Fix bad default variable names in configurable download host

galaxy.yml

@@ -1,7 +1,7 @@
 ---
 namespace: prometheus
 name: prometheus
-version: 0.30.1
+version: 0.30.1+stackhpc.1
 readme: README.md
 authors:
   - "Ben Kochie (https://github.com/SuperQ)"

roles/_common/tasks/install.yml

@@ -8,6 +8,14 @@
   tags:
     - always
 
+- name: "Validate Download host is localhost or remote host"
+  ansible.builtin.assert:
+    that:
+      - "_common_download_host in ('localhost', inventory_hostname)"
+    fail_msg: "Error: _common_download_host != localhost only works in single host plays (no way to copy from an arbitrary host to another)."
+  tags:
+    - always
+
 - name: "Gather system user and group facts"
   ansible.builtin.getent:
     database: "{{ item }}"
@@ -54,7 +62,7 @@
     - download
     - "{{ ansible_parent_role_names | first | regex_replace(ansible_collection_name ~ '.', '') }}_download"
   become: false
-  delegate_to: localhost
+  delegate_to: "{{ _common_download_host }}"
   block:
     - name: "Create localhost binary cache path"
       ansible.builtin.file:
@@ -81,7 +89,7 @@
     - name: "Verify checksum of {{ __common_binary_basename }}"
       run_once: true
       check_mode: false
-      when: (_common_checksums_url | length > 0)
+      when: (_common_checksum | length > 0) or (_common_checksums_url | length > 0)
       block:
         - name: "Fetch checksum list for {{ __common_binary_basename }}"
           ansible.builtin.uri:
@@ -91,12 +99,14 @@
             return_content: true
             status_code: [200, 203, 204, 206, 300, 301, 302, 303, 304, 307, 308]
             follow_redirects: all
+          when: (_common_checksum | length == 0)
           register: __common_binary_checksums_raw
 
         - name: "Parse checksum list for {{ __common_binary_basename }}"
           ansible.builtin.set_fact:
             __common_binary_checksums: "{{ dict(__common_binary_checksums_raw.content.splitlines()
                                         | map('regex_findall', '^([a-fA-F0-9]+)\\s+(.+)$') | map('flatten') | map('reverse')) }}"
+          when: (_common_checksum | length == 0)
 
         - name: "Calculate checksum of {{ __common_binary_basename }}"
           ansible.builtin.stat:
@@ -105,6 +115,11 @@
             get_checksum: true
           register: __common_binary_checksum
 
+        - name: "Use provided checksum"
+          ansible.builtin.set_fact:
+            __common_binary_checksums: "{{ { __common_binary_basename: _common_checksum } }}"
+          when: (_common_checksum | length > 0)
+
         - name: "Verify correct checksum of {{ __common_binary_basename }}"
           ansible.builtin.assert:
             that: __common_binary_checksum.stat.checksum == __common_binary_checksums[__common_binary_basename]
@@ -118,6 +133,7 @@
         mode: 0755
         list_files: true
         extra_opts: "{{ _common_binary_unarchive_opts | default(omit, true) }}"
+        remote_src: "{{ inventory_hostname == _common_download_host }}"
       check_mode: false
       throttle: 1  # see prometheus-community/ansible#457
       when: __common_binary_basename is search('\.zip$|\.tar\.gz$')
@@ -151,10 +167,12 @@
     mode: 0755
     owner: root
     group: root
+    remote_src: "{{ inventory_hostname == _common_download_host }}"
   loop: "{{ _common_binaries }}"
   become: true
-  notify:
-    - "{{ ansible_parent_role_names | first }} : Restart {{ _common_service_name }}"
+  # Avoid notifying the Restart SERVICE handler when SERVICE_skip_configure has been set because the systemd service doesn't exist
+  notify: >-
+    {{ _common_skip_configure | default(False) | ternary([], [(ansible_parent_role_names | first) ~ " : Restart " ~ _common_service_name]) | list }}
   tags:
     - "{{ ansible_parent_role_names | first | regex_replace(ansible_collection_name ~ '.', '') }}"
     - install

