fix: address Grafana Alloy review findings

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: thiras

ansible/Makefile

@@ -122,7 +122,7 @@ molecule-serial: deps
 
 # --- Galaxy collection (decdn.node) ------------------------------------------
 # Stage baseline + decdn_node into a clean collection tree and build the artifact
-# under build/. Only those two roles ship; see galaxy/README.md. Publishing stays
+# under build/. Only the three deployment roles ship; see galaxy/README.md. Publishing stays
 # a manual step (ansible-galaxy collection publish build/decdn-node-*.tar.gz).
 build:
 	./galaxy/build.sh

ansible/galaxy/README.md

@@ -2,12 +2,13 @@
 
 Deploy and harden a **public [deCDN](https://decdn.org) node**. This collection is
 the public, reusable slice of the [`decdn/devops`](https://github.com/decdn/devops)
-repository — two roles and nothing else:
+repository — three roles and nothing else:
 
 | Role | Purpose |
 |------|---------|
 | `decdn.node.baseline` | Debian host baseline — nftables default-deny inbound, fail2ban, unattended-upgrades, chrony, an admin sudo user, then DevSec OS + SSH hardening (applied last). |
 | `decdn.node.decdn_node` | The `decdn-node` daemon — installed from a pinned GitHub Release tarball under a hardened systemd unit; public QUIC udp/4433, loopback metrics + admin RPC. |
+| `decdn.node.grafana_alloy` | Opt-in Grafana Cloud observability agent — loopback-only Alloy receiver and hardened telemetry export. |
 
 ## Requirements
 
@@ -60,6 +61,7 @@ full variable list, the eth-keystore prerequisite, and day-2 ops:
 
 - [`roles/baseline`](https://github.com/decdn/devops/tree/main/ansible/roles/baseline)
 - [`roles/decdn_node`](https://github.com/decdn/devops/tree/main/ansible/roles/decdn_node)
+- [`roles/grafana_alloy`](https://github.com/decdn/devops/tree/main/ansible/roles/grafana_alloy)
 
 ## Security model
 

ansible/galaxy/build.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # Stage and build the public `decdn.node` Galaxy collection.
 #
-# Only the roles/baseline + roles/decdn_node sources ship. All deploy machinery
+# Only the roles/baseline, roles/decdn_node, and roles/grafana_alloy sources ship. All deploy machinery
 # (inventory, Makefile, ansible.cfg) is excluded BY CONSTRUCTION — it is simply
 # never copied into the staging tree. This keeps the artifact clean and leaves the
 # internal project untouched (no galaxy.yml at the project root, so ansible-lint

ansible/inventory/group_vars/decdn_nodes.yml

@@ -17,5 +17,5 @@ baseline_extra_inbound:
 # credential file on each host — see roles/grafana_alloy/files/grafana-alloy.env.example:
 #
 # decdn_grafana_cloud_enabled: true
-# grafana_alloy_region: ""              # e.g. "US" — same value as decdn_region
+# grafana_alloy_region: "{{ decdn_region }}"  # override only when needed
 # grafana_alloy_deployment_environment: production

ansible/molecule/default/converge.yml

@@ -118,4 +118,6 @@
         name: baseline
         tasks_from: sudo_users
   roles:
+    - role: grafana_alloy
+      tags: [observability, decdn_node, node]
     - role: decdn_node

ansible/molecule/grafana-cloud/verify.yml

@@ -60,7 +60,7 @@
           # ratio 0.25 -> percentage 25; batch size overrides pass through; labels
           # dotted AND set-variable ones present; secrets remain ${...} placeholders.
           - >-
-            'sampling_percentage = 25' in ga_config
+            'sampling_percentage = 25.0' in ga_config
           - >-
             'send_batch_size     = 512' in ga_config
           - >-

ansible/playbooks/site.yml

@@ -14,6 +14,6 @@
     # flag drives this + the otlp_endpoint injection inside decdn_node). Runs
     # BEFORE decdn_node so Alloy's receivers exist before the daemon exports.
     - role: grafana_alloy
-      tags: [observability]
+      tags: [observability, decdn_node, node]
     - role: decdn_node
       tags: [decdn_node, node]

ansible/roles/grafana_alloy/README.md

@@ -8,7 +8,7 @@ loopback-only [Grafana Alloy](https://grafana.com/docs/alloy/) agent that
   and pushes it to your Grafana Cloud Prometheus, stamped with low-cardinality
   identity labels, and
 - receives the daemon's OTLP span exports (`otlp_endpoint`) on gRPC `127.0.0.1:4317`
-  and HTTP `127.0.0.1:4318`, parent-based samples traces (default keep-ratio 0.25),
+  and HTTP `127.0.0.1:4318`, probabilistically samples traces (default keep-ratio 0.25),
   batches them, and exports via OTLP/HTTP to your Grafana Cloud org.
 
