LC_* variables, which fail without this locale.
    - name: Generate en_US.UTF-8 locale
      community.general.locale_gen:
        name: en_US.UTF-8
        state: present

# TODO disallow network access from non-tailscale interfaces
- import_playbook: ../playbooks/secure.yml # noqa: name[play]
- import_playbook: ../playbooks/tailscale.yml # noqa: name[play]

# https://setup.vector.dev
# https://grafana.com/blog/2024/07/12/obirdability-how-to-build-an-observability-system-for-bird-songs/
- name: Vector
  tags: vector
  hosts: hopeless-masquerade
  become: true
  tasks:

    - name: Install required dependencies
      ansible.builtin.apt:
        pkg:
          - apt-transport-https
          - curl
          - gnupg
          - python3-debian # for ansible.builtin.deb822_repository
        state: present
        update_cache: true

    - name: Create keyrings directory
      ansible.builtin.file:
        path: /usr/share/keyrings
        state: directory
        mode: '0755'

    - name: Download Vector GPG key
      ansible.builtin.get_url:
        url: https://keys.datadoghq.com/DATADOG_APT_KEY_CURRENT.public
        dest: /tmp/vector_key.public
        mode: '0644'

    - name: Import Vector GPG key
      ansible.builtin.command: gpg --dearmor --output /usr/share/keyrings/datadog-archive-keyring.gpg /tmp/vector_key.public
      args:
        creates: /usr/share/keyrings/datadog-archive-keyring.gpg

    # Left behind by ansible.builtin.apt_repository; apt reads both formats, so
    # leaving it would configure the repository twice.
    - name: Remove one-line Vector repository
      ansible.builtin.file:
        path: /etc/apt/sources.list.d/vector.list
        state: absent

    - name: Add Vector repository
      ansible.builtin.deb822_repository:
        name: vector
        types: deb
        uris: https://apt.vector.dev/
        suites: stable
        components: vector-0
        signed_by: /usr/share/keyrings/datadog-archive-keyring.gpg
        state: present

    - name: Install Vector
      ansible.builtin.apt:
        name: vector
        state: present
        update_cache: true

    - name: Configure Vector
      ansible.builtin.copy:
        src: templates/vector.yml
        dest: /etc/vector/vector.yaml
        mode: '0644'
        backup: true
      notify: Restart Vector

    - name: Enable and start Vector service
      ansible.builtin.systemd:
        name: vector
        enabled: true
        state: started
        daemon_reload: true

    - name: Clean up temporary key file
      ansible.builtin.file:
        path: /tmp/vector_key.public
        state: absent

  handlers:
    - name: Restart Vector
      ansible.builtin.systemd:
        name: vector
        state: restarted

# - name: birbnet
#   tags: birbnet
#   hosts: hopeless-masquerade
#   tasks:
#
#     - name: Install pipx
#       become: true
#       ansible.builtin.apt:
#         pkg:
#           - pipx
#         state: present
#         update_cache: true
#
#     - name: Install uv
#       ansible.builtin.command: pipx install uv
#       args:
#         creates: /home/alpha/.local/bin/uv

# vim: ft=yaml.ansible