feat: add dns_exporter

roles/dns_exporter/README.md

@@ -0,0 +1,55 @@
+# Ansible Role: dns exporter
+
+## Description
+
+Deploy prometheus [dns exporter](https://github.com/tykling/dns_exporter), written in python, using ansible.
+
+Possible Grafana dashboard: https://grafana.com/grafana/dashboards/20617-dns-exporter/
+
+## Requirements
+
+- Ansible >= 2.9 (It might work on previous versions, but we cannot guarantee it)
+- gnu-tar on Mac deployer host (`brew install gnu-tar`)
+- Passlib is required when using the basic authentication feature (`pip install passlib[bcrypt]`)
+
+## Role Variables
+
+All variables which can be overridden are stored in [defaults/main.yml](defaults/main.yml) file as well as in [meta/argument_specs.yml](meta/argument_specs.yml).
+Please refer to the [collection docs](https://prometheus-community.github.io/ansible/branch/main/dns_exporter_role.html) for description and default values of the variables.
+
+## Example
+
+### Playbook
+
+Use it in a playbook as follows:
+```yaml
+- hosts: all
+  roles:
+    - prometheus.prometheus.dns_exporter
+```
+
+## Local Testing
+
+The preferred way of locally testing the role is to use Docker and [molecule](https://github.com/ansible-community/molecule) (v3.x). You will have to install Docker on your system. See "Get started" for a Docker package suitable for your system. Running your tests is as simple as executing `molecule test`.
+
+## Continuous Integration
+
+Combining molecule and circle CI allows us to test how new PRs will behave when used with multiple ansible versions and multiple operating systems. This also allows use to create test scenarios for different role configurations. As a result we have quite a large test matrix which can take more time than local testing, so please be patient.
+
+## Contributing
+
+See [contributor guideline](CONTRIBUTING.md).
+
+## Troubleshooting
+
+See [troubleshooting](TROUBLESHOOTING.md).
+
+Manual test
+```
+curl -v "http://127.0.0.1:15353/query?query_name=gmail.com&server=127.0.0.2:53"
+curl -v "http://127.0.0.1:15353/query?module=internal_a_v4&module=internalbind_a_v4&module=internaldnscrypt_a_v4&query_name=youtube.com"
+```
+
+## License
+
+This project is licensed under MIT License. See [LICENSE](/LICENSE) for more details.

roles/dns_exporter/TROUBLESHOOTING.md

@@ -0,0 +1 @@
+# Troubleshooting

roles/dns_exporter/defaults/main.yml

@@ -0,0 +1,26 @@
+---
+dns_exporter_version: 1.0.0
+# not go, but python pip. placeholders for _common
+dns_exporter_textfile_dir: ""
+dns_exporter_enabled_collectors: []
+dns_exporter_disabled_collectors: []
+dns_exporter_tls_server_config: {}
+dns_exporter_http_server_config: {}
+dns_exporter_basic_auth_users: {}
+# just for "prometheus.prometheus._common : Naive assertion of proper listen address" else not used
+dns_exporter_web_listen_address: "127.0.0.1:15353"
+
+dns_exporter_web_listen_ip: "127.0.0.1"
+dns_exporter_web_listen_port: "15353"
+
+dns_exporter_debug_enable: false
+
+dns_exporter_home: "/var/lib/dns_exporter"
+dns_exporter_virtualenv: "/var/lib/dns_exporter/venv"
+
+dns_exporter_config_template: dns_exporter.yml.j2
+
+dns_exporter_system_group: "dns-exp"
+dns_exporter_system_user: "{{ dns_exporter_system_group }}"
+
+dns_exporter_config_dir: "/etc/dns_exporter"

roles/dns_exporter/handlers/main.yml

@@ -0,0 +1,10 @@
+---
+- name: Restart dns_exporter
+  listen: "restart dns_exporter"
+  become: true
+  ansible.builtin.systemd:
+    daemon_reload: true
+    name: dns_exporter
+    state: restarted
+  when:
+    - not ansible_check_mode