roles/_common/tasks/preflight.yml

@@ -11,7 +11,7 @@
 - name: "Check for deprecated skip_install variable"
   ansible.builtin.assert:
     that:
-      - __common_parent_role_short_name ~ '_skip_install' not in vars
+      - (__common_parent_role_short_name == "prometheus") or (__common_parent_role_short_name ~ '_skip_install' not in vars)
     fail_msg: "The variable {{ __common_parent_role_short_name ~ '_skip_install' }} is deprecated.
                Please use `--skip-tags {{ __common_parent_role_short_name }}_install` instead to skip the installation."
   tags:
@@ -82,7 +82,7 @@
       - >-
         [_common_web_listen_address] |
           flatten |
-          reject('match', '.+:\\d+$') |
+          reject('match', '.*:\\d+$') |
           list |
           length == 0
   when: (_common_web_listen_address | length > 0)

roles/_common/templates/web_config.yml.j2

@@ -13,6 +13,10 @@ http_server_config:
 {% if _common_basic_auth_users | length > 0 %}
 basic_auth_users:
 {% for k, v in _common_basic_auth_users.items() %}
+  {% if v is mapping %}
+  {{ k }}: {{ v.hashed | mandatory(msg='Give basic_auth_users in format {"USERNAME": "PASSWORD IN CLEARTEXT"} or {"USERNAME: {"hashed": "PASSWORD ALREADY HASHED"}}') }}
+  {% else %}
   {{ k }}: {{ v | string | password_hash('bcrypt', ('abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890' | shuffle(seed=inventory_hostname) | join)[:22], rounds=9) }}
+  {% endif %}
 {% endfor %}
 {% endif %}

roles/alertmanager/defaults/main.yml

@@ -2,6 +2,7 @@
 alertmanager_version: 0.33.1
 alertmanager_binary_url: "https://github.com/{{ _alertmanager_repo }}/releases/download/v{{ alertmanager_version }}/\
                           alertmanager-{{ alertmanager_version }}.{{ ansible_facts['system'] | lower }}-{{ _alertmanager_go_ansible_arch }}.tar.gz"
+alertmanager_checksum: ""
 alertmanager_checksums_url: "https://github.com/{{ _alertmanager_repo }}/releases/download/v{{ alertmanager_version }}/sha256sums.txt"
 
 alertmanager_config_dir: /etc/alertmanager
@@ -147,3 +148,9 @@ alertmanager_system_user: alertmanager
 alertmanager_system_group: "{{ alertmanager_system_user }}"
 
 alertmanager_mask_diff: false
+
+# Set to true for install-only runs
+alertmanager_skip_configure: false
+
+# Another host than localhost only works in single-host plays
+alertmanager_download_host: localhost

roles/alertmanager/tasks/main.yml

@@ -18,11 +18,14 @@
     _common_binaries: "{{ _alertmanager_binaries }}"
     _common_binary_install_dir: "{{ alertmanager_binary_install_dir }}"
     _common_binary_url: "{{ alertmanager_binary_url }}"
+    _common_download_host: "{{ alertmanager_download_host }}"
+    _common_checksum: "{{ alertmanager_checksum }}"
     _common_checksums_url: "{{ alertmanager_checksums_url }}"
     _common_system_group: "{{ alertmanager_system_group }}"
     _common_system_user: "{{ alertmanager_system_user }}"
     _common_config_dir: "{{ alertmanager_config_dir }}"
     _common_binary_unarchive_opts: ['--strip-components=1']
+    _common_skip_configure: "{{ alertmanager_skip_configure }}"
   tags:
     - alertmanager
     - install
@@ -43,6 +46,7 @@
 - name: Configure
   ansible.builtin.include_tasks:
     file: configure.yml
+  when: not alertmanager_skip_configure
   tags:
     - alertmanager
     - configure
@@ -57,6 +61,7 @@
     state: started
   when:
     - not ansible_check_mode
+    - not alertmanager_skip_configure
   tags:
     - alertmanager
     - run

