Chatops deployment ansible config

.github/workflows/chatops.yaml

@@ -1,4 +1,4 @@
-name: ChatOps checks
+name: Linting
 
 on:
   push:

chatops_deployment/.gitignore

@@ -2,4 +2,8 @@
 .terraform.lock.hcl
 plan
 terraform.tfstate
-terraform.tfstate.backup
+terraform.tfstate.backup
+ansible/dev_ssl/*
+ansible/prod_ssl/*
+ansible/dev-bastion-key
+ansible/prod-bastion-key

chatops_deployment/README.md

@@ -1,4 +1,29 @@
 # ChatOps Deployment
 
-This project outlines the deployment of the Cloud ChatOps application found [here](https://github.com/stfc/cloud-docker-images/tree/master/cloud-chatops).
-The goal is to create an easily deployable and highly available infrastructure to run the Docker image on. 
+![Linting](https://github.com/stfc/SCD-OpenStack-Utils/actions/workflows/chatops.yaml/badge.svg)
+
+## Contents
+
+- [About](#about)
+
+### About
+
+This project outlines the deployment of the Cloud ChatOps application
+found [here](https://github.com/stfc/cloud-docker-images/tree/master/cloud-chatops). The goal is to create an easily
+deployable and highly available infrastructure to run the Docker container on. We achieve this by using Terraform and
+Ansible to provision and configure the virtual machines the services will run on.
+
+This includes:
+
+- Load balanced application traffic
+- Infrastructure-wide service logging to a central location
+- Service monitoring with visual dashboards and alerting notifications
+- Multi-environment deployment (e.g. dev, staging, prod)
+
+To get started with the deployment, see [INSTALL.md](docs/INSTALL.md).
+
+For information about what services are deployed, see [SERVICES.md](docs/SERVICES.md)
+
+To understand what the Terraform modules do, see [TERRAFORM.md](docs/TERRAFORM.md)
+
+To know what and where variables are stored, see [VARIABLES.md](docks/VARIABLES.md)

chatops_deployment/ansible/configure.yml

@@ -1,50 +1,82 @@
 ---
+- name: Temporary work around for EGI services down 08/05/2025
+  hosts: private, haproxy
+  gather_facts: false
+  tasks:
+    - name: Remove EGI repository from apt
+      become: true
+      ansible.builtin.file:
+        path: /etc/apt/sources.list.d/repository_egi_eu_sw_production_cas_1_current.list
+        state: absent
+
+- name: Set up filebeat
+  hosts: private, haproxy
+  gather_facts: false
+  roles:
+    - role: filebeat
+      tags:
+        - filebeat
+
 - name: Configure load balancer
   hosts: haproxy
+  gather_facts: false
   roles:
     - role: haproxy
       tags:
         - haproxy
 
 - name: Configure ChatOps
   hosts: chatops
+  gather_facts: false
   roles:
     - role: chatops
       tags:
         - chatops
 
 - name: Configure CAdvisor
   hosts: chatops
+  gather_facts: false
   remote_user: ubuntu
   roles:
     - role: cadvisor
       tags:
         - cadvisor
 
 - name: Set up systemd exporters
-  hosts: all
+  hosts: private, haproxy
+  gather_facts: false
   roles:
     - role: systemd_exporter
       tags:
         - systemd_exporter
 
 - name: Configure Grafana
   hosts: grafana
+  gather_facts: false
   roles:
     - grafana
   tags:
     - grafana
 
 - name: Configure Prometheus
   hosts: prometheus
+  gather_facts: true
   roles:
     - prometheus
   tags:
     - prometheus
 
