Ebook Syafi - Edit Bab

Tajuk Bab

Urutan

Jenis

Kandungan HTML

<h1 id="bab-10-automasi-lanjutan-dan-cicd">Bab 10: Automasi Lanjutan dan CI/CD</h1>
Kalau anda dah sampai bab ni, tahniah — anda dah melepasi tahap beginner! Bab ini adalah untuk anda yang dah selesa dengan Ansible asas dan monitoring, dan nak naik satu level lagi.
Kita akan belajar tentang CI/CD (Continuous Integration/Continuous Deployment), Ansible Roles yang lebih teratur, skrip penyelenggaraan automatik, dan cara buat dokumentasi yang generate sendiri. Ini bukan benda wajib untuk homelab, tapi percayalah — bila anda dah biasa, anda tak akan mahu balik ke cara lama.
Apa yang anda akan belajar:
<ul>
<li>Cara setup CI/CD dengan Gitea Actions dalam homelab</li>
<li>Ansible Roles untuk pengurusan konfigurasi yang lebih kemas</li>
<li>Skrip automasi penyelenggaraan mingguan</li>
<li>Pemantauan lanjutan dengan Grafana</li>
<li>Strategi pemberitahuan pintar supaya anda tak kena alert fatigue</li>
</ul>
<blockquote>
Nota Beginner: Bab ini ialah upgrade kepada asas yang sudah stabil. Kalau anda masih baru dengan Docker atau Ansible, tak mengapa untuk tangguhkan bahagian ini dahulu. Balik bila anda dah selesa dengan bab-bab sebelumnya.
</blockquote>
<h3 id="laluan-paling-mudah-untuk-beginner">Laluan Paling Mudah untuk Beginner</h3>
<ul>
<li>Bina satu Workflow deploy yang paling ringkas terlebih dahulu. Jangan terus buat pipeline 10 langkah.</li>
<li>Pastikan proses manual anda stabil sebelum diubah menjadi CI/CD. Kalau buat manual pun masih gagal, automate pun akan gagal.</li>
<li>Untuk beginner, objektif utama ialah kebolehulangan (repeatability), bukan pipeline yang canggih.</li>
</ul>
<h2 id="langkah-1-gitea-actions-cicd-dalam-homelab">Langkah 1: Gitea Actions — CI/CD dalam Homelab</h2>
Kalau anda pernah guna GitHub Actions, Gitea Actions akan terasa sangat familiar. Bezanya, semua berjalan dalam homelab anda sendiri. Tiada bergantung pada cloud, tiada limit minutes.
Bayangkan: anda push code ke Gitea, dan secara automatik, code tu dibina, diuji, dan di-deploy ke server anda. Semua tanpa anda perlu SSH manual.
<figure><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 840 460" width="840" height="460">
 <defs>
 <linearGradient id="cf-bg" x1="0%" y1="0%" x2="100%" y2="100%">
 <stop offset="0%" style="stop-color:#f8fafc"/>
 <stop offset="100%" style="stop-color:#f0fdf4"/>
 </linearGradient>
 <filter id="cf-shadow">
 <feDropShadow dx="0" dy="7" stdDeviation="9" flood-color="#0f172a" flood-opacity="0.12"/>
 </filter>
 </defs>

<rect width="840" height="460" rx="18" fill="url(#cf-bg)"/>
 <text x="420" y="36" font-family="Arial, Helvetica, sans-serif" font-size="20" font-weight="bold" fill="#1e293b" text-anchor="middle">Aliran CI/CD dan Automasi Homelab</text>
 <text x="420" y="58" font-family="Arial, Helvetica, sans-serif" font-size="11" fill="#64748b" text-anchor="middle">Satu pipeline untuk deploy aplikasi, satu lagi untuk backup dan penyelenggaraan berkala</text>

<g filter="url(#cf-shadow)">
 <rect x="40" y="110" width="120" height="90" rx="16" fill="#2563eb"/>
 <text x="100" y="143" font-family="Arial, Helvetica, sans-serif" font-size="16" font-weight="bold" fill="#ffffff" text-anchor="middle">Developer</text>
 <text x="100" y="165" font-family="Arial, Helvetica, sans-serif" font-size="11" fill="#dbeafe" text-anchor="middle">Push ke branch</text>
 <text x="100" y="182" font-family="Arial, Helvetica, sans-serif" font-size="11" fill="#dbeafe" text-anchor="middle">`main`</text>
 </g>

<g filter="url(#cf-shadow)">
 <rect x="205" y="110" width="120" height="90" rx="16" fill="#0f766e"/>
 <text x="265" y="143" font-family="Arial, Helvetica, sans-serif" font-size="16" font-weight="bold" fill="#ffffff" text-anchor="middle">Gitea</text>
 <text x="265" y="165" font-family="Arial, Helvetica, sans-serif" font-size="11" fill="#ccfbf1" text-anchor="middle">Repo dan webhook</text>
 <text x="265" y="182" font-family="Arial, Helvetica, sans-serif" font-size="11" fill="#ccfbf1" text-anchor="middle">Actions trigger</text>
 </g>

<g filter="url(#cf-shadow)">
 <rect x="370" y="110" width="120" height="90" rx="16" fill="#7c3aed"/>
 <text x="430" y="143" font-family="Arial, Helvetica, sans-serif" font-size="16" font-weight="bold" fill="#ffffff" text-anchor="middle">Runner</text>
 <text x="430" y="165" font-family="Arial, Helvetica, sans-serif" font-size="11" fill="#ede9fe" text-anchor="middle">Build image</text>
 <text x="430" y="182" font-family="Arial, Helvetica, sans-serif" font-size="11" fill="#ede9fe" text-anchor="middle">Test dan lint</text>
 </g>

