initial scaffold: Meridian LXC (Node 22 + npm @rynfar/meridian + systemd)

Deploys @rynfar/meridian on a Debian 12 LXC, bound to 0.0.0.0:3456. OAuth credentials transferred manually after first deploy (claude login on Mac, scp ~/.claude to /opt/meridian/.claude). systemd unit is enabled but gated on credentials.json existence so the first deploy doesn't crash-loop. LXC has no auth layer — security model is LAN-only reachability. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-17 21:20:41 -04:00
parent 94fad75007
commit 5e16fee73b
12 changed files with 537 additions and 1 deletions
@@ -0,0 +1,120 @@
+---
+- name: Check if node_exporter is installed
+  stat:
+    path: /usr/local/bin/node_exporter
+  register: ne_bin
+
+- name: Set architecture
+  set_fact:
+    ne_arch: "{{ 'arm64' if ansible_architecture == 'aarch64' else 'amd64' }}"
+
+- name: Get latest node_exporter version
+  uri:
+    url: https://api.github.com/repos/prometheus/node_exporter/releases/latest
+    return_content: yes
+  register: ne_release
+  when: not ne_bin.stat.exists
+
+- name: Set node_exporter version
+  set_fact:
+    ne_version: "{{ ne_release.json.tag_name | regex_replace('^v', '') }}"
+  when: not ne_bin.stat.exists
+
+- name: Download node_exporter
+  get_url:
+    url: "https://github.com/prometheus/node_exporter/releases/download/v{{ ne_version }}/node_exporter-{{ ne_version }}.linux-{{ ne_arch }}.tar.gz"
+    dest: /tmp/node_exporter.tar.gz
+  when: not ne_bin.stat.exists
+
+- name: Extract node_exporter
+  unarchive:
+    src: /tmp/node_exporter.tar.gz
+    dest: /tmp/
+    remote_src: yes
+  when: not ne_bin.stat.exists
+
+- name: Install node_exporter binary
+  copy:
+    src: "/tmp/node_exporter-{{ ne_version }}.linux-{{ ne_arch }}/node_exporter"
+    dest: /usr/local/bin/node_exporter
+    owner: root
+    group: root
+    mode: '0755'
+    remote_src: yes
+  when: not ne_bin.stat.exists
+  notify: restart node_exporter
+
+- name: Create node_exporter user
+  user:
+    name: node_exporter
+    system: yes
+    shell: /usr/sbin/nologin
+    create_home: no
+
+- name: Deploy node_exporter systemd service
+  copy:
+    content: |
+      [Unit]
+      Description=Prometheus Node Exporter
+      After=network-online.target
+      Wants=network-online.target
+
+      [Service]
+      User=node_exporter
+      Group=node_exporter
+      Type=simple
+      ExecStart=/usr/local/bin/node_exporter --collector.textfile.directory=/var/lib/node_exporter/textfile
+      Restart=on-failure
+      RestartSec=5
+
+      [Install]
+      WantedBy=multi-user.target
+    dest: /etc/systemd/system/node_exporter.service
+    owner: root
+    group: root
+    mode: '0644'
+  notify: restart node_exporter
+
+- name: Create textfile collector directory
+  file:
+    path: /var/lib/node_exporter/textfile
+    state: directory
+    owner: node_exporter
+    group: node_exporter
+    mode: '0755'
+
+- name: Deploy CPU temperature collector script
+  copy:
+    content: |
+      #!/bin/bash
+      TEMP=$(vcgencmd measure_temp 2>/dev/null | grep -oP '[0-9.]+')
+      if [ -n "$TEMP" ]; then
+        echo "# HELP node_cpu_temperature_celsius CPU temperature from vcgencmd"
+        echo "# TYPE node_cpu_temperature_celsius gauge"
+        echo "node_cpu_temperature_celsius $TEMP"
+      fi > /var/lib/node_exporter/textfile/cpu_temp.prom
+    dest: /usr/local/bin/collect-cpu-temp.sh
+    mode: '0755'
+
+- name: Schedule CPU temperature collection (every minute)
+  cron:
+    name: "node_exporter cpu temp"
+    user: node_exporter
+    job: "/usr/local/bin/collect-cpu-temp.sh"
+
+- name: Run initial temperature collection
+  command: /usr/local/bin/collect-cpu-temp.sh
+  changed_when: false
+
+- name: Enable and start node_exporter
+  systemd:
+    name: node_exporter
+    enabled: yes
+    state: started
+    daemon_reload: yes
+
+- name: Clean up download
+  file:
+    path: /tmp/node_exporter.tar.gz
+    state: absent
+  when: not ne_bin.stat.exists