Alertmanager On Loopback, Gossip Off

alertmanager

Prometheus Alertmanager from the upstream release tarball (sha256-verified), as a system service on loopback with its cluster gossip listener switched off and its configuration checked by amtool before it lands. Original role for EL 10, live-tested with podman on Rocky Linux 10.

No package, so the checksum is the whole story. EL 10 carries no alertmanager; Prometheus ships a release with a checksum file beside it. The role downloads both and has Ansible's get_url refuse the asset unless its SHA-256 is the one in the vendor's file, then installs the binaries as root's in /usr/local/bin, pinned by alertmanager_version.

A service account, a hardened unit, a loopback listener. alertmanager is a system user with no shell that owns the data directory and nothing else; the unit runs with NoNewPrivileges, PrivateTmp, ProtectHome and ProtectSystem=strict. The listener is 127.0.0.1:9093 by default, for a proxy that authenticates or a client on the same host; the live test reads the listening sockets and expects loopback only.

The second listener nobody asked for. Alertmanager opens a gossip listener on 0.0.0.0:9094 by default, for clustering, on every install that never clusters. The role passes --cluster.listen-address= (empty), which turns it off, and the live test reads the sockets and expects no 9094 at all. A cluster is a variable change (alertmanager_extra_args is not needed; set the listen address and peers in the unit template).

Held, not lost. The default receiver has no integration, which Alertmanager accepts: alerts are grouped and held and delivered nowhere until you give the receiver a webhook (alertmanager_default_webhook_url) or add receivers and routes of your own. The live test posts an alert through the API and reads it back active, held by the default receiver, the proof the routing tree loaded and ran.

License

Commercial - IaC Bazaar EULA. (c) IaC Bazaar.