snapshot of https://github.com/zulip/zulip.git @ 48c69911c7dd4e03b20552eb3bd77ad8151c1357 (2026-09-15)

puppet/kandra/manifests/prometheus/akamai.pp

@@ -0,0 +1,23 @@
+# @summary Prometheus monitoring of Akamai access logs
+#
+class kandra::prometheus::akamai {
+  include kandra::prometheus::base
+  include kandra::vector
+  include zulip::supervisor
+
+  $pipelines = {
+    'static' => zulipsecret('secrets', 'akamai_static_sqs_url', ''),
+    'realm'  => zulipsecret('secrets', 'akamai_realm_sqs_url', ''),
+  }
+
+  concat::fragment { 'vector_akamai':
+    target  => $kandra::vector::conf,
+    order   => '50',
+    content => template('kandra/vector_akamai.toml.template.erb'),
+  }
+  concat::fragment { 'vector_akamai_export':
+    target  => $kandra::vector::conf,
+    content => ',"akamai_logs2metrics*"',
+    order   => '90',
+  }
+}

puppet/kandra/manifests/prometheus/base.pp

@@ -0,0 +1,16 @@
+# @summary Configures a node for monitoring with Prometheus
+#
+class kandra::prometheus::base {
+  group { 'prometheus':
+    ensure => present,
+    gid    => '1060',
+  }
+  user { 'prometheus':
+    ensure     => present,
+    uid        => '1060',
+    gid        => '1060',
+    shell      => '/bin/bash',
+    home       => '/nonexistent',
+    managehome => false,
+  }
+}

puppet/kandra/manifests/prometheus/grok.pp

@@ -0,0 +1,45 @@
+# @summary Parses nginx access_log files
+#
+class kandra::prometheus::grok {
+  include kandra::prometheus::base
+  include zulip::supervisor
+
+  $version = $zulip::common::versions['grok_exporter']['version']
+  $dir = "/srv/zulip-grok_exporter-${version}"
+  $bin = "${dir}/grok_exporter"
+
+  zulip::external_dep { 'grok_exporter':
+    version        => $version,
+    url            => "https://github.com/fstab/grok_exporter/releases/download/v${version}/grok_exporter-${version}.linux-${zulip::common::goarch}.zip",
+    tarball_prefix => "grok_exporter-${version}.linux-${zulip::common::goarch}",
+    bin            => [$bin],
+    cleanup_after  => [Service[supervisor]],
+  }
+
+  $realm_names_regex = zulipconf('grok_exporter', 'realm_names_regex', '__impossible__')
+  $include_dir = "${dir}/patterns"
+  file { '/etc/grok_exporter.yaml':
+    ensure  => file,
+    owner   => zulip,
+    group   => zulip,
+    mode    => '0644',
+    content => template('kandra/prometheus/grok_exporter.yaml.template.erb'),
+    notify  => Service[supervisor],
+  }
+
+  kandra::teleport::prometheus_app { 'grok_exporter': port => '9144' }
+  file { "${zulip::common::supervisor_conf_dir}/prometheus_grok_exporter.conf":
+    ensure  => file,
+    require => [
+      User[zulip],
+      Package[supervisor],
+      File[$bin],
+      File['/etc/grok_exporter.yaml'],
+    ],
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0644',
+    content => template('kandra/supervisor/conf.d/prometheus_grok_exporter.conf.template.erb'),
+    notify  => Service[supervisor],
+  }
+}

puppet/kandra/manifests/prometheus/memcached.pp

@@ -0,0 +1,39 @@
+# @summary Export memcached stats, with SASL auth
+#
+# We cannot use the stock
+# https://github.com/prometheus/memcached_exporter because it does not
+# support SASL auth, which we require.  Re-implement it in Python,
+# using bmemcached.
+class kandra::prometheus::memcached {
+  include kandra::prometheus::base
+  include zulip::supervisor
+
+  # We embed the hash of the contents into the name of the process, so
+  # that `supervisorctl reread` knows that it has updated.
+  $full_exporter_hash = sha256(file('kandra/memcached_exporter'))
+  $exporter_hash = $full_exporter_hash[0,8]
+
+  $bin = '/usr/local/bin/memcached_exporter'
+  file { $bin:
+    ensure => file,
+    owner  => 'root',
+    group  => 'root',
+    mode   => '0755',
+    source => 'puppet:///modules/kandra/memcached_exporter',
+  }
+
+  kandra::teleport::prometheus_app { 'memcached_exporter': port => '11212' }
+  file { "${zulip::common::supervisor_conf_dir}/memcached_exporter.conf":
+    ensure  => file,
+    require => [
+      User[zulip],
+      Package[supervisor],
+      File[$bin],
+    ],
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0644',
+    content => template('kandra/supervisor/conf.d/memcached_exporter.conf.template.erb'),
+    notify  => Service[supervisor],
+  }
+}