roles/dns_exporter/meta/argument_specs.yml

@@ -0,0 +1,82 @@
+---
+# yamllint disable rule:line-length
+argument_specs:
+  main:
+    short_description: "Prometheus DNS Exporter"
+    description:
+      - "Deploy prometheus L(dns exporter,https://github.com/tykling/dns_exporter) using ansible"
+    author:
+      - "Prometheus Community"
+    options:
+      dns_exporter_web_listen_ip:
+        description: "IP address for dns_exporter to listen to"
+        default: "127.0.0.1"
+      dns_exporter_web_listen_port:
+        description: "Port for dns_exporter to listen to"
+        default: "15353"
+      dns_exporter_debug_enable:
+        description: "Enable or not daemon debug"
+        type: bool
+        default: false
+      dns_exporter_home:
+        description: "Home of dns_exporter user and base file locations"
+        default: "/var/lib/dns_exporter"
+      dns_exporter_virtualenv:
+        description: "Python virtualenv filepath for dns_exporter"
+        default: "/var/lib/dns_exporter/venv"
+      dns_exporter_config_template:
+        description: "Configuration template for dns_exporter"
+        default: "dns_exporter.yml.j2"
+      dns_exporter_version:
+        description: "DNS exporter package version. Also accepts latest as parameter."
+        default: "1.0.0"
+      dns_exporter_web_listen_address:
+        description: "Address on which dns exporter will listen"
+        default: "0.0.0.0:15353"
+      dns_exporter_enabled_collectors:
+        description:
+          - "List of dicts defining additionally enabled collectors and their configuration."
+          - "It adds collectors to L(those enabled by default,https://github.com/prometheus/dns_exporter#enabled-by-default)."
+        type: "list"
+        default:
+          - systemd
+          - textfile:
+              directory: "{{ dns_exporter_textfile_dir }}"
+      dns_exporter_disabled_collectors:
+        description:
+          - "List of disabled collectors."
+          - "By default dns_exporter disables collectors listed L(here,https://github.com/prometheus/dns_exporter#disabled-by-default)."
+        type: "list"
+        elements: "str"
+      dns_exporter_textfile_dir:
+        description:
+          - "Directory used by the L(Textfile Collector,https://github.com/prometheus/dns_exporter#textfile-collector)."
+          - "To get permissions to write metrics in this directory, users must be in C(dns-exp) system group."
+          - "B(Note:) More information in TROUBLESHOOTING.md guide."
+        default: "/var/lib/dns_exporter"
+      dns_exporter_tls_server_config:
+        description:
+          - "Configuration for TLS authentication."
+          - "Keys and values are the same as in L(dns_exporter docs,https://prometheus.io/docs/prometheus/latest/configuration/https/)."
+        type: "dict"
+      dns_exporter_http_server_config:
+        description:
+          - "Config for HTTP/2 support."
+          - "Keys and values are the same as in L(dns_exporter docs,https://prometheus.io/docs/prometheus/latest/configuration/https/)."
+        type: "dict"
+      dns_exporter_basic_auth_users:
+        description: "Dictionary of users and password for basic authentication. Passwords are automatically hashed with bcrypt."
+        type: "dict"
+      dns_exporter_system_group:
+        description:
+          - "I(Advanced)"
+          - "System group for dns exporter"
+        default: "dns-exp"
+      dns_exporter_system_user:
+        description:
+          - "I(Advanced)"
+          - "DNS exporter user"
+        default: "dns-exp"
+      dns_exporter_config_dir:
+        description: "Path to directory with dns_exporter configuration"
+        default: "/etc/dns_exporter"

roles/dns_exporter/meta/main.yml

@@ -0,0 +1,25 @@
+---
+galaxy_info:
+  author: "Prometheus Community"
+  description: "Prometheus DNS Exporter"
+  license: "Apache"
+  min_ansible_version: "2.9"
+  platforms:
+    - name: "Ubuntu"
+      versions:
+        - "focal"
+        - "jammy"
+        - "noble"
+    - name: "Debian"
+      versions:
+        - "bullseye"
+    - name: "EL"
+      versions:
+        - "8"
+        - "9"
+  galaxy_tags:
+    - "monitoring"
+    - "prometheus"
+    - "exporter"
+    - "metrics"
+    - "system"

roles/dns_exporter/molecule/alternative/molecule.yml

@@ -0,0 +1,23 @@
+---
+provisioner:
+  playbooks:
+    prepare: "${MOLECULE_PROJECT_DIRECTORY}/../../.config/molecule/alternative/prepare.yml"
+  inventory:
+    group_vars:
+      all:
+        dns_exporter_web_listen_address:
+          - '127.0.0.1:8080'
+          - '127.0.1.1:8080'
+        dns_exporter_textfile_dir: ""
+        dns_exporter_enabled_collectors:
+          - entropy
+        dns_exporter_disabled_collectors:
+          - diskstats
+        dns_exporter_tls_server_config:
+          cert_file: /etc/dns_exporter/tls.cert
+          key_file: /etc/dns_exporter/tls.key
+        dns_exporter_http_server_config:
+          http2: true
+        dns_exporter_basic_auth_users:
+          randomuser: examplepassword
+        dns_exporter_version: 1.5.0

