Blackbox Exporter, Probed With A Control

Prometheus Blackbox exporter from the upstream release (sha256-verified) as a hardened system service on loopback with HTTP and TCP modules, checked by --config.check before the file lands. The live test has it probe itself over HTTP and TCP (probe_success 1) and a port with nothing behind it (probe_success 0): it measures, not only answers. Original role, live-tested on Rocky Linux 10.

ansibleObservability

Verification

Live-tested

Really deployed to a container sandbox, proven idempotent (a second run changes nothing), verified against the role’s assertions, then torn down.

Conformance

  • Static validation (yamllint · ansible-lint)

Provenance

  • SHA-256 checksum
  • Signature (pending)

Functional

  • Live-tested - applied, verified, destroyed

Last verified 2026-09-20 · podman 4.9.3 · ansible 2.21.4 · how we verify

Documentation

blackbox-exporter

Prometheus Blackbox exporter from the upstream release tarball (sha256-verified), as a system service on loopback with HTTP and TCP probe modules and its configuration checked by the exporter's own --config.check before it lands. Original role for EL 10, live-tested with podman on Rocky Linux 10.

No package, so the checksum is the whole story. EL 10 carries no blackbox-exporter; Prometheus ships a release with a checksum file beside it. The role downloads both and has Ansible's get_url refuse the asset unless its SHA-256 is the one in the vendor's file, then installs the binaries as root's in /usr/local/bin, pinned by blackbox_exporter_version.

A service account, a hardened unit, a loopback listener. blackbox-exporter is a system user with no shell that owns the data directory and nothing else; the unit runs with NoNewPrivileges, PrivateTmp, ProtectHome and ProtectSystem=strict. The listener is 127.0.0.1:9115 by default, for a proxy that authenticates or a client on the same host; the live test reads the listening sockets and expects loopback only.

Probed for real, with a control. The live test asks the exporter to probe itself over HTTP and over TCP and expects probe_success 1 from both, then asks it to probe a port with nothing behind it and expects probe_success 0. Without the third probe the first two would only show that the exporter answers; with it they show that it measures.

No ICMP by default. The hardened unit grants no capabilities, so an icmp module would fail with permission denied; the README of the unit says where to add AmbientCapabilities=CAP_NET_RAW if you need it.

License

Commercial - IaC Bazaar EULA. (c) IaC Bazaar.

Usage code & full reference need an account

The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.

  • Variables
  • Test

Related modules

Live-tested

ansible-alertmanager

Prometheus Alertmanager from the upstream release (sha256-verified) as a hardened system service on loopback, its cluster gossip listener switched off and its configuration checked by amtool before it lands. The live test posts an alert through the API and reads it back active, held by the default receiver, and expects no 9094 listener at all. Original role, live-tested on Rocky Linux 10.

View module
Live-tested

ansible-alloy

Grafana Alloy from the upstream release (sha256-verified) as a hardened system service on loopback with --disable-reporting, a self-scrape pipeline that proves the collector runs, and its configuration checked by alloy validate before it lands. The live test reads Alloy's own metrics and asks the component API for the scrape component's health. Original role, live-tested on Rocky Linux 10.

View module
Live-tested

ansible-grafana-server

Grafana on loopback with a secret key of yours: every install that never set one shares the package's, which encrypts the data-source credentials in its database. Secure cookies and HSTS for the TLS proxy in front; public snapshots, plugin update checks, feedback links and Gravatar switched off. Settings verified through the API, not the file. Original role, live-tested on Rocky Linux 10.

View module
Live-tested

ansible-loki

Grafana Loki from the upstream release (sha256-verified) as a single-binary system service on loopback with filesystem storage, a TSDB index, retention the compactor enforces and usage reporting off, its configuration checked by loki -verify-config before it lands. The live test pushes one log line and queries it back. Original role, live-tested on Rocky Linux 10.

View module
Live-tested

ansible-prometheus-server

Prometheus from the upstream release (EL 10 has no package), sha256-verified, on loopback: the binary listens everywhere and authenticates nobody. Retention time and size as explicit flags, lifecycle and admin endpoints off (the live test POSTs to both), prometheus.yml checked by the promtool it installs. Pairs with grafana-server and node-exporter. Original role, live-tested on Rocky Linux 10.

View module
Live-tested

ansible-node-exporter

Official node_exporter release (pinned v1.11.1) with sha256 checksum-verified install, dedicated shell-less system user, and a systemd unit on :9100; live-tested for idempotence with a functional /metrics verification.

View module