roles/apache_exporter/defaults/main.yml

@@ -2,6 +2,7 @@
 apache_exporter_version: 1.1.1
 apache_exporter_binary_url: "https://github.com/{{ _apache_exporter_repo }}/releases/download/v{{ apache_exporter_version }}/\
                           apache_exporter-{{ apache_exporter_version }}.{{ ansible_facts['system'] | lower }}-{{ _apache_exporter_go_ansible_arch }}.tar.gz"
+apache_exporter_checksum: ""
 apache_exporter_checksums_url: "https://github.com/{{ _apache_exporter_repo }}/releases/download/v{{ apache_exporter_version }}/sha256sums.txt"
 
 apache_exporter_web_listen_address: "0.0.0.0:9117"
@@ -22,3 +23,6 @@ apache_exporter_config_dir: "/etc/apache_exporter"
 
 # Local path to stash the archive and its extraction
 apache_exporter_local_cache_path: "/tmp/apache_exporter-{{ ansible_facts['system'] | lower }}-{{ _apache_exporter_go_ansible_arch }}/{{ apache_exporter_version }}"
+
+# Another host than localhost only works in single-host plays
+apache_exporter_download_host: localhost

roles/apache_exporter/tasks/main.yml

@@ -20,6 +20,8 @@
     _common_binaries: "{{ _apache_exporter_binaries }}"
     _common_binary_install_dir: "{{ apache_exporter_binary_install_dir }}"
     _common_binary_url: "{{ apache_exporter_binary_url }}"
+    _common_download_host: "{{ apache_exporter_download_host }}"
+    _common_checksum: "{{ apache_exporter_checksum }}"
     _common_checksums_url: "{{ apache_exporter_checksums_url }}"
     _common_system_group: "{{ apache_exporter_system_group }}"
     _common_system_user: "{{ apache_exporter_system_user }}"

roles/bind_exporter/defaults/main.yml

@@ -2,6 +2,7 @@
 bind_exporter_version: 0.8.0
 bind_exporter_binary_url: "https://github.com/{{ _bind_exporter_repo }}/releases/download/v{{ bind_exporter_version }}/\
                            bind_exporter-{{ bind_exporter_version }}.{{ ansible_facts['system'] | lower }}-{{ _bind_exporter_go_ansible_arch }}.tar.gz"
+bind_exporter_checksum: ""
 bind_exporter_checksums_url: "https://github.com/{{ _bind_exporter_repo }}/releases/download/v{{ bind_exporter_version }}/sha256sums.txt"
 
 bind_exporter_web_listen_address: "0.0.0.0:9119"
@@ -24,3 +25,6 @@ bind_exporter_binary_install_dir: "/usr/local/bin"
 
 bind_exporter_config_dir: "/etc/bind_exporter"
 bind_exporter_local_cache_path: "/tmp/bind_exporter-{{ ansible_facts['system'] | lower }}-{{ _bind_exporter_go_ansible_arch }}/{{ bind_exporter_version }}"
+
+# Another host than localhost only works in single-host plays
+bind_exporter_download_host: localhost

roles/bind_exporter/tasks/main.yml

@@ -16,6 +16,8 @@
     _common_binaries: "{{ _bind_exporter_binaries }}"
     _common_binary_install_dir: "{{ bind_exporter_binary_install_dir }}"
     _common_binary_url: "{{ bind_exporter_binary_url }}"
+    _common_download_host: "{{ bind_exporter_download_host }}"
+    _common_checksum: "{{ bind_exporter_checksum }}"
     _common_checksums_url: "{{ bind_exporter_checksums_url }}"
     _common_system_group: "{{ bind_exporter_system_group }}"
     _common_system_user: "{{ bind_exporter_system_user }}"

roles/blackbox_exporter/defaults/main.yml

@@ -2,6 +2,7 @@
 blackbox_exporter_version: 0.28.0
 blackbox_exporter_binary_url: "https://github.com/{{ _blackbox_exporter_repo }}/releases/download/v{{ blackbox_exporter_version }}/\
                                blackbox_exporter-{{ blackbox_exporter_version }}.{{ ansible_facts['system'] | lower }}-{{ _blackbox_exporter_go_ansible_arch }}.tar.gz"
+blackbox_exporter_checksum: ""
 blackbox_exporter_checksums_url: "https://github.com/{{ _blackbox_exporter_repo }}/releases/download/v{{ blackbox_exporter_version }}/sha256sums.txt"
 