<g filter="url(#cf-shadow)">
 <rect x="535" y="110" width="120" height="90" rx="16" fill="#ea580c"/>
 <text x="595" y="143" font-family="Arial, Helvetica, sans-serif" font-size="16" font-weight="bold" fill="#ffffff" text-anchor="middle">Docker Host</text>
 <text x="595" y="165" font-family="Arial, Helvetica, sans-serif" font-size="11" fill="#ffedd5" text-anchor="middle">`docker compose up -d`</text>
 <text x="595" y="182" font-family="Arial, Helvetica, sans-serif" font-size="11" fill="#ffedd5" text-anchor="middle">Deploy aplikasi</text>
 </g>

<g filter="url(#cf-shadow)">
 <rect x="700" y="110" width="110" height="90" rx="16" fill="#334155"/>
 <text x="755" y="143" font-family="Arial, Helvetica, sans-serif" font-size="16" font-weight="bold" fill="#ffffff" text-anchor="middle">Ntfy + Grafana</text>
 <text x="755" y="165" font-family="Arial, Helvetica, sans-serif" font-size="11" fill="#cbd5e1" text-anchor="middle">Status deploy</text>
 <text x="755" y="182" font-family="Arial, Helvetica, sans-serif" font-size="11" fill="#cbd5e1" text-anchor="middle">Amaran dan anotasi</text>
 </g>

<g filter="url(#cf-shadow)">
 <rect x="205" y="280" width="120" height="82" rx="16" fill="#1d4ed8"/>
 <text x="265" y="310" font-family="Arial, Helvetica, sans-serif" font-size="15" font-weight="bold" fill="#ffffff" text-anchor="middle">Workflow Backup</text>
 <text x="265" y="330" font-family="Arial, Helvetica, sans-serif" font-size="11" fill="#dbeafe" text-anchor="middle">Jadual `cron` harian</text>
 <text x="265" y="347" font-family="Arial, Helvetica, sans-serif" font-size="11" fill="#dbeafe" text-anchor="middle">Dump DB + archive</text>
 </g>

<g filter="url(#cf-shadow)">
 <rect x="380" y="280" width="120" height="82" rx="16" fill="#059669"/>
 <text x="440" y="310" font-family="Arial, Helvetica, sans-serif" font-size="15" font-weight="bold" fill="#ffffff" text-anchor="middle">NAS / Backup</text>
 <text x="440" y="330" font-family="Arial, Helvetica, sans-serif" font-size="11" fill="#d1fae5" text-anchor="middle">rsync dan retention</text>
 <text x="440" y="347" font-family="Arial, Helvetica, sans-serif" font-size="11" fill="#d1fae5" text-anchor="middle">Repositori sandaran</text>
 </g>

<g filter="url(#cf-shadow)">
 <rect x="560" y="280" width="140" height="82" rx="16" fill="#a16207"/>
 <text x="630" y="310" font-family="Arial, Helvetica, sans-serif" font-size="15" font-weight="bold" fill="#ffffff" text-anchor="middle">Penyelenggaraan</text>
 <text x="630" y="330" font-family="Arial, Helvetica, sans-serif" font-size="11" fill="#fef3c7" text-anchor="middle">Update sistem, log,</text>
 <text x="630" y="347" font-family="Arial, Helvetica, sans-serif" font-size="11" fill="#fef3c7" text-anchor="middle">semak disk dan ZFS</text>
 </g>

