ansible-role-blackbox-exporter

systemd blackbox exporter ansible role

Compatibility

python: 3.11, 3.12, 3.13 ansible: 11, 12, 13

Features

• It won't install the same version of blackbox exporter if it's already installed
• Able to make ICMP ping by default
• Optional tags blackbox-exporter-install, blackbox-exporter-configure for managing role
• Checking rendered config
• Make reload if blackbox-exporter is already running

Install

ansible-galaxy role install foi.blackbox_exporter

or add it in requirements.yml

roles:
  - name: foi.blackbox_exporter

and run ansible-galaxy install -r requirements.yml

Role Variables

role defaults:

---
blackbox_exporter_version: "0.28.0"
blackbox_exporter_arch: amd64
blackbox_exporter_service_description: Blackbox Exporter Service
blackbox_exporter_systemd_services_path: /etc/systemd/system
blackbox_exporter_conf_path: /etc/blackbox-exporter
blackbox_exporter_bin_path: /usr/local/bin
blackbox_exporter_tmp_path: /tmp
blackbox_exporter_service_name: blackbox-exporter
blackbox_exporter_user: blackbox-exporter
blackbox_exporter_append_to_groups: []
blackbox_exporter_port: 9115
blackbox_exporter_addr: ""
blackbox_exporter_commands:
  - '--web.listen-address={{ blackbox_exporter_addr }}:{{ blackbox_exporter_port }}'
  - '--log.format=json'
  - '--config.file="{{ blackbox_exporter_conf_path }}/config.yml"'
blackbox_exporter_default_unit_options:
  Wants: network-online.target
  After: network-online.target
  StartLimitBurst: 30
  StartLimitIntervalSec: 900
blackbox_exporter_default_service_options:
  Restart: always
  TimeoutStopSec: 5s
  LimitNOFILE: 1048576
  RestartSec: 10
  AmbientCapabilities: CAP_NET_RAW
  CapabilityBoundingSet: CAP_NET_RAW
blackbox_exporter_config_yml: |
  modules:
    http_2xx:
      prober: http
      http:
        preferred_ip_protocol: "ip4"
    http_post_2xx:
      prober: http
      http:
        method: POST
    tcp_connect:
      prober: tcp
    pop3s_banner:
      prober: tcp
      tcp:
        query_response:
        - expect: "^+OK"
        tls: true
        tls_config:
          insecure_skip_verify: false
    grpc:
      prober: grpc
      grpc:
        tls: true
        preferred_ip_protocol: "ip4"
    grpc_plain:
      prober: grpc
      grpc:
        tls: false
        service: "service1"
    ssh_banner:
      prober: tcp
      tcp:
        query_response:
        - expect: "^SSH-2.0-"
        - send: "SSH-2.0-blackbox-ssh-check"
    ssh_banner_extract:
      prober: tcp
      timeout: 5s
      tcp:
        query_response:
        - expect: "^SSH-2.0-([^ -]+)(?: (.*))?$"
          labels:
          - name: ssh_version
            value: "${1}"
          - name: ssh_comments
            value: "${2}"
    irc_banner:
      prober: tcp
      tcp:
        query_response:
        - send: "NICK prober"
        - send: "USER prober prober prober :prober"
        - expect: "PING :([^ ]+)"
          send: "PONG ${1}"
        - expect: "^:[^ ]+ 001"
    icmp:
      prober: icmp
      icmp:
        dont_fragment: true
    icmp_ttl5:
      prober: icmp
      timeout: 5s
      icmp:
        ttl: 5
    http_3xx:
      prober: http
      http:
        preferred_ip_protocol: "ip4"
        enable_http3: true
        enable_http2: false
        valid_http_versions: ["HTTP/3.0"]
    postgresql:
      prober: tcp
      tcp:
        query_response:
        - send: !!binary AAAACATSFi8= # 0x00, 0x00, 0x00, 0x08, 0x04, 0xD2, 0x16, 0x2F - PostgreSQL SSLRequest
        - expect_bytes: S # 0x53 - Reply will be 'S' if SSL is enabled, and 'N' if it is not.
        - starttls: true

Example Playbook

# inventory
[blackbox_exporter]
yourhost

# playbook.yml
- hosts: blackbox_exporter
  roles:
    - role: foi.blackbox_exporter