 blackbox_exporter_web_listen_address: "0.0.0.0:9115"
@@ -76,3 +77,6 @@ blackbox_exporter_local_cache_path: "/tmp/blackbox_exporter-{{ ansible_facts['sy
                                      {{ blackbox_exporter_version }}"
 
 blackbox_exporter_binary_install_dir: "/usr/local/bin"
+
+# Another host than localhost only works in single-host plays
+blackbox_exporter_download_host: localhost

roles/blackbox_exporter/tasks/main.yml

@@ -16,6 +16,8 @@
     _common_binaries: "{{ _blackbox_exporter_binaries }}"
     _common_binary_install_dir: "{{ blackbox_exporter_binary_install_dir }}"
     _common_binary_url: "{{ blackbox_exporter_binary_url }}"
+    _common_download_host: "{{ blackbox_exporter_download_host }}"
+    _common_checksum: "{{ blackbox_exporter_checksum }}"
     _common_checksums_url: "{{ blackbox_exporter_checksums_url }}"
     _common_system_group: "{{ blackbox_exporter_system_group }}"
     _common_system_user: "{{ blackbox_exporter_system_user }}"

roles/cadvisor/defaults/main.yml

@@ -27,3 +27,6 @@ cadvisor_binary_install_dir: "/usr/local/bin"
 #
 cadvisor_housekeeping_interval: 10s
 cadvisor_max_housekeeping_interval: 15s
+
+# Another host than localhost only works in single-host plays
+cadvisor_download_host: localhost

roles/cadvisor/tasks/main.yml

@@ -17,6 +17,7 @@
     _common_binaries: "{{ _cadvisor_binaries }}"
     _common_binary_install_dir: "{{ cadvisor_binary_install_dir }}"
     _common_binary_url: "{{ cadvisor_binary_url }}"
+    _common_download_host: "{{ cadvisor_download_host }}"
     _common_system_group: "{{ cadvisor_system_group }}"
     _common_system_user: "{{ cadvisor_system_user }}"
     _common_config_dir: "{{ cadvisor_config_dir }}"

roles/chrony_exporter/defaults/main.yml

@@ -2,6 +2,7 @@
 chrony_exporter_version: 0.13.3
 chrony_exporter_binary_url: "https://github.com/{{ _chrony_exporter_repo }}/releases/download/v{{ chrony_exporter_version }}/\
                              chrony_exporter-{{ chrony_exporter_version }}.{{ ansible_facts['system'] | lower }}-{{ _chrony_exporter_go_ansible_arch }}.tar.gz"
+chrony_exporter_checksum: ""
 chrony_exporter_checksums_url: "https://github.com/{{ _chrony_exporter_repo }}/releases/download/v{{ chrony_exporter_version }}/sha256sums.txt"
 
 chrony_exporter_web_listen_address: "0.0.0.0:9123"
@@ -28,3 +29,6 @@ chrony_exporter_local_cache_path: "/tmp/chrony_exporter-{{ ansible_facts['system
 
 chrony_exporter_binary_install_dir: "/usr/local/bin"
 chrony_exporter_config_dir: "/etc/chrony_exporter"
+
+# Another host than localhost only works in single-host plays
+chrony_exporter_download_host: localhost

roles/chrony_exporter/tasks/main.yml

@@ -16,6 +16,8 @@
     _common_binaries: "{{ _chrony_exporter_binaries }}"
     _common_binary_install_dir: "{{ chrony_exporter_binary_install_dir }}"
     _common_binary_url: "{{ chrony_exporter_binary_url }}"
+    _common_download_host: "{{ chrony_exporter_download_host }}"
+    _common_checksum: "{{ chrony_exporter_checksum }}"
     _common_checksums_url: "{{ chrony_exporter_checksums_url }}"
     _common_system_group: "{{ chrony_exporter_system_group }}"
     _common_system_user: "{{ chrony_exporter_system_user }}"