<text x="420" y="248" font-family="Arial, Helvetica, sans-serif" font-size="13" font-weight="bold" fill="#334155" text-anchor="middle">Laluan deploy berterusan</text>
 <text x="420" y="395" font-family="Arial, Helvetica, sans-serif" font-size="13" font-weight="bold" fill="#334155" text-anchor="middle">Laluan operasi berkala dan backup</text>
</svg>
<figcaption>Aliran CI/CD dan Automasi Homelab</figcaption></figure>
<h3 id="menyediakan-gitea-runner">Menyediakan Gitea Runner</h3>
<div class="sourceCode" id="cb1"><pre class="sourceCode yaml"><code class="sourceCode yaml"><a href="#cb1-1" aria-hidden="true" tabindex="-1"></a># docker-compose.yml - Gitea dengan Runner
<a href="#cb1-2" aria-hidden="true" tabindex="-1"></a>services:
<a href="#cb1-3" aria-hidden="true" tabindex="-1"></a> gitea:
<a href="#cb1-4" aria-hidden="true" tabindex="-1"></a> image: gitea/gitea:latest
<a href="#cb1-5" aria-hidden="true" tabindex="-1"></a> container_name: gitea
<a href="#cb1-6" aria-hidden="true" tabindex="-1"></a> ports:
<a href="#cb1-7" aria-hidden="true" tabindex="-1"></a> - "3000:3000"
<a href="#cb1-8" aria-hidden="true" tabindex="-1"></a> - "2222:22"
<a href="#cb1-9" aria-hidden="true" tabindex="-1"></a> environment:
<a href="#cb1-10" aria-hidden="true" tabindex="-1"></a> USER_UID: 1000
<a href="#cb1-11" aria-hidden="true" tabindex="-1"></a> USER_GID: 1000
<a href="#cb1-12" aria-hidden="true" tabindex="-1"></a> GITEA__actions__ENABLED: "true"
<a href="#cb1-13" aria-hidden="true" tabindex="-1"></a> volumes:
<a href="#cb1-14" aria-hidden="true" tabindex="-1"></a> - ./gitea/data:/data
<a href="#cb1-15" aria-hidden="true" tabindex="-1"></a> restart: unless-stopped
<a href="#cb1-16" aria-hidden="true" tabindex="-1"></a>
<a href="#cb1-17" aria-hidden="true" tabindex="-1"></a> gitea-runner:
<a href="#cb1-18" aria-hidden="true" tabindex="-1"></a> image: gitea/act_runner:latest
<a href="#cb1-19" aria-hidden="true" tabindex="-1"></a> container_name: gitea-runner
<a href="#cb1-20" aria-hidden="true" tabindex="-1"></a> environment:
<a href="#cb1-21" aria-hidden="true" tabindex="-1"></a> GITEA_INSTANCE_URL: "http://gitea:3000"
<a href="#cb1-22" aria-hidden="true" tabindex="-1"></a> GITEA_RUNNER_REGISTRATION_TOKEN: "token_pendaftaran_anda"
<a href="#cb1-23" aria-hidden="true" tabindex="-1"></a> GITEA_RUNNER_NAME: "homelab-runner"
<a href="#cb1-24" aria-hidden="true" tabindex="-1"></a> volumes:
<a href="#cb1-25" aria-hidden="true" tabindex="-1"></a> - /var/run/docker.sock:/var/run/docker.sock
<a href="#cb1-26" aria-hidden="true" tabindex="-1"></a> - ./runner/data:/data
<a href="#cb1-27" aria-hidden="true" tabindex="-1"></a> depends_on:
<a href="#cb1-28" aria-hidden="true" tabindex="-1"></a> - gitea
<a href="#cb1-29" aria-hidden="true" tabindex="-1"></a> restart: unless-stopped</code></pre></div>
<h3 id="contoh-workflow-deploy-automatik">Contoh Workflow — Deploy Automatik</h3>
Ini contoh workflow yang paling asas. Bila anda push ke branch <code>main</code>, ia akan build Docker image dan deploy:
<div class="sourceCode" id="cb2"><pre class="sourceCode yaml"><code class="sourceCode yaml"><a href="#cb2-1" aria-hidden="true" tabindex="-1"></a># .gitea/workflows/deploy.yml
<a href="#cb2-2" aria-hidden="true" tabindex="-1"></a>name: Deploy ke Homelab
<a href="#cb2-3" aria-hidden="true" tabindex="-1"></a>on:
<a href="#cb2-4" aria-hidden="true" tabindex="-1"></a> push:
<a href="#cb2-5" aria-hidden="true" tabindex="-1"></a> branches: [main]
<a href="#cb2-6" aria-hidden="true" tabindex="-1"></a>
<a href="#cb2-7" aria-hidden="true" tabindex="-1"></a>jobs:
<a href="#cb2-8" aria-hidden="true" tabindex="-1"></a> deploy:
<a href="#cb2-9" aria-hidden="true" tabindex="-1"></a> runs-on: ubuntu-latest
<a href="#cb2-10" aria-hidden="true" tabindex="-1"></a> steps:
<a href="#cb2-11" aria-hidden="true" tabindex="-1"></a> - name: Checkout kod
<a href="#cb2-12" aria-hidden="true" tabindex="-1"></a> uses: actions/checkout@v4
<a href="#cb2-13" aria-hidden="true" tabindex="-1"></a>
<a href="#cb2-14" aria-hidden="true" tabindex="-1"></a> - name: Bina imej Docker
<a href="#cb2-15" aria-hidden="true" tabindex="-1"></a> run: |
<a href="#cb2-16" aria-hidden="true" tabindex="-1"></a> docker build -t app:latest .
<a href="#cb2-17" aria-hidden="true" tabindex="-1"></a>