puppet/kandra/manifests/prometheus/node.pp

@@ -0,0 +1,33 @@
+# @summary Configures a node for monitoring with Prometheus
+#
+class kandra::prometheus::node {
+  include kandra::prometheus::base
+  include zulip::supervisor
+
+  $version = $zulip::common::versions['node_exporter']['version']
+  $dir = "/srv/zulip-node_exporter-${version}"
+  $bin = "${dir}/node_exporter"
+
+  zulip::external_dep { 'node_exporter':
+    version        => $version,
+    url            => "https://github.com/prometheus/node_exporter/releases/download/v${version}/node_exporter-${version}.linux-${zulip::common::goarch}.tar.gz",
+    tarball_prefix => "node_exporter-${version}.linux-${zulip::common::goarch}",
+    bin            => [$bin],
+    cleanup_after  => [Service[supervisor]],
+  }
+
+  kandra::teleport::prometheus_app { 'node_exporter': port => '9100' }
+  file { "${zulip::common::supervisor_conf_dir}/prometheus_node_exporter.conf":
+    ensure  => file,
+    require => [
+      User[zulip],
+      Package[supervisor],
+      File[$bin],
+    ],
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0644',
+    content => template('kandra/supervisor/conf.d/prometheus_node_exporter.conf.template.erb'),
+    notify  => Service[supervisor],
+  }
+}

puppet/kandra/manifests/prometheus/postgresql.pp

@@ -0,0 +1,83 @@
+# @summary Prometheus monitoring of postgresql servers
+#
+class kandra::prometheus::postgresql {
+  include kandra::prometheus::base
+  include zulip::supervisor
+  include zulip::golang
+
+  $version = $zulip::common::versions['postgres_exporter-src']['version']
+  $dir = "/srv/zulip-postgres_exporter-src-${version}"
+  $bin = "/usr/local/bin/postgres_exporter-${version}-go-${zulip::golang::version}"
+
+  # Binary builds: https://github.com/prometheus-community/postgres_exporter/releases/download/v${version}/postgres_exporter-${version}.linux-${zulip::common::goarch}.tar.gz
+
+  zulip::external_dep { 'postgres_exporter-src':
+    version        => $version,
+    url            => "https://github.com/alexmv/postgres_exporter/archive/${version}.tar.gz",
+    tarball_prefix => "postgres_exporter-${version}",
+  }
+
+  exec { 'compile postgres_exporter':
+    command     => "make build && cp ./postgres_exporter ${bin}",
+    cwd         => $dir,
+    # GOCACHE is required; nothing is written to GOPATH, but it is required to be set
+    environment => ['GOCACHE=/tmp/gocache', 'GOPATH=/root/go'],
+    path        => [
+      "${zulip::golang::dir}/bin",
+      '/usr/local/bin',
+      '/usr/bin',
+      '/bin',
+    ],
+    creates     => $bin,
+    require     => [
+      Zulip::External_Dep['golang'],
+      Zulip::External_Dep['postgres_exporter-src'],
+    ],
+    notify      => Exec['Cleanup postgres_exporter'],
+  }
+  # This resource is created by the 'compile postgres_exporter' step.
+  file { $bin:
+    ensure  => file,
+    require => Exec['compile postgres_exporter'],
+  }
+  exec { 'Cleanup postgres_exporter':
+    refreshonly => true,
+    provider    => shell,
+    onlyif      => "ls /usr/local/bin/postgres_exporter-* | grep -xv '${bin}'",
+    command     => "ls /usr/local/bin/postgres_exporter-* | grep -xv '${bin}' | xargs rm -r",
+    require     => [File[$bin], Service[supervisor]],
+  }
+
+  if false {
+    # This is left commented out, since it only makes sense to run
+    # against a server where the database exists and is writable --
+    # the former of which happens outside th scope of puppet right
+    # now, and the latter of which can only be determined after the
+    # database is in place.  Given that it has been run once, we do
+    # not expect to ever need it to run again; it is left here for
+    # completeness.
+    include zulip::postgresql_client
+    exec { 'create prometheus postgres user':
+      require => Class['zulip::postgresql_client'],
+      command => '/usr/bin/createuser -g pg_monitor prometheus',
+      unless  => 'test -f /usr/bin/psql && /usr/bin/psql -tAc "select usename from pg_user" | /bin/grep -xq prometheus)',
+      user    => 'postgres',
+      before  => File["${zulip::common::supervisor_conf_dir}/prometheus_postgres_exporter.conf"],
+    }
+  }
+
+  kandra::teleport::prometheus_app { 'postgres_exporter': port => '9187' }
+  file { "${zulip::common::supervisor_conf_dir}/prometheus_postgres_exporter.conf":
+    ensure  => file,
+    require => [
+      User[prometheus],
+      Package[supervisor],
+      File[$bin],
+    ],
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0644',
+    content => template('kandra/supervisor/conf.d/prometheus_postgres_exporter.conf.template.erb'),
+    notify  => Service[supervisor],
+  }
+}

