Prometheus On Loopback, Retention Written Down
Prometheus from the upstream release (EL 10 has no package), sha256-verified, on loopback: the binary listens everywhere and authenticates nobody. Retention time and size as explicit flags, lifecycle and admin endpoints off (the live test POSTs to both), prometheus.yml checked by the promtool it installs. Pairs with grafana-server and node-exporter. Original role, live-tested on Rocky Linux 10.
Verification
Live-testedReally deployed to a container sandbox, proven idempotent (a second run changes nothing), verified against the role’s assertions, then torn down.
Conformance
- Static validation (yamllint · ansible-lint)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live-tested - applied, verified, destroyed
Last verified 2026-09-19 · podman 4.9.3 · ansible 2.21.4 · how we verify
Cite it in your README
badge · attributionPaste this beside the module in the repository that uses it. The badge is rendered from this artifact's verification record, so it reads live-tested because the record says so, and the link lands on this page.
[](https://www.iac-bazaar.com/catalog/ansible-prometheus-server?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
Ansible role 1.0.0, live-tested on IaC Bazaar: [Prometheus On Loopback, Retention Written Down](https://www.iac-bazaar.com/catalog/ansible-prometheus-server?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
```yaml
# Prometheus On Loopback, Retention Written Down: https://www.iac-bazaar.com/catalog/ansible-prometheus-server (download from your IaC Bazaar account)
```Preview:
Documentation
prometheus-server
Prometheus from the upstream release tarball (sha256-verified), as a system service on loopback, with explicit retention and the endpoints that change the server switched off. Original role for EL 10, live-tested with podman on Rocky Linux 10.
There is no package, and there is no login. EL 10 ships no Prometheus;
the upstream tarball is the distribution, so the role downloads the release,
checks it against the published sha256sums.txt, and installs prometheus
and promtool. The binary listens on every interface and authenticates
nobody. This role listens on 127.0.0.1:9090 for a proxy that does (this
catalogue's caddy-https or haproxy-tls) or for Grafana on the same host
(grafana-server points at it by default); the live test reads the
listening sockets and expects loopback only.
Retention is a decision, written down. The sample configuration sets
none, so the default 15 days applies silently; the role writes the time and,
if you set it, a size cap, and the live test reads both back from
/api/v1/status/flags - what the process runs with, not what a file says.
The endpoints that change the server are off. /-/reload and /-/quit
(lifecycle) and the TSDB delete and snapshot calls (admin API) are flags, off
here; the live test POSTs to both and expects a refusal (403 from the first,
and from the second a 500 whose body says admin APIs disabled - Prometheus
does not answer 403 there, which the first draft of this test assumed).
Configuration changes are applied with a SIGHUP through systemctl reload.
Checked by the release that reads it. prometheus.yml is validated with
the just-installed promtool before it lands. Scrape jobs, Alertmanagers and
rule files are plain variables; the default scrapes Prometheus itself and the
node-exporter role on the same host.
License
Commercial - IaC Bazaar EULA. (c) IaC Bazaar.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Variables
- Test
Related modules
ansible-victoria-logs
VictoriaLogs from the upstream release as a hardened service on loopback. Its JSON-lines endpoint answers 200 and stores nothing when the content type is wrong, so the README names the one it needs. The live test ingests two lines, gets the right one back from LogsQL, and sees an unwritten stream come back empty and bad LogsQL refused. Original role, live-tested on Rocky Linux 10.
ansible-alertmanager
Prometheus Alertmanager from the upstream release (sha256-verified) as a hardened system service on loopback, its cluster gossip listener switched off and its configuration checked by amtool before it lands. The live test posts an alert through the API and reads it back active, held by the default receiver, and expects no 9094 listener at all. Original role, live-tested on Rocky Linux 10.
ansible-alloy
Grafana Alloy from the upstream release (sha256-verified) as a hardened system service on loopback with --disable-reporting, a self-scrape pipeline that proves the collector runs, and its configuration checked by alloy validate before it lands. The live test reads Alloy's own metrics and asks the component API for the scrape component's health. Original role, live-tested on Rocky Linux 10.
ansible-blackbox-exporter
Prometheus Blackbox exporter from the upstream release (sha256-verified) as a hardened system service on loopback with HTTP and TCP modules, checked by --config.check before the file lands. The live test has it probe itself over HTTP and TCP (probe_success 1) and a port with nothing behind it (probe_success 0): it measures, not only answers. Original role, live-tested on Rocky Linux 10.
ansible-cockpit
Cockpit from BaseOS bound to loopback, with logins limited to an admin group through PAM and root refused outright. The live test sees an administrator log in while an ordinary account, a wrong password and root, placed in the admin group to isolate its own rule, are refused, and reads the login banner. Original role, live-tested on Rocky Linux 10.
ansible-fluent-bit
fluent-bit from EPEL, following a log-file glob it re-reads every few seconds and shipping over the Forward protocol, with retries unlimited instead of the default single retry. Its config is checked with --dry-run before it lands. The live test writes a line to a new file and watches it arrive at an aggregator it started. Original role, live-tested on Rocky Linux 10.