Install munin-node on servers

Begin with already-included and postgres modules. I'll look to add
prosody-specific modules in time.

2 files changed, 185 insertions, 0 deletions

diff --git a/files/munin-node.conf.j2 b/files/munin-node.conf.j2
new file mode 100644
index 0000000..81400a9
--- /dev/null
+++ b/files/munin-node.conf.j2
@@ -0,0 +1,69 @@
+# SPDX-FileCopyrightText: 2026 Matthew Fennell <matthew@fennell.dev>
+#
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+#
+# Example config-file for munin-node
+#
+
+log_level 4
+log_file /var/log/munin/munin-node.log
+pid_file /var/run/munin/munin-node.pid
+
+background 1
+setsid 1
+
+user root
+group root
+
+# This is the timeout for the whole transaction.
+# Units are in sec. Default is 15 min
+#
+# global_timeout 900
+
+# This is the timeout for each plugin.
+# Units are in sec. Default is 1 min
+#
+# timeout 60
+
+# Regexps for files to ignore
+ignore_file [\#~]$
+ignore_file DEADJOE$
+ignore_file \.bak$
+ignore_file %$
+ignore_file \.dpkg-(tmp|new|old|dist)$
+ignore_file \.rpm(save|new)$
+ignore_file \.pod$
+
+# Set this if the client doesn't report the correct hostname when
+# telnetting to localhost, port 4949
+#
+#host_name localhost.localdomain
+host_name {{ hostname }}
+
+# A list of addresses that are allowed to connect.  This must be a
+# regular expression, since Net::Server does not understand CIDR-style
+# network notation unless the perl module Net::CIDR is installed.  You
+# may repeat the allow line as many times as you'd like
+
+allow ^127\.0\.0\.1$
+allow ^::1$
+allow ^{{ munin_host }}$
+
+# If you have installed the Net::CIDR perl module, you can use one or more
+# cidr_allow and cidr_deny address/mask patterns.  A connecting client must
+# match any cidr_allow, and not match any cidr_deny.  Note that a netmask
+# *must* be provided, even if it's /32
+#
+# Example:
+#
+# cidr_allow 127.0.0.1/32
+# cidr_allow 192.0.2.0/24
+# cidr_deny  192.0.2.42/32
+
+# Which address to bind to;
+host *
+# host 127.0.0.1
+
+# And which port
+port 4949
diff --git a/playbook.yaml b/playbook.yaml
index 48262c2..91573fe 100644
--- a/playbook.yaml
+++ b/playbook.yaml
@@ -225,8 +225,10 @@
    - name: Ensure required packages are installed
      ansible.builtin.apt:
       name:
+       - libdbi-perl  # Used by munin postgres plugins
        - lua-dbi-postgresql  # Prosody postgres connection
        - lua-unbound  # Prosody DNS resolution
+       - munin-node  # Graphs and monitoring
        - postgresql  # Database
        - prosody  # XMPP server
        - prosody-modules  # Extra addons
@@ -316,6 +318,7 @@
       proto: tcp
       state: enabled
      loop:
+      - 4949  # Munin
       - 5000  # XEP-0065
       - 5223  # XEP-0368
       - 5270  # XEP-0368
@@ -366,6 +369,113 @@
      notify: Restart nginx
      when: not is_transport_server
 
+   - name: Ensure munin is configured
+     ansible.builtin.template:
+      src: "{{ playbook_dir }}/files/munin-node.conf.j2"
+      dest: /etc/munin/munin-node.conf
+      owner: root
+      group: root
+      mode: "0644"
+     become: true
+     notify: Restart munin-node
+
+   - name: Ensure munin plugins are configured
+     ansible.builtin.file:
+      src: "/usr/share/munin/plugins/{{ item.src }}"
+      dest: "/etc/munin/plugins/{{ item.dest }}"
+      owner: root
+      group: root
+      state: link
+     become: true
+     with_items:
+      - src: apt_all
+        dest: apt_all
+      - src: cpu
+        dest: cpu
+      - src: df
+        dest: df
+      - src: df_abs
+        dest: df_abs
+      - src: df_inode
+        dest: df_inode
+      - src: diskstats
+        dest: diskstats
+      - src: entropy
+        dest: entropy
+      - src: forks
+        dest: forks
+      - src: fw_conntrack
+        dest: fw_conntrack
+      - src: fw_forwarded_local
+        dest: fw_forwarded_local
+      - src: fw_packets
+        dest: fw_packets
+      - src: if_
+        dest: if_enp1s0
+      - src: if_err_
+        dest: if_err_enp1s0
+      - src: irqstats
+        dest: irqstats
+      - src: load
+        dest: load
+      - src: memory
+        dest: memory
+      - src: netstat
+        dest: netstat
+      - src: open_files
+        dest: open_files
+      - src: open_inodes
+        dest: open_inodes
+      - src: postgres_autovacuum
+        dest: postgres_autovacuum
+      - src: postgres_bgwriter
+        dest: postgres_bgwriter
+      - src: postgres_cache_
+        dest: postgres_cache_prosody
+      - src: postgres_checkpoints
+        dest: postgres_checkpoints
+      - src: postgres_connections_
+        dest: postgres_connections_prosody
+      - src: postgres_connections_db
+        dest: postgres_connections_db
+      - src: postgres_locks_
+        dest: postgres_locks_prosody
+      - src: postgres_oldest_prepared_xact_
+        dest: postgres_oldest_prepared_xact_prosody
+      - src: postgres_prepared_xacts_
+        dest: postgres_prepared_xacts_prosody
+      - src: postgres_querylength_
+        dest: postgres_querylength_prosody
+      - src: postgres_scans_
+        dest: postgres_scans_prosody
+      - src: postgres_size_
+        dest: postgres_size_prosody
+      - src: postgres_streaming_
+        dest: postgres_streaming_prosody
+      - src: postgres_transactions_
+        dest: postgres_transactions_prosody
+      - src: postgres_tuples_
+        dest: postgres_tuples_prosody
+      - src: postgres_users
+        dest: postgres_users
+      - src: postgres_xlog
+        dest: postgres_xlog
+      - src: proc_pri
+        dest: proc_pri
+      - src: processes
+        dest: processes
+      - src: swap
+        dest: swap
+      - src: threads
+        dest: threads
+      - src: uptime
+        dest: uptime
+      - src: users
+        dest: users
+      - src: vmstat
+        dest: vmstat
+     notify: Restart munin-node
+
    - name: Ensure turn is configured
      ansible.builtin.template:
       src: "{{ playbook_dir }}/files/turnserver.conf.j2"
@@ -533,6 +643,12 @@
       state: restarted
      become: true
 
+   - name: Restart munin-node
+     ansible.builtin.service:
+      name: munin-node
+      state: restarted
+     become: true
+
   vars:
 
    env_prefix: >-