roles/consul_exporter/defaults/main.yml

@@ -2,6 +2,7 @@
 consul_exporter_version: 0.13.0
 consul_exporter_binary_url: "https://github.com/{{ _consul_exporter_repo }}/releases/download/v{{ consul_exporter_version }}/\
                              consul_exporter-{{ consul_exporter_version }}.{{ ansible_facts['system'] | lower }}-{{ _consul_exporter_go_ansible_arch }}.tar.gz"
+consul_exporter_checksum: ""
 consul_exporter_checksums_url: "https://github.com/{{ _consul_exporter_repo }}/releases/download/v{{ consul_exporter_version }}/sha256sums.txt"
 
 consul_exporter_web_listen_address: "0.0.0.0:9107"
@@ -36,3 +37,6 @@ consul_exporter_local_cache_path: "/tmp/consul_exporter-{{ ansible_facts['system
 
 consul_exporter_binary_install_dir: "/usr/local/bin"
 consul_exporter_config_dir: "/etc/consul_exporter"
+
+# Another host than localhost only works in single-host plays
+consul_exporter_download_host: localhost

roles/consul_exporter/tasks/main.yml

@@ -20,6 +20,8 @@
     _common_binaries: "{{ _consul_exporter_binaries }}"
     _common_binary_install_dir: "{{ consul_exporter_binary_install_dir }}"
     _common_binary_url: "{{ consul_exporter_binary_url }}"
+    _common_download_host: "{{ consul_exporter_download_host }}"
+    _common_checksum: "{{ consul_exporter_checksum }}"
     _common_checksums_url: "{{ consul_exporter_checksums_url }}"
     _common_system_group: "{{ consul_exporter_system_group }}"
     _common_system_user: "{{ consul_exporter_system_user }}"

roles/fail2ban_exporter/defaults/main.yml

@@ -2,6 +2,7 @@
 fail2ban_exporter_version: 0.10.3
 fail2ban_exporter_binary_url: "https://gitlab.com/hectorjsmith/fail2ban-prometheus-exporter/-/releases/v{{ fail2ban_exporter_version }}/downloads/\
                                fail2ban_exporter_{{ fail2ban_exporter_version }}_{{ ansible_facts['system'] | lower }}_{{ _fail2ban_exporter_go_ansible_arch }}.tar.gz"
+fail2ban_exporter_checksum: ""
 fail2ban_exporter_checksums_url: "https://gitlab.com/hectorjsmith/fail2ban-prometheus-exporter/-/releases/v{{ fail2ban_exporter_version }}/downloads/\
                                fail2ban_exporter_{{ fail2ban_exporter_version }}_checksums.txt"
 
@@ -17,3 +18,6 @@ fail2ban_exporter_system_group: "{{ fail2ban_exporter_system_user }}"
 # Local path to stash the archive and its extraction
 fail2ban_exporter_local_cache_path: "/tmp/fail2ban_exporter-{{ ansible_facts['system'] | lower }}-{{ _fail2ban_exporter_go_ansible_arch }}/\
                                      {{ fail2ban_exporter_version }}"
+
+# Another host than localhost only works in single-host plays
+fail2ban_exporter_download_host: localhost

roles/fail2ban_exporter/tasks/main.yml

@@ -16,6 +16,8 @@
     _common_binaries: "{{ _fail2ban_exporter_binaries }}"
     _common_binary_install_dir: "{{ fail2ban_exporter_binary_install_dir }}"
     _common_binary_url: "{{ fail2ban_exporter_binary_url }}"
+    _common_download_host: "{{ fail2ban_exporter_download_host }}"
+    _common_checksum: "{{ fail2ban_exporter_checksum }}"
     _common_checksums_url: "{{ fail2ban_exporter_checksums_url }}"
     _common_system_group: "{{ fail2ban_exporter_system_group }}"
     _common_system_user: "{{ fail2ban_exporter_system_user }}"