<a href="#cb2-18" aria-hidden="true" tabindex="-1"></a> - name: Deploy ke pelayan
<a href="#cb2-19" aria-hidden="true" tabindex="-1"></a> run: |
<a href="#cb2-20" aria-hidden="true" tabindex="-1"></a> docker compose -f docker-compose.prod.yml up -d
<a href="#cb2-21" aria-hidden="true" tabindex="-1"></a>
<a href="#cb2-22" aria-hidden="true" tabindex="-1"></a> - name: Pemberitahuan
<a href="#cb2-23" aria-hidden="true" tabindex="-1"></a> run: |
<a href="#cb2-24" aria-hidden="true" tabindex="-1"></a> curl -d "Deploy berjaya: ${{ github.sha }}" \
<a href="#cb2-25" aria-hidden="true" tabindex="-1"></a> http://ntfy.lab.local/deployments</code></pre></div>
<blockquote>
Nota Beginner: Perhatikan step terakhir — ia hantar notification bila deploy berjaya. Ini amalan yang baik supaya anda sentiasa tahu apa yang berlaku dalam homelab.
</blockquote>
<h3 id="workflow-backup-automatik">Workflow Backup Automatik</h3>
Ini contoh workflow yang lebih praktikal — backup harian yang berjalan secara automatik:
<div class="sourceCode" id="cb3"><pre class="sourceCode yaml"><code class="sourceCode yaml"><a href="#cb3-1" aria-hidden="true" tabindex="-1"></a># .gitea/workflows/backup.yml
<a href="#cb3-2" aria-hidden="true" tabindex="-1"></a>name: Backup Harian
<a href="#cb3-3" aria-hidden="true" tabindex="-1"></a>on:
<a href="#cb3-4" aria-hidden="true" tabindex="-1"></a> schedule:
<a href="#cb3-5" aria-hidden="true" tabindex="-1"></a> - cron: '0 3 * * *' # Setiap hari jam 3 pagi
<a href="#cb3-6" aria-hidden="true" tabindex="-1"></a>
<a href="#cb3-7" aria-hidden="true" tabindex="-1"></a>jobs:
<a href="#cb3-8" aria-hidden="true" tabindex="-1"></a> backup:
<a href="#cb3-9" aria-hidden="true" tabindex="-1"></a> runs-on: ubuntu-latest
<a href="#cb3-10" aria-hidden="true" tabindex="-1"></a> steps:
<a href="#cb3-11" aria-hidden="true" tabindex="-1"></a> - name: Backup pangkalan data
<a href="#cb3-12" aria-hidden="true" tabindex="-1"></a> run: |
<a href="#cb3-13" aria-hidden="true" tabindex="-1"></a> docker exec nextcloud-db mysqldump \
<a href="#cb3-14" aria-hidden="true" tabindex="-1"></a> -u root -p$DB_ROOT_PASS nextcloud \
<a href="#cb3-15" aria-hidden="true" tabindex="-1"></a> > /backup/nextcloud-db-$(date +%Y%m%d).sql
<a href="#cb3-16" aria-hidden="true" tabindex="-1"></a>
<a href="#cb3-17" aria-hidden="true" tabindex="-1"></a> - name: Backup konfigurasi Docker
<a href="#cb3-18" aria-hidden="true" tabindex="-1"></a> run: |
<a href="#cb3-19" aria-hidden="true" tabindex="-1"></a> tar czf /backup/docker-config-$(date +%Y%m%d).tar.gz \
<a href="#cb3-20" aria-hidden="true" tabindex="-1"></a> /opt/docker/
<a href="#cb3-21" aria-hidden="true" tabindex="-1"></a>
<a href="#cb3-22" aria-hidden="true" tabindex="-1"></a> - name: Muat naik ke NAS
<a href="#cb3-23" aria-hidden="true" tabindex="-1"></a> run: |
<a href="#cb3-24" aria-hidden="true" tabindex="-1"></a> rsync -av /backup/ nas:/mnt/pool/backups/gitea-runner/
<a href="#cb3-25" aria-hidden="true" tabindex="-1"></a>
<a href="#cb3-26" aria-hidden="true" tabindex="-1"></a> - name: Bersihkan backup lama
<a href="#cb3-27" aria-hidden="true" tabindex="-1"></a> run: |
<a href="#cb3-28" aria-hidden="true" tabindex="-1"></a> find /backup/ -name "*.sql" -mtime +7 -delete
<a href="#cb3-29" aria-hidden="true" tabindex="-1"></a> find /backup/ -name "*.tar.gz" -mtime +7 -delete</code></pre></div>
<h2 id="langkah-2-ansible-roles-lanjutan">Langkah 2: Ansible Roles Lanjutan</h2>
Dalam bab sebelumnya, kita guna playbook biasa. Sekarang, kita naik taraf ke Roles — cara yang lebih teratur untuk susun Ansible code. Macam susun baju dalam almari berbanding campak semua dalam satu laci.
<h3 id="struktur-role">Struktur Role</h3>
<pre><code>roles/
├── common/
│ ├── tasks/
│ │ └── main.yml
│ ├── handlers/
│ │ └── main.yml
│ ├── templates/
│ │ └── sshd_config.j2
│ └── defaults/
│ └── main.yml
├── docker/
│ ├── tasks/
│ │ └── main.yml
│ ├── handlers/
│ │ └── main.yml
│ └── templates/
│ └── daemon.json.j2
└── monitoring/
 ├── tasks/
 │ └── main.yml
 └── templates/
 └── prometheus.yml.j2</code></pre>
<h3 id="role-docker">Role: Docker</h3>
Ini contoh role untuk install dan configure Docker. Tulis sekali, guna untuk semua server:
<div class="sourceCode" id="cb5"><pre class="sourceCode yaml"><code class="sourceCode yaml"><a href="#cb5-1" aria-hidden="true" tabindex="-1"></a># roles/docker/tasks/main.yml
<a href="#cb5-2" aria-hidden="true" tabindex="-1"></a>---
<a href="#cb5-3" aria-hidden="true" tabindex="-1"></a>- name: Pasang kebergantungan Docker
<a href="#cb5-4" aria-hidden="true" tabindex="-1"></a> apt:
<a href="#cb5-5" aria-hidden="true" tabindex="-1"></a> name:
<a href="#cb5-6" aria-hidden="true" tabindex="-1"></a> - ca-certificates
<a href="#cb5-7" aria-hidden="true" tabindex="-1"></a> - curl
<a href="#cb5-8" aria-hidden="true" tabindex="-1"></a> - gnupg
<a href="#cb5-9" aria-hidden="true" tabindex="-1"></a> state: present
<a href="#cb5-10" aria-hidden="true" tabindex="-1"></a> update_cache: yes
<a href="#cb5-11" aria-hidden="true" tabindex="-1"></a>
<a href="#cb5-12" aria-hidden="true" tabindex="-1"></a>- name: Tambah kunci GPG Docker
<a href="#cb5-13" aria-hidden="true" tabindex="-1"></a> apt_key:
<a href="#cb5-14" aria-hidden="true" tabindex="-1"></a> url: https://download.docker.com/linux/ubuntu/gpg
<a href="#cb5-15" aria-hidden="true" tabindex="-1"></a> state: present
<a href="#cb5-16" aria-hidden="true" tabindex="-1"></a>
<a href="#cb5-17" aria-hidden="true" tabindex="-1"></a>- name: Tambah repositori Docker
<a href="#cb5-18" aria-hidden="true" tabindex="-1"></a> apt_repository:
<a href="#cb5-19" aria-hidden="true" tabindex="-1"></a> repo: "deb https://download.docker.com/linux/ubuntu {{ ansible_distribution_release }} stable"
<a href="#cb5-20" aria-hidden="true" tabindex="-1"></a> state: present
<a href="#cb5-21" aria-hidden="true" tabindex="-1"></a>
<a href="#cb5-22" aria-hidden="true" tabindex="-1"></a>- name: Pasang Docker
<a href="#cb5-23" aria-hidden="true" tabindex="-1"></a> apt:
<a href="#cb5-24" aria-hidden="true" tabindex="-1"></a> name:
<a href="#cb5-25" aria-hidden="true" tabindex="-1"></a> - docker-ce
<a href="#cb5-26" aria-hidden="true" tabindex="-1"></a> - docker-ce-cli
<a href="#cb5-27" aria-hidden="true" tabindex="-1"></a> - containerd.io
<a href="#cb5-28" aria-hidden="true" tabindex="-1"></a> - docker-compose-plugin
<a href="#cb5-29" aria-hidden="true" tabindex="-1"></a> state: present
<a href="#cb5-30" aria-hidden="true" tabindex="-1"></a> update_cache: yes
<a href="#cb5-31" aria-hidden="true" tabindex="-1"></a>
<a href="#cb5-32" aria-hidden="true" tabindex="-1"></a>- name: Tambah pengguna ke kumpulan docker
<a href="#cb5-33" aria-hidden="true" tabindex="-1"></a> user:
<a href="#cb5-34" aria-hidden="true" tabindex="-1"></a> name: "{{ ansible_user }}"
<a href="#cb5-35" aria-hidden="true" tabindex="-1"></a> groups: docker
<a href="#cb5-36" aria-hidden="true" tabindex="-1"></a> append: yes
<a href="#cb5-37" aria-hidden="true" tabindex="-1"></a>
<a href="#cb5-38" aria-hidden="true" tabindex="-1"></a>- name: Konfigurasi Docker daemon
<a href="#cb5-39" aria-hidden="true" tabindex="-1"></a> template:
<a href="#cb5-40" aria-hidden="true" tabindex="-1"></a> src: daemon.json.j2
<a href="#cb5-41" aria-hidden="true" tabindex="-1"></a> dest: /etc/docker/daemon.json
<a href="#cb5-42" aria-hidden="true" tabindex="-1"></a> notify: restart docker
<a href="#cb5-43" aria-hidden="true" tabindex="-1"></a>
<a href="#cb5-44" aria-hidden="true" tabindex="-1"></a>- name: Pastikan Docker berjalan
<a href="#cb5-45" aria-hidden="true" tabindex="-1"></a> service:
<a href="#cb5-46" aria-hidden="true" tabindex="-1"></a> name: docker
<a href="#cb5-47" aria-hidden="true" tabindex="-1"></a> state: started
<a href="#cb5-48" aria-hidden="true" tabindex="-1"></a> enabled: yes</code></pre></div>
<div class="sourceCode" id="cb6"><pre class="sourceCode json"><code class="sourceCode json"><a href="#cb6-1" aria-hidden="true" tabindex="-1"></a>// roles/docker/templates/daemon.json.j2
<a href="#cb6-2" aria-hidden="true" tabindex="-1"></a>{
<a href="#cb6-3" aria-hidden="true" tabindex="-1"></a> "log-driver": "json-file",
<a href="#cb6-4" aria-hidden="true" tabindex="-1"></a> "log-opts": {
<a href="#cb6-5" aria-hidden="true" tabindex="-1"></a> "max-size": "10m",
<a href="#cb6-6" aria-hidden="true" tabindex="-1"></a> "max-file": "3"
<a href="#cb6-7" aria-hidden="true" tabindex="-1"></a> },
<a href="#cb6-8" aria-hidden="true" tabindex="-1"></a> "default-address-pools": [