roles/dns_exporter/molecule/alternative/tests/test_alternative.py

@@ -0,0 +1,43 @@
+from __future__ import (absolute_import, division, print_function)
+__metaclass__ = type
+
+from testinfra_helpers import get_target_hosts
+import pytest
+
+testinfra_hosts = get_target_hosts()
+
+
+def test_directories(host):
+    dirs = [
+        "/var/lib/dns_exporter"
+    ]
+    for dir in dirs:
+        d = host.file(dir)
+        assert not d.exists
+
+
+def test_service(host):
+    s = host.service("dns_exporter")
+    try:
+        assert s.is_running
+    except AssertionError:
+        # Capture service logs
+        journal_output = host.run('journalctl -u dns_exporter --since "1 hour ago"')
+        print("\n==== journalctl -u dns_exporter Output ====\n")
+        print(journal_output)
+        print("\n============================================\n")
+        raise  # Re-raise the original assertion error
+
+
+def test_protecthome_property(host):
+    s = host.service("dns_exporter")
+    p = s.systemd_properties
+    assert p.get("ProtectHome") == "yes"
+
+
+@pytest.mark.parametrize("sockets", [
+    "tcp://127.0.0.1:8080",
+    "tcp://127.0.1.1:8080",
+])
+def test_socket(host, sockets):
+    assert host.socket(sockets).is_listening

roles/dns_exporter/molecule/default/molecule.yml

@@ -0,0 +1,6 @@
+---
+provisioner:
+  inventory:
+    group_vars:
+      all:
+        dns_exporter_web_listen_address: "127.0.0.1:15353"

roles/dns_exporter/molecule/default/tests/test_default.py

@@ -0,0 +1,76 @@
+from __future__ import (absolute_import, division, print_function)
+__metaclass__ = type
+
+from testinfra_helpers import get_target_hosts
+
+testinfra_hosts = get_target_hosts()
+
+
+def test_directories(host):
+    dirs = [
+        "/var/lib/dns_exporter"
+    ]
+    for dir in dirs:
+        d = host.file(dir)
+        assert d.is_directory
+        assert d.exists
+
+
+def test_files(host):
+    files = [
+        "/etc/systemd/system/dns_exporter.service",
+        "/usr/local/bin/dns_exporter"
+    ]
+    for file in files:
+        f = host.file(file)
+        assert f.exists
+        assert f.is_file
+
+
+def test_permissions_didnt_change(host):
+    dirs = [
+        "/etc",
+        "/root",
+        "/usr",
+        "/var"
+    ]
+    for file in dirs:
+        f = host.file(file)
+        assert f.exists
+        assert f.is_directory
+        assert f.user == "root"
+        assert f.group == "root"
+
+
+def test_user(host):
+    assert host.group("dns-exp").exists
+    assert "dns-exp" in host.user("dns-exp").groups
+    assert host.user("dns-exp").shell == "/usr/sbin/nologin"
+
+
+def test_service(host):
+    s = host.service("dns_exporter")
+    try:
+        assert s.is_running
+    except AssertionError:
+        # Capture service logs
+        journal_output = host.run('journalctl -u dns_exporter --since "1 hour ago"')
+        print("\n==== journalctl -u dns_exporter Output ====\n")
+        print(journal_output)
+        print("\n============================================\n")
+        raise  # Re-raise the original assertion error
+
+
+def test_protecthome_property(host):
+    s = host.service("dns_exporter")
+    p = s.systemd_properties
+    assert p.get("ProtectHome") == "yes"
+
+
+def test_socket(host):
+    sockets = [
+        "tcp://127.0.0.1:15353"
+    ]
+    for socket in sockets:
+        s = host.socket(socket)
+        assert s.is_listening

roles/dns_exporter/molecule/latest/molecule.yml

@@ -0,0 +1,7 @@
+---
+provisioner:
+  inventory:
+    group_vars:
+      all:
+        dns_exporter_version: latest
+        dns_exporter_textfile_dir: /home/dns_exporter