Mimir Monolithic On Loopback, A Metric Written And Read Back
Grafana Mimir from the upstream release binary (sha256-verified) in monolithic mode as a hardened system service on loopback with filesystem storage, every ring member on loopback, usage reporting off. The live test pushes a gauge over OTLP, queries it back through the Prometheus API with its labels and sees an unknown metric answered empty. Original role, live-tested on Rocky Linux 10.
Verification
Live-testedReally deployed to a container sandbox, proven idempotent (a second run changes nothing), verified against the role’s assertions, then torn down.
Conformance
- Static validation (yamllint · ansible-lint)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live-tested - applied, verified, destroyed
Last verified 2026-09-20 · podman 4.9.3 · ansible 2.21.4 · how we verify
Documentation
mimir
Grafana Mimir from the upstream release binary (sha256-verified), in monolithic mode as a hardened system service on loopback with filesystem storage, for a Prometheus remote-write or OTLP source on the same host or behind a proxy. Original role for EL 10, live-tested with podman on Rocky Linux 10.
No package, so the checksum is the whole story. EL 10 carries no
mimir; Grafana ships a release with a checksum file beside it. The
role downloads both and has Ansible's get_url refuse the binary unless its
SHA-256 is the one in the vendor's file, then installs it as
root's in /usr/local/bin, pinned by mimir_version.
A service account, a hardened unit, a loopback listener. mimir
is a system user with no shell that owns the data directory and nothing
else; the unit runs with NoNewPrivileges, PrivateTmp, ProtectHome and
ProtectSystem=strict. The listener is 127.0.0.1:9009 by default,
for a proxy that authenticates or a client on the same host; the live test
reads the listening sockets and expects loopback only.
Every ring member says loopback. Mimir's components find each other
through rings and advertise the address of the first interface they
find, which on a host is not loopback: the query frontend then waits for
queriers at an address nothing listens on and every query hangs. The
role gives each ring (instance_addr), the query frontend (address) and
memberlist (bind_addr, advertise_addr) 127.0.0.1 explicitly, and the
live test reads the listening sockets and expects 9009, 9095 and 7946 on
loopback only. Filesystem blocks, ruler and alertmanager stores must be
distinct directories (Mimir refuses overlapping ones at start), and the
activity tracker's file is pointed into the data directory, since
ProtectSystem=strict makes the working directory read-only.
Proven by a metric. The live test pushes one gauge sample through the
OTLP/HTTP receiver, queries it back through the Prometheus API with its
resource and point labels, sees a metric nobody wrote answered with an
empty result, and reads the pinned version from the build information.
Filesystem storage is what Grafana calls development-grade; an object
store is mimir_extra_config away, and usage reporting is off.
License
Commercial - IaC Bazaar EULA. (c) IaC Bazaar.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Variables
- Test
Related modules
ansible-alertmanager
Prometheus Alertmanager from the upstream release (sha256-verified) as a hardened system service on loopback, its cluster gossip listener switched off and its configuration checked by amtool before it lands. The live test posts an alert through the API and reads it back active, held by the default receiver, and expects no 9094 listener at all. Original role, live-tested on Rocky Linux 10.
ansible-alloy
Grafana Alloy from the upstream release (sha256-verified) as a hardened system service on loopback with --disable-reporting, a self-scrape pipeline that proves the collector runs, and its configuration checked by alloy validate before it lands. The live test reads Alloy's own metrics and asks the component API for the scrape component's health. Original role, live-tested on Rocky Linux 10.
ansible-blackbox-exporter
Prometheus Blackbox exporter from the upstream release (sha256-verified) as a hardened system service on loopback with HTTP and TCP modules, checked by --config.check before the file lands. The live test has it probe itself over HTTP and TCP (probe_success 1) and a port with nothing behind it (probe_success 0): it measures, not only answers. Original role, live-tested on Rocky Linux 10.
ansible-grafana-server
Grafana on loopback with a secret key of yours: every install that never set one shares the package's, which encrypts the data-source credentials in its database. Secure cookies and HSTS for the TLS proxy in front; public snapshots, plugin update checks, feedback links and Gravatar switched off. Settings verified through the API, not the file. Original role, live-tested on Rocky Linux 10.
ansible-jaeger
Jaeger v2, the tracing backend built on the OpenTelemetry Collector, from the upstream release (sha256-verified against the right checksum file) as a hardened system service on loopback with badger storage and the query API on loopback. The live test pushes a span over OTLP and reads the trace back by id with its name and service. Original role, live-tested on Rocky Linux 10.
ansible-loki
Grafana Loki from the upstream release (sha256-verified) as a single-binary system service on loopback with filesystem storage, a TSDB index, retention the compactor enforces and usage reporting off, its configuration checked by loki -verify-config before it lands. The live test pushes one log line and queries it back. Original role, live-tested on Rocky Linux 10.