 - name: Configure Alert Manager
   hosts: prometheus
+  gather_facts: false
   roles:
     - alertmanager
   tags:
     - alertmanager
+
+- name: Configure Elastic Stack
+  hosts: elastic
+  gather_facts: true
+  remote_user: ubuntu
+  roles:
+    - elastic

chatops_deployment/ansible/deploy.yml

@@ -13,3 +13,36 @@
   roles:
     - role: ssh_known_hosts
       tags: known_hosts
+
+- name: Copy facts to hosts
+  hosts: prometheus, elastic
+  become: true
+  gather_facts: false
+  tasks:
+    - name: Create facts directory
+      ansible.builtin.file:
+        path: /etc/ansible/facts.d
+        state: directory
+        owner: ubuntu
+        group: ubuntu
+        mode: "0774"
+
+    - name: Copy facts file to host
+      ansible.builtin.copy:
+        src: terraform.fact
+        dest: /etc/ansible/facts.d/terraform.fact
+        owner: ubuntu
+        group: ubuntu
+        mode: "preserve"
+
+    - name: Remove local facts file
+      delegate_to: 127.0.0.1
+      ansible.builtin.file:
+        path: terraform.fact
+        state: absent
+
+- name: Create certificates
+  hosts: localhost
+  roles:
+    - role: ssl_certificates
+      tags: ssl_certificates

chatops_deployment/ansible/group_vars/all/vars.yml → chatops_deployment/ansible/dev/group_vars/all/vars.yml

@@ -1,4 +1,8 @@
+---
 ansible_user: ubuntu
 domain: "dev-cloud-chatops.nubes.rl.ac.uk"
 chatops_custom_api_token: "{{ vault_chatops_custom_api_token }}"
 systemd_exporter_version: "0.7.0"
+filebeat_version: "9.0.0"
+terraform_floating_ip: 130.246.83.230
+env: "dev"

chatops_deployment/ansible/dev/group_vars/all/vault.yml

@@ -0,0 +1,10 @@
+$ANSIBLE_VAULT;1.1;AES256
+33626537336632336631623865356565626662613237396138383931636630653334656462666630
+3331326436343833376366326662356333306338323230340a316136656562383337663338336437
+31643039303732626462656239663331363334353837613035393834326164343163626665663235
+6165313732313165610a326139313863366562363865383233383238653633366533386261323661
+35376465326263383332343666393137623532326433616366396330346561633963316636346638
+30346232643662663935353261366536316630626665323333346564356136366333343333353462
+62663665373862323734393833613134383464383639653566336138666638353730666634393166
+62353136633136303731613537633064306166333466386439643061663864363737623565323938
+35646539633734656561633630323936376332393031313464393761643738343062

chatops_deployment/ansible/group_vars/chatops/vars.yml → chatops_deployment/ansible/dev/group_vars/chatops/vars.yml

@@ -1,4 +1,5 @@
-chatops_version: 7.0.0
+---
+chatops_image: "harbor.stfc.ac.uk/stfc-cloud/cloud-chatops:8.0.1"
 chatops_github_repos:
   stfc:
     - cloud-deployed-apps