 The Helm-chart path is separate and deliberately untouched by this role.
@@ -52,9 +52,8 @@ upstream version/sha256). Highlights:
 | `grafana_alloy_install_method` | `release` | `manual` copies a control-machine binary (CI stubs) |
 | `grafana_alloy_version` / `grafana_alloy_sha256` | pin | Bump together from upstream release digests |
 | `grafana_alloy_trace_sampling_ratio` | `0.25` | Trace keep-ratio, validated to `[0,1]` |
-| `grafana_alloy_scrape_target` | `127.0.0.1:9090` | Must mirror `decdn_metrics_port`'s default |
 | `grafana_alloy_otlp_grpc_port` | `4317` | Hard-coupled to the literal emitted into node.toml |
-| `grafana_alloy_region` | `""` | Set = your `decdn_region`; empty omits the attribute |
+| `grafana_alloy_region` | `decdn_region` | Required identity attribute; derived from the node region |
 
 Label variables (`service_name`, `service_namespace`, `instance_id`,
 `deployment_environment`, `region`) ship on EVERY series/span/log line — keep
@@ -66,8 +65,8 @@ spans, and no per-request/per-hash label values.
 
 Two couplings between roles are pinned by constants plus molecule assertions:
 
-1. This role's `prometheus.scrape` targets `127.0.0.1:9090` — the
-   `decdn_metrics_port` default.
+1. This role's `prometheus.scrape` targets `127.0.0.1:<decdn_metrics_port>`, using
+   the node role's configured metrics port directly.
 2. `decdn_node` injects `otlp_endpoint = "http://127.0.0.1:4317"` when the flag
    flips on — the port constant here.
 

ansible/roles/grafana_alloy/defaults/main.yml

@@ -49,11 +49,6 @@ grafana_alloy_server_http_addr: 127.0.0.1:12345
 grafana_alloy_server_grpc_addr: 127.0.0.1:12347
 
 # --- Metrics scrape (node /metrics -> Grafana Cloud Prometheus) ---------------
-# COUPLING: mirrors decdn_metrics_port's DEFAULT (9090) in roles/decdn_node.
-# Kept a plain constant here because cross-role vars are fragile; the molecule
-# suite guards the drift — if you move decdn_metrics_port off 9090, set
-# grafana_alloy_scrape_target on the same inventory level.
-grafana_alloy_scrape_target: 127.0.0.1:9090
 grafana_alloy_scrape_interval: 30s
 
 # --- Resource identity labels (low-cardinality only!) --------------------------
@@ -64,11 +59,11 @@ grafana_alloy_scrape_interval: 30s
 grafana_alloy_service_name: decdn-node
 grafana_alloy_service_namespace: decdn
 grafana_alloy_instance_id: ""            # "" => derive from inventory_hostname
-grafana_alloy_deployment_environment: ""  # "" => attribute omitted entirely
-grafana_alloy_region: ""                  # operator sets it = decdn_region ("" => omitted)
+grafana_alloy_deployment_environment: production
+grafana_alloy_region: "{{ decdn_region | default('') }}"
 
 # --- Pipeline tuning ------------------------------------------------------------
-# Parent-based probabilistic sampler for TRACES, expressed as the 0..1 keep-ratio
+# Probabilistic sampler for TRACES, expressed as the 0..1 keep-ratio
 # the deCDN issue settled on (0.25 == keep ~25% of spans); converted to the
 # component's percentage internally. Validated at preflight.
 grafana_alloy_trace_sampling_ratio: 0.25

ansible/roles/grafana_alloy/tasks/install.yml

@@ -42,7 +42,9 @@
 - name: Decide whether (re)install is needed
   ansible.builtin.set_fact:
     _ga_need_install: "{{ (_ga_dpkg_version.rc | default(1)) != 0
-                          or (grafana_alloy_version not in (_ga_dpkg_version.stdout | default(''))) }}"
+                          or (_ga_dpkg_version.stdout | trim)
+                             not in [grafana_alloy_version,
+                                     grafana_alloy_version ~ '-1'] }}"
   when:
     - grafana_alloy_install_method == "release"
     - not ansible_check_mode
@@ -132,7 +134,9 @@
   ansible.builtin.command: "{{ grafana_alloy_bin_effective }} --version"
   changed_when: false
   register: _ga_installed_version
+  when: not ansible_check_mode
   failed_when: >-
     _ga_installed_version.rc != 0
     or (grafana_alloy_install_method == "release"
-        and grafana_alloy_version not in _ga_installed_version.stdout)
+        and not (_ga_installed_version.stdout
+                 | regex_search('(^|[^0-9])v?' ~ (grafana_alloy_version | regex_escape) ~ '([^0-9]|$)')))