puppet/kandra/manifests/prometheus/process.pp

@@ -0,0 +1,43 @@
+# @summary Prometheus monitoring of Zulip server processes
+#
+class kandra::prometheus::process {
+  include kandra::prometheus::base
+  include zulip::supervisor
+
+  $version = $zulip::common::versions['process_exporter']['version']
+  $dir = "/srv/zulip-process_exporter-${version}"
+  $bin = "${dir}/process-exporter"
+  $conf = '/etc/zulip/process_exporter.yaml'
+
+  zulip::external_dep { 'process_exporter':
+    version        => $version,
+    url            => "https://github.com/ncabatoff/process-exporter/releases/download/v${version}/process-exporter-${version}.linux-${zulip::common::goarch}.tar.gz",
+    tarball_prefix => "process-exporter-${version}.linux-${zulip::common::goarch}",
+    bin            => [$bin],
+    cleanup_after  => [Service[supervisor]],
+  }
+
+  kandra::teleport::prometheus_app { 'process_exporter': port => '9256' }
+  file { $conf:
+    ensure  => file,
+    require => User[zulip],
+    owner   => 'zulip',
+    group   => 'zulip',
+    mode    => '0644',
+    source  => 'puppet:///modules/kandra/process_exporter.yaml',
+  }
+  file { "${zulip::common::supervisor_conf_dir}/prometheus_process_exporter.conf":
+    ensure  => file,
+    require => [
+      User[zulip],
+      Package[supervisor],
+      File[$bin],
+      File[$conf],
+    ],
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0644',
+    content => template('kandra/supervisor/conf.d/prometheus_process_exporter.conf.template.erb'),
+    notify  => Service[supervisor],
+  }
+}

puppet/kandra/manifests/prometheus/pushgateway.pp

@@ -0,0 +1,32 @@
+# @summary Pushgateway for cron jobs
+#
+class kandra::prometheus::pushgateway {
+  include kandra::prometheus::base
+  include zulip::supervisor
+
+  $version = $zulip::common::versions['pushgateway']['version']
+  $dir = "/srv/zulip-pushgateway-${version}"
+  $bin = "${dir}/pushgateway"
+
+  zulip::external_dep { 'pushgateway':
+    version        => $version,
+    url            => "https://github.com/prometheus/pushgateway/releases/download/v${version}/pushgateway-${version}.linux-${zulip::common::goarch}.tar.gz",
+    tarball_prefix => "pushgateway-${version}.linux-${zulip::common::goarch}",
+    bin            => [$bin],
+    cleanup_after  => [Service[supervisor]],
+  }
+
+  file { "${zulip::common::supervisor_conf_dir}/prometheus_pushgateway.conf":
+    ensure  => file,
+    require => [
+      User[zulip],
+      Package[supervisor],
+      File[$bin],
+    ],
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0644',
+    content => template('kandra/supervisor/conf.d/prometheus_pushgateway.conf.template.erb'),
+    notify  => Service[supervisor],
+  }
+}

puppet/kandra/manifests/prometheus/rabbitmq.pp

@@ -0,0 +1,14 @@
+# @summary Prometheus monitoring of rabbitmq server.  This is done via
+# the built-in prometheus plugin which serves on port 15692:
+# https://www.rabbitmq.com/prometheus.html
+#
+class kandra::prometheus::rabbitmq {
+  include kandra::prometheus::base
+
+  exec { 'enable rabbitmq-prometheus':
+    command => 'rabbitmq-plugins enable rabbitmq_prometheus',
+    unless  => 'grep -q rabbitmq_prometheus /etc/rabbitmq/enabled_plugins',
+    require => Service['rabbitmq-server'],
+  }
+  kandra::teleport::prometheus_app { 'rabbitmq': port => '15692' }
+}

puppet/kandra/manifests/prometheus/redis.pp

@@ -0,0 +1,33 @@
+# @summary Prometheus monitoring of redis servers
+#
+class kandra::prometheus::redis {
+  include kandra::prometheus::base
+  include zulip::supervisor
+
+  $version = $zulip::common::versions['redis_exporter']['version']
+  $dir = "/srv/zulip-redis_exporter-${version}"
+  $bin = "${dir}/redis_exporter"
+
+  zulip::external_dep { 'redis_exporter':
+    version        => $version,
+    url            => "https://github.com/oliver006/redis_exporter/releases/download/v${version}/redis_exporter-v${version}.linux-${zulip::common::goarch}.tar.gz",
+    tarball_prefix => "redis_exporter-v${version}.linux-${zulip::common::goarch}",
+    bin            => [$bin],
+    cleanup_after  => [Service[supervisor]],
+  }
+
+  kandra::teleport::prometheus_app { 'redis_exporter': port => '9121' }
+  file { "${zulip::common::supervisor_conf_dir}/prometheus_redis_exporter.conf":
+    ensure  => file,
+    require => [
+      User[zulip],
+      Package[supervisor],
+      File[$bin],
+    ],
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0644',
+    content => template('kandra/supervisor/conf.d/prometheus_redis_exporter.conf.template.erb'),
+    notify  => Service[supervisor],
+  }
+}