chatops_deployment/ansible/dev/group_vars/chatops/vault.yml

@@ -0,0 +1,29 @@
+$ANSIBLE_VAULT;1.1;AES256
+65313637353736366565313932376465613735393865313534333534363234363338343731626138
+3837386466656662303735393035363439376339313239300a623331343830323931353937323337
+62626661393563396434353030663439383630323936643166656632613363396634633732346339
+6131313837383234640a666336373438346464663461653831633134363361383861393431363231
+35613866613465383535316538393537616537666539383331333866386262303737623038386161
+33663633353863326533633966313934393566346665323138633334323532383266666163633065
+38643238346133643730323930646161383535386462396232653534376535323661386538666631
+35613534613965636632313836656233333234613665333838663461306165363863336266386663
+30316138306666646137326133656364653062636133643037646136306637336334626630643031
+61646631373762646466383333303332353231656334363734666565623731343361333864396264
+63343062366564636462663434633963666362356531383537303365386561376635346532383432
+34363963356136316562393235383536626433303563666336373232653233336136643765616366
+38623336303631653862663737663262316261666666643365396639303031623563663733643137
+32383338643334653665353362383764383439393434366634333939393739623461366137663135
+34363632303733393966373438393331373231633366306639623537393032363230376339623637
+32356637653732636665356533366561636665313066653565653134376539366664333737336535
+61343265306230346538616665336336636563343261396366653061386530346439343835386163
+66303233633361353936316664323132346330376364393939323737666534373135666137346435
+39343131313239343636373262313730383166323631623564343635386534653430306434303035
+31376163376335663632333439313338363831376435363465386466343330613537353535333430
+35363961626663393036383834306661656435633330343833636131303033396635633163633363
+65613162343662356134326235356233626235343436303334356362646436303533316237343265
+34383431616161343166316262656433613961343338363235333932353135343162343037383830
+64303531353438323664383162386230383236383630633432373930636439663133323939303635
+61376461346637343664646338373734363031343731623639396535653863626265623730323364
+31303037663032656239646633336239633930656338636263653564636635353931306364336665
+66653236626362353339653237303066613839316664363565393432323662613964633431643666
+64326631356237646136

chatops_deployment/ansible/dev/group_vars/grafana/vars.yml

@@ -0,0 +1,4 @@
+---
+grafana_client_id: "{{ vault_grafana_client_id }}"
+grafana_client_secret: "{{ vault_grafana_client_secret }}"
+grafana_admin_password: "{{ vault_grafana_admin_password }}"

chatops_deployment/ansible/dev/group_vars/grafana/vault.yml

@@ -0,0 +1,17 @@
+$ANSIBLE_VAULT;1.1;AES256
+61356166373937626361393637343264316131316466633839373362663636663034316630376563
+3537653333366537303030363831326232623133666463310a353635613438396234303735623465
+64323733636532373631636665613362636437663131616662383332343638353666396131353138
+3532613866383431660a343266323166643431303632396330303866383538663936663837366233
+31396131333639336662396463376363303536666562333331666165336465616665383232613139
+61336335303162353533656530356539646632643365373035396335613635643837386163323661
+61343065646563366531656333356662623065376331366431333963366534316330393837613236
+66333939653232376633653632393130313730666335343933336131393834346262643539663830
+31313833363166393636383936633864323631363465343264666431336131313738666537373231
+31623866626266316538666564636633636431353537653034393530376166313133373233313863
+66373163323564626238336661356533343239346661343831633832656462373763376330663130
+39623635313133326661356330653534333332616639633732393263613965306363376236303037
+39323765346233366130396464323061613638663936393363663162383435343631636363393332
+61333431353661373934356230323931666336323963366563616435393032303735366237613234
+35366638353138356632626434623638663436643961343830343633656166343462303330623732
+36326663363864333161

chatops_deployment/ansible/dev/group_vars/monitoring/vars.yml

@@ -0,0 +1,15 @@
+---
+prometheus_username: "{{ vault_prometheus_username }}"
+prometheus_password: "{{ vault_prometheus_password }}"
+alertmanager_username: "{{ vault_alertmanager_username }}"
+alertmanager_password: "{{ vault_alertmanager_password }}"
+alertmanager_version: "0.28.1"
+prometheus_version: "3.2.1"
+elastic_password: "{{ vault_elastic_password }}"
+kibana_system_password: "{{ vault_kibana_system_password }}"
+logstash_system_password: "{{ vault_logstash_system_password }}"
+elasticsearch_version: "9.0.0"
+kibana_version: "9.0.0"
+logstash_version: "9.0.0"
+elastic_iris_client_id: "{{ vault_elastic_iris_client_id }}"
+elastic_iris_client_secret: "{{ vault_elastic_iris_client_secret }}"

