feat: InfluxDB/Grafana/Telegraf support, multi-OS fixes, CI improvements#3
Merged
Conversation
…o false Reorganised README: installation/verification/update/managing at the top, configuration/SSL/backup/status/manual-setup in the middle, and testing (Docker + CI) at the end. Added Docker local testing section and CI matrix table. Simulator install and autostart now default to false — users who want the NBP1406 test data simulator opt in explicitly. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds influxdb.yml playbook and supporting roles to install and configure the InfluxDB v2 observability stack (InfluxDB, Grafana, Telegraf) with optional OpenRVDAS settings.py integration. Key design decisions: - standalone_influx auto-detected: installs supervisord only on hosts not already running OpenRVDAS - InfluxDB setup via HTTP API POST /api/v2/setup (fully idempotent) - User-supplied token from vault; no fragile CLI token parsing - Single combined supervisor conf (influx.conf.j2) covers all three services with Jinja2 conditionals and [group:influx] - Grafana admin password via GF_SECURITY_ADMIN_PASSWORD env var - Version-branched task structure (setup_v2.yml, setup_v3.yml stub) ready for future InfluxDB v3 support - Interactive configure_and_install_influxdb.sh installer following same pattern as configure_and_install.sh Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Tests the 'localhost' install path where Ansible runs on the same machine being configured, using real sudo become rather than the Docker sudo shim. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…l test Quoted "false" is a truthy string in Ansible; unquoted false is the boolean the when: conditional expects. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…re_and_install Fix ./configure_and_install.sh on MacOS
If Ansible can connect to run the playbook, sshd is already installed and running. Including it causes apt to attempt an upgrade mid-play, and openssh-server's post-install script fails when it tries to restart sshd via systemctl on some machines (VPS, restricted systemd etc.). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
If a previous run left a package half-configured (e.g. openssh-server failing its post-install systemctl restart), every subsequent apt-get invocation fails with 'Sub-process dpkg returned error code 1'. Run dpkg --configure -a behind a policy-rc.d guard (prevents service start/restart scripts from running) to clear the broken state before any package installation tasks. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Unquoted values in the secrets heredoc break YAML parsing when
passwords or tokens contain special characters (: # { } [ ]).
Replace heredoc with a Python writer that wraps all values in YAML
single quotes (doubling any embedded single quotes), which is safe
for any string content.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Stale copy of python_bin_for_os still had python3.9, which doesn't exist on Ubuntu 22.04/24.04 without deadsnakes. The influxdb playbook doesn't need a specific Python minor version. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Use current InfluxData GPG key (influxdata-archive.key) with fingerprint verification and /etc/apt/keyrings/ keyring path - Validate InfluxDB admin password is 8-72 characters in installer - Offer to auto-generate API token via openssl rand in installer - Fix 'influxd_pid.stdout' reference when temp influxd block is skipped - Fix supervisord reload handler using shell instead of command for && - Ensure database/influxdb/__init__.py exists so Python import succeeds - Fix influxdb_openrvdas restart handler to reread/update before restart Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Prompt for rvdas Linux system user password in installer; store in vault
- Apply password to rvdas user via password_hash('sha512') in Ansible role
- Fix vault read-back using yaml.safe_load instead of awk/sed to prevent
YAML single-quote wrapping from compounding on each re-run
- Preserve rvdas_user_password when influxdb installer merges secrets
- Fix Django superuser creation to use createsuperuser --noinput with
DJANGO_SUPERUSER_PASSWORD env var (avoids quoting/indentation errors)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…s in CI createsuperuser --noinput runs password validation and rejects 'changeme' (common password). Revert to calling User.objects.create_superuser() directly via manage.py shell with env vars — bypasses validators, safe for any password. Also add rvdas_user_password to secrets.yml.example to avoid undefined var. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Alex/fix hosts ini
RHEL-family already had wheel in rvdas_groups; add sudo for Debian-family so rvdas can run privileged commands after install. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add retries=3/delay=15 to both apt-get install tasks so flaky connections to Ubuntu package mirrors don't fail the run. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Upstream dev branch removed all sys.path.append() calls in favour of proper packaging (pyproject.toml, #544/#545). Without pip install -e ., supervised processes (logger_manager, cached_data_server, uWSGI, etc.) fail on import because the openrvdas subpackages are not on sys.path. Mirror what install_openrvdas.sh does: stat-guard the step so it is a no-op on the master branch where pyproject.toml does not yet exist. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR brings
devup to date withmain, encompassing all work since the initial project setup. The changes fall into four areas:New features
feat: add InfluxDB/Grafana/Telegraf installation roles and playbook)rvdasuser added tosudogroup on Debian/Ubuntu/Raspbian to support post-install management tasksBug fixes
/usr/bin/python3)pip install -e) when apyproject.tomlis present;create_superuser()shell workaround to bypass Django password validators in CIrvdassystem user password set correctly; vault read-back quoting fixeddpkgstate before apt operations; retryapt-get installon transient network failures; removeopenssh-serverfrom package lists (caused conflicts)configure_and_install.sh— macOS compatibility fixes; sudo handling corrected (Ubuntu localhost only); removedRUN_ANSIBLE_VIA_SUDOflagCI
ansible_connection=localon a Linux GitHub Actions runner)use_deadsnakeswritten as boolean (not quoted string) in CI test matrixDocs
install_simulate_nbp/run_simulate_nbpset tofalseinstall_openrvdas.shTest plan
configure_and_install.shagainst a fresh Ubuntu/Debian host and verify OpenRVDAS + InfluxDB stack comes up cleanlychanged🤖 Generated with Claude Code