infra-nimbus/ansible/group_vars/log-store.yml

---
# CloudFlare Origin certificates
origin_certs:
  - domain: 'status.im'
    crt: '{{lookup("bitwarden", "Cloudflare/status.im", file="origin.crt")}}'
    key: '{{lookup("bitwarden", "Cloudflare/status.im", file="origin.key")}}'
    default: true

# Syncing can use a lot of mamory
swap_file_path: '/main.swap'
swap_file_size_mb: 2048

# ElasticSearch Cluster
es_master_nodes: |
  {{ ansible_play_hosts
   | map('extract', hostvars)
   | list
   | json_query(
   '[].{
     name: hostname,
     addr: ansible_local.wireguard.vpn_ip,
     port: to_string(es_node_port)
   }') }}
es_cluster_name: 'nimbus-logs-search'
es_cont_name: 'elasticsearch'

es_image: 'elasticsearch:7.14.2'
es_api_port: 9200
es_node_port: 9300

# Since Logstash stores 1 index per day this is fine
# See: https://www.elastic.co/blog/how-many-shards-should-i-have-in-my-elasticsearch-cluster
es_number_of_replicas: 1
es_number_of_shards: 3

# JVM memory settings
es_jvm_mem_ratio: 0.6
es_jvm_mem: '{{ (ansible_memtotal_mb * es_jvm_mem_ratio) | round(0, "floor") }}'
es_jvm_min_heap: '{{ es_jvm_mem | int }}m'
es_jvm_max_heap: '{{ es_jvm_mem | int }}m'

# ElasticSearch HQ
es_hq_lb_cont_name: '{{ es_cont_name }}'

# oauth access
oauth_domain: 'nimbus-es.infra.status.im'
oauth_cont_name: '{{ es_hq_cont_name }}-oauth'
oauth_upstream_cont: '{{ es_hq_cont_name }}'
oauth_upstream_port: '{{ es_hq_cont_port }}'
oauth_public_port: 443
oauth_local_port: 8090
oauth_cookie_secret: '{{ lookup("bitwarden", "cookie-secret", field="secret") }}'
oauth_id: '{{ lookup("bitwarden", "nimbus/elastic-hq/oauth", field="client-id") }}'
oauth_secret: '{{ lookup("bitwarden", "nimbus/elastic-hq/oauth", field="secret") }}'

# Open Ports
open_ports_default_comment: 'ElasticSearch'
open_ports_default_chain: 'VPN'
open_ports_list:
  - { port: 80,  protocol: 'tcp', chain: 'SERVICES' }
  - { port: 443, protocol: 'tcp', chain: 'SERVICES' }
  - { port: '{{ es_api_port }}',          ipset: 'log-store.nimbus' }
  - { port: '{{ es_api_port  }}',         ipset: 'dash.nimbus' }
  - { port: '{{ es_api_port  }}',         ipset: 'log-aggr.hq' }
  - { port: '{{ es_node_port }}',         ipset: 'log-store.nimbus' }
  - { port: '{{ es_node_port }}',         ipset: 'dash.nimbus' }
  - { port: '{{ es_metrics_cont_port }}', ipset: 'metrics.hq' }

# Proxy for ES HQ
nginx_sites:
  elasticsearch_hq_http:
    - listen 80
    - server_name {{ oauth_domain }}
    - return 302 https://$server_name$request_uri
  elasticsearch_hq_https:
    - listen 80
    - listen 443 ssl

    - server_name {{ oauth_domain }}

    - ssl_certificate     /certs/status.im/origin.crt
    - ssl_certificate_key /certs/status.im/origin.key

    - location / {
        proxy_set_header Host $host;
        proxy_pass http://127.0.0.1:{{ oauth_local_port }}/;
      }