Prometheus On Loopback, Retention Written Down

prometheus-server

Prometheus from the upstream release tarball (sha256-verified), as a system service on loopback, with explicit retention and the endpoints that change the server switched off. Original role for EL 10, live-tested with podman on Rocky Linux 10.

There is no package, and there is no login. EL 10 ships no Prometheus; the upstream tarball is the distribution, so the role downloads the release, checks it against the published sha256sums.txt, and installs prometheus and promtool. The binary listens on every interface and authenticates nobody. This role listens on 127.0.0.1:9090 for a proxy that does (this catalogue's caddy-https or haproxy-tls) or for Grafana on the same host (grafana-server points at it by default); the live test reads the listening sockets and expects loopback only.

Retention is a decision, written down. The sample configuration sets none, so the default 15 days applies silently; the role writes the time and, if you set it, a size cap, and the live test reads both back from /api/v1/status/flags - what the process runs with, not what a file says.

The endpoints that change the server are off. /-/reload and /-/quit (lifecycle) and the TSDB delete and snapshot calls (admin API) are flags, off here; the live test POSTs to both and expects a refusal (403 from the first, and from the second a 500 whose body says admin APIs disabled - Prometheus does not answer 403 there, which the first draft of this test assumed). Configuration changes are applied with a SIGHUP through systemctl reload.

Checked by the release that reads it. prometheus.yml is validated with the just-installed promtool before it lands. Scrape jobs, Alertmanagers and rule files are plain variables; the default scrapes Prometheus itself and the node-exporter role on the same host.

License

Commercial - IaC Bazaar EULA. (c) IaC Bazaar.