<a href="#cb6-9" aria-hidden="true" tabindex="-1"></a> {
<a href="#cb6-10" aria-hidden="true" tabindex="-1"></a> "base": "172.17.0.0/12",
<a href="#cb6-11" aria-hidden="true" tabindex="-1"></a> "size": 24
<a href="#cb6-12" aria-hidden="true" tabindex="-1"></a> }
<a href="#cb6-13" aria-hidden="true" tabindex="-1"></a> ],
<a href="#cb6-14" aria-hidden="true" tabindex="-1"></a> "storage-driver": "overlay2",
<a href="#cb6-15" aria-hidden="true" tabindex="-1"></a> "live-restore": true
<a href="#cb6-16" aria-hidden="true" tabindex="-1"></a>}</code></pre></div>
<div class="sourceCode" id="cb7"><pre class="sourceCode yaml"><code class="sourceCode yaml"><a href="#cb7-1" aria-hidden="true" tabindex="-1"></a># roles/docker/handlers/main.yml
<a href="#cb7-2" aria-hidden="true" tabindex="-1"></a>---
<a href="#cb7-3" aria-hidden="true" tabindex="-1"></a>- name: restart docker
<a href="#cb7-4" aria-hidden="true" tabindex="-1"></a> service:
<a href="#cb7-5" aria-hidden="true" tabindex="-1"></a> name: docker
<a href="#cb7-6" aria-hidden="true" tabindex="-1"></a> state: restarted</code></pre></div>
<blockquote>
Nota Beginner: Perhatikan <code>notify: restart docker</code> dalam task konfigurasi. Ini bermakna Docker hanya akan restart kalau config memang berubah. Kalau config sama, ia tak restart — jimat downtime.
</blockquote>
<h3 id="role-monitoring-node-exporter">Role: Monitoring (Node Exporter)</h3>
<div class="sourceCode" id="cb8"><pre class="sourceCode yaml"><code class="sourceCode yaml"><a href="#cb8-1" aria-hidden="true" tabindex="-1"></a># roles/monitoring/tasks/main.yml
<a href="#cb8-2" aria-hidden="true" tabindex="-1"></a>---
<a href="#cb8-3" aria-hidden="true" tabindex="-1"></a>- name: Cipta pengguna node_exporter
<a href="#cb8-4" aria-hidden="true" tabindex="-1"></a> user:
<a href="#cb8-5" aria-hidden="true" tabindex="-1"></a> name: node_exporter
<a href="#cb8-6" aria-hidden="true" tabindex="-1"></a> shell: /bin/false
<a href="#cb8-7" aria-hidden="true" tabindex="-1"></a> system: yes
<a href="#cb8-8" aria-hidden="true" tabindex="-1"></a> create_home: no
<a href="#cb8-9" aria-hidden="true" tabindex="-1"></a>
<a href="#cb8-10" aria-hidden="true" tabindex="-1"></a>- name: Muat turun Node Exporter
<a href="#cb8-11" aria-hidden="true" tabindex="-1"></a> get_url:
<a href="#cb8-12" aria-hidden="true" tabindex="-1"></a> url: "https://github.com/prometheus/node_exporter/releases/download/v{{ node_exporter_version }}/node_exporter-{{ node_exporter_version }}.linux-amd64.tar.gz"
<a href="#cb8-13" aria-hidden="true" tabindex="-1"></a> dest: /tmp/node_exporter.tar.gz
<a href="#cb8-14" aria-hidden="true" tabindex="-1"></a>
<a href="#cb8-15" aria-hidden="true" tabindex="-1"></a>- name: Ekstrak Node Exporter
<a href="#cb8-16" aria-hidden="true" tabindex="-1"></a> unarchive:
<a href="#cb8-17" aria-hidden="true" tabindex="-1"></a> src: /tmp/node_exporter.tar.gz
<a href="#cb8-18" aria-hidden="true" tabindex="-1"></a> dest: /usr/local/bin/
<a href="#cb8-19" aria-hidden="true" tabindex="-1"></a> remote_src: yes
<a href="#cb8-20" aria-hidden="true" tabindex="-1"></a> extra_opts:
<a href="#cb8-21" aria-hidden="true" tabindex="-1"></a> - --strip-components=1
<a href="#cb8-22" aria-hidden="true" tabindex="-1"></a> - --wildcards
<a href="#cb8-23" aria-hidden="true" tabindex="-1"></a> - "*/node_exporter"
<a href="#cb8-24" aria-hidden="true" tabindex="-1"></a>
<a href="#cb8-25" aria-hidden="true" tabindex="-1"></a>- name: Cipta perkhidmatan systemd
<a href="#cb8-26" aria-hidden="true" tabindex="-1"></a> copy:
<a href="#cb8-27" aria-hidden="true" tabindex="-1"></a> content: |
<a href="#cb8-28" aria-hidden="true" tabindex="-1"></a> [Unit]
<a href="#cb8-29" aria-hidden="true" tabindex="-1"></a> Description=Node Exporter
<a href="#cb8-30" aria-hidden="true" tabindex="-1"></a> After=network.target
<a href="#cb8-31" aria-hidden="true" tabindex="-1"></a>
<a href="#cb8-32" aria-hidden="true" tabindex="-1"></a> [Service]
<a href="#cb8-33" aria-hidden="true" tabindex="-1"></a> User=node_exporter
<a href="#cb8-34" aria-hidden="true" tabindex="-1"></a> ExecStart=/usr/local/bin/node_exporter
<a href="#cb8-35" aria-hidden="true" tabindex="-1"></a> Restart=always
<a href="#cb8-36" aria-hidden="true" tabindex="-1"></a>
