change ffshmon to run as service and now exports metrics to prometheus

roles/ffshmon/handlers/main.yml

@@ -0,0 +1,5 @@
+- name: Restart ffshmon service
+  ansible.builtin.systemd:
+    daemon_reload: true
+    name: ffshmon
+    state: restarted

roles/ffshmon/tasks/install.yml

@@ -1,19 +1,89 @@
-- name: Install curl
+- name: Install ffshmon dependencies
   ansible.builtin.apt:
-    name: ['curl']
+    name: ["curl", "python3-venv", "python3-pip", "sudo", "logrotate"]
+- name: Add ffshmon system user
+  ansible.builtin.user:
+    name: ffshmon
+    system: true
+    create_home: false
+    shell: /usr/sbin/nologin
 - name: Create log directory
   ansible.builtin.file:
     path: /var/log/ffshmon
     state: directory
-    mode: '0755'
+    owner: ffshmon
+    group: ffshmon
+    mode: "0755"
+- name: Create ffshmon log file
+  ansible.builtin.file:
+    path: /var/log/ffshmon/ffshmon.log
+    state: touch
+    owner: ffshmon
+    group: ffshmon
+    mode: "0640"
+    access_time: preserve
+    modification_time: preserve
+  notify:
+    - Restart ffshmon service
+- name: Allow root to manage ffshmon repository
+  ansible.builtin.blockinfile:
+    path: /etc/gitconfig
+    create: true
+    owner: root
+    group: root
+    mode: "0644"
+    block: |
+      [safe]
+          directory = /opt/ffshmon
+    marker: "# {mark} ANSIBLE MANAGED FFSHMON SAFE DIRECTORY"
 - name: Clone ffshmon repository
   ansible.builtin.git:
     repo: https://github.com/ffsh/ffshmon.git
     dest: /opt/ffshmon
     force: true
     version: main
-- name: Trigger ffshmon regularly
-  ansible.builtin.cron:
-    name: "Execute ffshmon"
-    minute: "*/30"
-    job: "python3 /opt/ffshmon/wireguard.py check --user {{ ffshmon_mail }} --password {{ ffshmon_pw }} --log /var/log/ffshmon/ffshmon.log"
+- name: Install ffshmon Python dependencies
+  ansible.builtin.pip:
+    requirements: /opt/ffshmon/requirements.txt
+    virtualenv: /opt/ffshmon/.venv
+    virtualenv_command: python3 -m venv
+- name: Adjust ffshmon permissions
+  ansible.builtin.file:
+    path: /opt/ffshmon
+    owner: ffshmon
+    group: ffshmon
+    recurse: true
+    state: directory
+- name: Configure ffshmon sudo permissions
+  ansible.builtin.template:
+    src: templates/ffshmon.sudoers
+    dest: /etc/sudoers.d/ffshmon
+    owner: root
+    group: root
+    mode: "0440"
+    validate: "visudo -cf %s"
+- name: Configure ffshmon log rotation
+  ansible.builtin.template:
+    src: templates/ffshmon.logrotate
+    dest: /etc/logrotate.d/ffshmon
+    owner: root
+    group: root
+    mode: "0644"
+- name: Install ffshmon service
+  ansible.builtin.template:
+    src: templates/ffshmon.service
+    dest: /etc/systemd/system/ffshmon.service
+    owner: root
+    group: root
+    mode: "0600"
+  notify:
+    - Restart ffshmon service
+
+- name: Flush handlers
+  ansible.builtin.meta: flush_handlers
+
+- name: Enable ffshmon service
+  ansible.builtin.systemd:
+    enabled: true
+    state: started
+    name: ffshmon

roles/ffshmon/templates/ffshmon.logrotate

@@ -0,0 +1,10 @@
+/var/log/ffshmon/ffshmon.log {
+    daily
+    rotate 7
+    compress
+    delaycompress
+    missingok
+    notifempty
+    copytruncate
+    create 0640 ffshmon ffshmon
+}

roles/ffshmon/templates/ffshmon.service

@@ -0,0 +1,20 @@
+[Unit]
+Description=ffshmon WireGuard health monitor
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+WorkingDirectory=/opt/ffshmon
+User=ffshmon
+Group=ffshmon
+ExecStart=/opt/ffshmon/.venv/bin/python /opt/ffshmon/wireguard.py serve --user {{ ffshmon_mail }} --password {{ ffshmon_pw }} --log /var/log/ffshmon/ffshmon.log --loglevel WARNING --host 127.0.0.1 --port 8000 --interval 300
+Restart=on-failure
+ProtectHome=true
+PrivateTmp=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectClock=true
+
+[Install]
+WantedBy=multi-user.target

roles/ffshmon/templates/ffshmon.sudoers

@@ -0,0 +1,5 @@
+ffshmon ALL=(root) NOPASSWD: /usr/bin/systemctl stop fastd@ffsh.service
+ffshmon ALL=(root) NOPASSWD: /usr/bin/systemctl show -p SubState fastd@ffsh.service
+ffshmon ALL=(root) NOPASSWD: /usr/bin/systemctl stop wg-quick@exit.service
+ffshmon ALL=(root) NOPASSWD: /usr/bin/systemctl restart wg-quick@exit.service
+ffshmon ALL=(root) NOPASSWD: /usr/bin/python3 /opt/wg-conf-gen/wg-conf-gen.py recreate

roles/nginx/templates/gw-status.conf

@@ -25,6 +25,12 @@ server {
         proxy_pass http://127.0.0.1:9100/;
     }
 
+{% if enable_wireguard_exit | default(false) | bool %}
+    location /ffshmon/ {
+        proxy_pass http://127.0.0.1:8000/;
+    }
+{% endif %}
+
     ## TLS
     ssl_certificate /etc/letsencrypt/live/{{ inventory_hostname }}.freifunk-suedholstein.de/fullchain.pem;
     ssl_certificate_key /etc/letsencrypt/live/{{ inventory_hostname }}.freifunk-suedholstein.de/privkey.pem;
@@ -39,6 +45,6 @@ server {
     # HSTS (ngx_http_headers_module is required) (63072000 seconds)
     add_header Strict-Transport-Security "max-age=63072000" always;
 
-   
+
 }
 

roles/prometheus/templates/prometheus.yml.j2

@@ -39,6 +39,14 @@ scrape_configs:
     static_configs:
       - targets: ["beste.freifunk-suedholstein.de", "brunsbach.freifunk-suedholstein.de", "trave.freifunk-suedholstein.de"]
 
+  - job_name: "ffshmon"
+
+    metrics_path: /ffshmon/metrics
+    scheme: https
+
+    static_configs:
+      - targets: ["beste.freifunk-suedholstein.de", "brunsbach.freifunk-suedholstein.de", "trave.freifunk-suedholstein.de"]
+
   - job_name: "services"
 
     metrics_path: stats/metrics