puppet/kandra/manifests/prometheus/uwsgi.pp

@@ -0,0 +1,33 @@
+# @summary Prometheus monitoring of uwsgi servers
+#
+class kandra::prometheus::uwsgi {
+  include kandra::prometheus::base
+  include zulip::supervisor
+
+  $version = $zulip::common::versions['uwsgi_exporter']['version']
+  $dir = "/srv/zulip-uwsgi_exporter-${version}"
+  $bin = "${dir}/uwsgi_exporter"
+
+  zulip::external_dep { 'uwsgi_exporter':
+    version        => $version,
+    url            => "https://github.com/timonwong/uwsgi_exporter/releases/download/v${version}/uwsgi_exporter-${version}.linux-${zulip::common::goarch}.tar.gz",
+    tarball_prefix => "uwsgi_exporter-${version}.linux-${zulip::common::goarch}",
+    bin            => [$bin],
+    cleanup_after  => [Service[supervisor]],
+  }
+
+  kandra::teleport::prometheus_app { 'uwsgi_exporter': port => '9238' }
+  file { "${zulip::common::supervisor_conf_dir}/prometheus_uwsgi_exporter.conf":
+    ensure  => file,
+    require => [
+      User[zulip],
+      Package[supervisor],
+      File[$bin],
+    ],
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0644',
+    content => template('kandra/supervisor/conf.d/prometheus_uwsgi_exporter.conf.template.erb'),
+    notify  => Service[supervisor],
+  }
+}

puppet/kandra/manifests/prometheus/wal_g.pp

@@ -0,0 +1,34 @@
+# @summary Prometheus monitoring of wal-g backups
+#
+class kandra::prometheus::wal_g {
+  include kandra::prometheus::base
+  include zulip::supervisor
+  include zulip::wal_g
+
+  file { '/usr/local/bin/wal-g-exporter':
+    ensure  => file,
+    require => User[zulip],
+    owner   => 'zulip',
+    group   => 'zulip',
+    mode    => '0755',
+    source  => 'puppet:///modules/zulip/postgresql/wal-g-exporter',
+  }
+
+  # We embed the hash of the contents into the name of the process, so
+  # that `supervisorctl reread` knows that it has updated.
+  $full_exporter_hash = sha256(file('zulip/postgresql/wal-g-exporter'))
+  $exporter_hash = $full_exporter_hash[0,8]
+  file { "${zulip::common::supervisor_conf_dir}/prometheus_wal_g_exporter.conf":
+    ensure  => file,
+    require => [
+      User[zulip],
+      Package[supervisor],
+      File['/usr/local/bin/wal-g-exporter'],
+    ],
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0644',
+    content => template('kandra/supervisor/conf.d/prometheus_wal_g_exporter.conf.template.erb'),
+    notify  => Service[supervisor],
+  }
+}

puppet/kandra/manifests/prometheus/weblate.pp

@@ -0,0 +1,40 @@
+# @summary Export Weblate translation stats
+class kandra::prometheus::weblate {
+  include kandra::prometheus::base
+  include zulip::supervisor
+
+  # We embed the hash of the contents into the name of the process, so
+  # that `supervisorctl reread` knows that it has updated.
+  $full_exporter_hash = sha256(file('kandra/weblate_exporter'))
+  $exporter_hash = $full_exporter_hash[0,8]
+
+  $bin = '/usr/local/bin/weblate_exporter'
+  file { $bin:
+    ensure => file,
+    owner  => 'root',
+    group  => 'root',
+    mode   => '0755',
+    source => 'puppet:///modules/kandra/weblate_exporter',
+  }
+
+  file { "${zulip::common::supervisor_conf_dir}/weblate_exporter.conf":
+    ensure  => file,
+    require => [
+      User[zulip],
+      Package[supervisor],
+      File[$bin],
+    ],
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0644',
+    content => template('kandra/supervisor/conf.d/weblate_exporter.conf.template.erb'),
+    notify  => Service[supervisor],
+  }
+
+  include kandra::prometheus::pushgateway
+  zulip::cron { 'weblate-to-pushgateway':
+    minute    => '*/15',
+    command   => 'curl http://localhost:9189/metrics | curl --data-binary @- http://localhost:9091/metrics/job/weblate',
+    use_proxy => false,
+  }
+}