<a href="#cb8-37" aria-hidden="true" tabindex="-1"></a> [Install]
<a href="#cb8-38" aria-hidden="true" tabindex="-1"></a> WantedBy=multi-user.target
<a href="#cb8-39" aria-hidden="true" tabindex="-1"></a> dest: /etc/systemd/system/node_exporter.service
<a href="#cb8-40" aria-hidden="true" tabindex="-1"></a>
<a href="#cb8-41" aria-hidden="true" tabindex="-1"></a>- name: Aktifkan dan mulakan Node Exporter
<a href="#cb8-42" aria-hidden="true" tabindex="-1"></a> systemd:
<a href="#cb8-43" aria-hidden="true" tabindex="-1"></a> name: node_exporter
<a href="#cb8-44" aria-hidden="true" tabindex="-1"></a> state: started
<a href="#cb8-45" aria-hidden="true" tabindex="-1"></a> enabled: yes
<a href="#cb8-46" aria-hidden="true" tabindex="-1"></a> daemon_reload: yes</code></pre></div>
<h3 id="playbook-utama">Playbook Utama</h3>
Semua role digabungkan dalam satu playbook utama. Satu command, semua server dikonfigurasikan:
<div class="sourceCode" id="cb9"><pre class="sourceCode yaml"><code class="sourceCode yaml"><a href="#cb9-1" aria-hidden="true" tabindex="-1"></a># playbooks/site.yml - Playbook utama
<a href="#cb9-2" aria-hidden="true" tabindex="-1"></a>---
<a href="#cb9-3" aria-hidden="true" tabindex="-1"></a>- name: Konfigurasi semua pelayan
<a href="#cb9-4" aria-hidden="true" tabindex="-1"></a> hosts: all
<a href="#cb9-5" aria-hidden="true" tabindex="-1"></a> become: yes
<a href="#cb9-6" aria-hidden="true" tabindex="-1"></a> roles:
<a href="#cb9-7" aria-hidden="true" tabindex="-1"></a> - common
<a href="#cb9-8" aria-hidden="true" tabindex="-1"></a> - monitoring
<a href="#cb9-9" aria-hidden="true" tabindex="-1"></a>
<a href="#cb9-10" aria-hidden="true" tabindex="-1"></a>- name: Konfigurasi host Docker
<a href="#cb9-11" aria-hidden="true" tabindex="-1"></a> hosts: docker_hosts
<a href="#cb9-12" aria-hidden="true" tabindex="-1"></a> become: yes
<a href="#cb9-13" aria-hidden="true" tabindex="-1"></a> roles:
<a href="#cb9-14" aria-hidden="true" tabindex="-1"></a> - docker
<a href="#cb9-15" aria-hidden="true" tabindex="-1"></a>
<a href="#cb9-16" aria-hidden="true" tabindex="-1"></a>- name: Deploy stack Docker
<a href="#cb9-17" aria-hidden="true" tabindex="-1"></a> hosts: docker_hosts
<a href="#cb9-18" aria-hidden="true" tabindex="-1"></a> become: yes
<a href="#cb9-19" aria-hidden="true" tabindex="-1"></a> tasks:
<a href="#cb9-20" aria-hidden="true" tabindex="-1"></a> - name: Salin docker-compose.yml
<a href="#cb9-21" aria-hidden="true" tabindex="-1"></a> copy:
<a href="#cb9-22" aria-hidden="true" tabindex="-1"></a> src: ../docker/docker-compose.yml
<a href="#cb9-23" aria-hidden="true" tabindex="-1"></a> dest: /opt/docker/docker-compose.yml
<a href="#cb9-24" aria-hidden="true" tabindex="-1"></a>
<a href="#cb9-25" aria-hidden="true" tabindex="-1"></a> - name: Salin fail .env
<a href="#cb9-26" aria-hidden="true" tabindex="-1"></a> template:
<a href="#cb9-27" aria-hidden="true" tabindex="-1"></a> src: ../docker/.env.j2
<a href="#cb9-28" aria-hidden="true" tabindex="-1"></a> dest: /opt/docker/.env
<a href="#cb9-29" aria-hidden="true" tabindex="-1"></a> mode: '0600'
<a href="#cb9-30" aria-hidden="true" tabindex="-1"></a>
<a href="#cb9-31" aria-hidden="true" tabindex="-1"></a> - name: Mulakan stack Docker
<a href="#cb9-32" aria-hidden="true" tabindex="-1"></a> shell: |
<a href="#cb9-33" aria-hidden="true" tabindex="-1"></a> cd /opt/docker && docker compose pull && docker compose up -d</code></pre></div>
<h2 id="langkah-3-automasi-penyelenggaraan">Langkah 3: Automasi Penyelenggaraan</h2>
<h3 id="skrip-penyelenggaraan-mingguan">Skrip Penyelenggaraan Mingguan</h3>
Ini skrip “all-in-one” yang saya jalankan setiap minggu. Ia update sistem, bersihkan Docker, check disk health, dan hantar laporan. Set and forget:
<div class="sourceCode" id="cb10"><pre class="sourceCode bash"><code class="sourceCode bash"><a href="#cb10-1" aria-hidden="true" tabindex="-1"></a>#!/bin/bash
<a href="#cb10-2" aria-hidden="true" tabindex="-1"></a># /usr/local/bin/weekly-maintenance.sh
<a href="#cb10-3" aria-hidden="true" tabindex="-1"></a># Jalankan setiap Ahad jam 4 pagi
<a href="#cb10-4" aria-hidden="true" tabindex="-1"></a>
<a href="#cb10-5" aria-hidden="true" tabindex="-1"></a>LOG="/var/log/maintenance.log"