roles/influxdb_exporter/defaults/main.yml

@@ -2,6 +2,7 @@
 influxdb_exporter_version: 0.12.1
 influxdb_exporter_binary_url: "https://github.com/{{ _influxdb_exporter_repo }}/releases/download/v{{ influxdb_exporter_version }}/\
                            influxdb_exporter-{{ influxdb_exporter_version }}.{{ ansible_facts['system'] | lower }}-{{ _influxdb_exporter_go_ansible_arch }}.tar.gz"
+influxdb_exporter_checksum: ""
 influxdb_exporter_checksums_url: "https://github.com/{{ _influxdb_exporter_repo }}/releases/download/v{{ influxdb_exporter_version }}/sha256sums.txt"
 
 influxdb_exporter_web_listen_address: "0.0.0.0:9122"
@@ -20,3 +21,6 @@ influxdb_exporter_system_user: "{{ influxdb_exporter_system_group }}"
 influxdb_exporter_config_dir: "/etc/influxdb_exporter"
 # Local path to stash the archive and its extraction
 influxdb_exporter_local_cache_path: "/tmp/influxdb_exporter-{{ ansible_facts['system'] | lower }}-{{ _influxdb_exporter_go_ansible_arch }}/{{ influxdb_exporter_version }}"
+
+# Another host than localhost only works in single-host plays
+influxdb_exporter_download_host: localhost

roles/influxdb_exporter/tasks/main.yml

@@ -20,6 +20,8 @@
     _common_binaries: "{{ _influxdb_exporter_binaries }}"
     _common_binary_install_dir: "{{ influxdb_exporter_binary_install_dir }}"
     _common_binary_url: "{{ influxdb_exporter_binary_url }}"
+    _common_download_host: "{{ influxdb_exporter_download_host }}"
+    _common_checksum: "{{ influxdb_exporter_checksum }}"
     _common_checksums_url: "{{ influxdb_exporter_checksums_url }}"
     _common_system_group: "{{ influxdb_exporter_system_group }}"
     _common_system_user: "{{ influxdb_exporter_system_user }}"

roles/ipmi_exporter/defaults/main.yml

@@ -2,6 +2,7 @@
 ipmi_exporter_version: 1.10.1
 ipmi_exporter_binary_url: "https://github.com/{{ _ipmi_exporter_repo }}/releases/download/v{{ ipmi_exporter_version }}/\
                            ipmi_exporter-{{ ipmi_exporter_version }}.{{ ansible_facts['system'] | lower }}-{{ _ipmi_exporter_go_ansible_arch }}.tar.gz"
+ipmi_exporter_checksum: ""
 ipmi_exporter_checksums_url: "https://github.com/{{ _ipmi_exporter_repo }}/releases/download/v{{ ipmi_exporter_version }}/sha256sums.txt"
 
 ipmi_exporter_modules:
@@ -30,3 +31,6 @@ ipmi_exporter_config_dir: /etc/ipmi_exporter
 
 # Local path to stash and extract the archive
 ipmi_exporter_local_cache_path: "/tmp/ipmi_exporter-{{ ansible_facts['system'] | lower }}-{{ _ipmi_exporter_go_ansible_arch }}/{{ ipmi_exporter_version }}"
+
+# Another host than localhost only works in single-host plays
+ipmi_exporter_download_host: localhost

roles/ipmi_exporter/tasks/main.yml

@@ -16,6 +16,8 @@
     _common_binaries: "{{ _ipmi_exporter_binaries }}"
     _common_binary_install_dir: "{{ ipmi_exporter_binary_install_dir }}"
     _common_binary_url: "{{ ipmi_exporter_binary_url }}"
+    _common_download_host: "{{ ipmi_exporter_download_host }}"
+    _common_checksum: "{{ ipmi_exporter_checksum }}"
     _common_checksums_url: "{{ ipmi_exporter_checksums_url }}"
     _common_system_group: "{{ ipmi_exporter_system_group }}"
     _common_system_user: "{{ ipmi_exporter_system_user }}"