Telegraf, A Metrics Agent Proven By A Metric Through It

telegraf

Telegraf, InfluxData's metrics agent, from the vendor's release tarball (SHA-256 pinned to the value in InfluxData's release notes; there is no checksum file beside the download), as a hardened system service whose listeners are on loopback. Original role for EL 10, live-tested with podman on Rocky Linux 10.

No package, and no checksum file to speak of. EL 10 carries no telegraf, and InfluxData publishes the release with nothing beside it. This role pins the SHA-256 per architecture beside the version, has Ansible's get_url refuse the asset unless it matches, and installs the binaries as root's in /usr/local/bin. A new release is a new pair, on purpose.

A service account, a hardened unit, a loopback listener. telegraf is a system user with no shell that owns the data directory and nothing else; the unit runs with NoNewPrivileges, PrivateTmp, ProtectHome and ProtectSystem=strict. The listener is 127.0.0.1:9273 by default, for a proxy that authenticates or a client on the same host; the live test reads the listening sockets and expects loopback only.

Proven by a metric through the agent. The live test POSTs a line of line protocol to the HTTP listener input (204), sees a line that is not line protocol refused (400), and reads the metric back from the Prometheus client output as probe_value{lane="ansible"} 42 - the parser, the agent's flush cycle and the output all ran. Your real inputs and outputs go in telegraf_extra_config; the two plugins in the base configuration are what makes the role testable and are harmless to keep (both on loopback).

License

Commercial - IaC Bazaar EULA. (c) IaC Bazaar.