chatops_deployment/ansible/dev/group_vars/monitoring/vault.yml

@@ -0,0 +1,26 @@
+$ANSIBLE_VAULT;1.1;AES256
+65393439616562313033353438303334326165666238656138333334633433643138333638663932
+3539316637346661663938633961333132393632346538350a356338323635376262623930366238
+36633439316633323437646136316162316362653730613331396130633436313764653762323238
+3934653037343436380a366461346537616230313962306333386461326165633463336533336436
+65646538396366326532323737633337353238366333316238396531373935366236386333303265
+39323836643631616236333232303436666264633362343065383231333561386463666333326465
+39323939376431373334366463313339346430616638333264333936646161396631623632383635
+34666234386536393435333135653861376338323562653565633862643763346666666361633762
+31653335653139353033623533666231343862373935623232336532303134636137326430396364
+35306238653039643632353734373033636331313138383934366364626436623331393237396338
+32303062333264353930623532343631393364353361626430306338643464646566333064316537
+32396631363866386537386565653562356138386536363563383432303361363865633033376462
+66336635343266636266393432313666323362656362633366316134356434343639656139366636
+39663331323738643934646639643366623864633933633462396139623666323231626439346231
+62653838333734366138386364653661363033653364343630393166666532626234663332616464
+33336164333631383037373438613530616535356539653235393430623033616636353535613137
+31636234396365663163383664663662393138393639326230316462386464626137343136663831
+66313063353666373235633736313361613365666337323361303463373037353863316139336536
+36373164346466306431643439393265343861653238323332373366303933343432366330613637
+62343437303866383339396336306331396437623465386131636132343733313232623334326630
+65333235616231343234656539623635613433616131346363653539343864316430306332316262
+31303030613864386234656536356662626661653737363736643961316534383938363463363533
+61316539353937643736313265363732666464616161633032633038366139653434333233656234
+31636632366236343237616239343361343064646132396331343832363539613564343536363332
+6539

chatops_deployment/ansible/dev/host_vars/localhost/vars.yml

@@ -0,0 +1,6 @@
+---
+terraform_deployment: chatops-development
+terraform_external_network_id: 5283f642-8bd8-48b6-8608-fa3006ff4539
+terraform_prometheus_volume_id: 2d47f4ed-2af4-4c21-b825-fa6e383c6aff
+terraform_elasticsearch_volume_id: 3a4c7ddd-13ec-4beb-80a9-589c86a36f08
+bastion_key_passphrase: "{{ vault_bastion_key_passphrase }}"

chatops_deployment/ansible/dev/hosts.yml

@@ -0,0 +1,15 @@
+private:
+  children:
+    prometheus:
+    grafana:
+    chatops:
+    elastic:
+  vars:
+    ansible_ssh_common_args: "-J ubuntu@{{ terraform_floating_ip }}"
+    ansible_ssh_private_key_file: "./dev-bastion-key"
+
+monitoring:
+  children:
+    prometheus:
+    grafana:
+    elastic:

chatops_deployment/ansible/dev/openstack.yml

@@ -0,0 +1,19 @@
+plugin: openstack.cloud.openstack
+
+all_projects: false
+expand_hostvars: true
+fail_on_errors: true
+only_clouds:
+  - "openstack"
+strict: true
+clouds_yaml_path: "~/.config/openstack/clouds.yaml"
+replace_invalid_groups: true
+only_ipv4: true
+legacy_groups: false
+inventory_hostname: "name"
+groups:
+  chatops: "(openstack.metadata.service | default('') == 'chatops') and (openstack.metadata.env | default('') == 'dev')"
+  grafana: "(openstack.metadata.service | default('') == 'grafana') and (openstack.metadata.env | default('') == 'dev')"
+  prometheus: "(openstack.metadata.service | default('') == 'prometheus') and (openstack.metadata.env | default('') == 'dev')"
+  elastic: "(openstack.metadata.service | default('') == 'elastic') and (openstack.metadata.env | default('') == 'dev')"
+  haproxy: "(openstack.metadata.service | default('') == 'haproxy') and (openstack.metadata.env | default('') == 'dev')"