<a href="#cb10-6" aria-hidden="true" tabindex="-1"></a>echo "=== Penyelenggaraan Mingguan: $(date) ===" >> "$LOG"
<a href="#cb10-7" aria-hidden="true" tabindex="-1"></a>
<a href="#cb10-8" aria-hidden="true" tabindex="-1"></a># 1. Kemas kini sistem
<a href="#cb10-9" aria-hidden="true" tabindex="-1"></a>echo "Mengemas kini sistem..." >> "$LOG"
<a href="#cb10-10" aria-hidden="true" tabindex="-1"></a>apt update && apt upgrade -y >> "$LOG" 2>&1
<a href="#cb10-11" aria-hidden="true" tabindex="-1"></a>
<a href="#cb10-12" aria-hidden="true" tabindex="-1"></a># 2. Kemas kini kontena Docker
<a href="#cb10-13" aria-hidden="true" tabindex="-1"></a>echo "Mengemas kini kontena Docker..." >> "$LOG"
<a href="#cb10-14" aria-hidden="true" tabindex="-1"></a>cd /opt/docker
<a href="#cb10-15" aria-hidden="true" tabindex="-1"></a>docker compose pull >> "$LOG" 2>&1
<a href="#cb10-16" aria-hidden="true" tabindex="-1"></a>docker compose up -d >> "$LOG" 2>&1
<a href="#cb10-17" aria-hidden="true" tabindex="-1"></a>
<a href="#cb10-18" aria-hidden="true" tabindex="-1"></a># 3. Bersihkan Docker
<a href="#cb10-19" aria-hidden="true" tabindex="-1"></a>echo "Membersihkan Docker..." >> "$LOG"
<a href="#cb10-20" aria-hidden="true" tabindex="-1"></a>docker system prune -af --volumes >> "$LOG" 2>&1
<a href="#cb10-21" aria-hidden="true" tabindex="-1"></a>
<a href="#cb10-22" aria-hidden="true" tabindex="-1"></a># 4. Bersihkan log lama
<a href="#cb10-23" aria-hidden="true" tabindex="-1"></a>echo "Membersihkan log..." >> "$LOG"
<a href="#cb10-24" aria-hidden="true" tabindex="-1"></a>journalctl --vacuum-time=30d >> "$LOG" 2>&1
<a href="#cb10-25" aria-hidden="true" tabindex="-1"></a>find /var/log -name "*.gz" -mtime +30 -delete
<a href="#cb10-26" aria-hidden="true" tabindex="-1"></a>
<a href="#cb10-27" aria-hidden="true" tabindex="-1"></a># 5. Periksa kesihatan cakera
<a href="#cb10-28" aria-hidden="true" tabindex="-1"></a>echo "Memeriksa kesihatan cakera..." >> "$LOG"
<a href="#cb10-29" aria-hidden="true" tabindex="-1"></a>for disk in /dev/sd?; do
<a href="#cb10-30" aria-hidden="true" tabindex="-1"></a> smartctl -H "$disk" >> "$LOG" 2>&1
<a href="#cb10-31" aria-hidden="true" tabindex="-1"></a>done
<a href="#cb10-32" aria-hidden="true" tabindex="-1"></a>
<a href="#cb10-33" aria-hidden="true" tabindex="-1"></a># 6. Periksa penggunaan storan
<a href="#cb10-34" aria-hidden="true" tabindex="-1"></a>echo "Penggunaan storan:" >> "$LOG"
<a href="#cb10-35" aria-hidden="true" tabindex="-1"></a>df -h >> "$LOG" 2>&1
<a href="#cb10-36" aria-hidden="true" tabindex="-1"></a>
<a href="#cb10-37" aria-hidden="true" tabindex="-1"></a># 7. Periksa ZFS (jika ada)
<a href="#cb10-38" aria-hidden="true" tabindex="-1"></a>if command -v zpool &> /dev/null; then
<a href="#cb10-39" aria-hidden="true" tabindex="-1"></a> echo "Status ZFS:" >> "$LOG"
<a href="#cb10-40" aria-hidden="true" tabindex="-1"></a> zpool status >> "$LOG" 2>&1
<a href="#cb10-41" aria-hidden="true" tabindex="-1"></a>fi
<a href="#cb10-42" aria-hidden="true" tabindex="-1"></a>
<a href="#cb10-43" aria-hidden="true" tabindex="-1"></a># 8. Hantar laporan
<a href="#cb10-44" aria-hidden="true" tabindex="-1"></a>SUMMARY=$(tail -50 "$LOG")
<a href="#cb10-45" aria-hidden="true" tabindex="-1"></a>curl -d "$SUMMARY" http://ntfy.lab.local/maintenance
<a href="#cb10-46" aria-hidden="true" tabindex="-1"></a>
<a href="#cb10-47" aria-hidden="true" tabindex="-1"></a>echo "=== Penyelenggaraan selesai: $(date) ===" >> "$LOG"</code></pre></div>
<div class="sourceCode" id="cb11"><pre class="sourceCode bash"><code class="sourceCode bash"><a href="#cb11-1" aria-hidden="true" tabindex="-1"></a># Tambah ke crontab
<a href="#cb11-2" aria-hidden="true" tabindex="-1"></a>sudo crontab -e
<a href="#cb11-3" aria-hidden="true" tabindex="-1"></a>0 4 * * 0 /usr/local/bin/weekly-maintenance.sh</code></pre></div>
<blockquote>
Nota Beginner: Perhatikan <code>docker system prune -af --volumes</code> dalam skrip tu. Ini akan padam semua image, container, dan volume yang tak digunakan. Bagus untuk jimat disk space, tapi pastikan semua container penting anda memang running sebelum jalankan skrip ni.
</blockquote>
<h3 id="automasi-pembaharuan-sijil-ssl">Automasi Pembaharuan Sijil SSL</h3>
Ini skrip kecil tapi sangat berguna. Ia check semua sijil SSL anda dan alert kalau ada yang nak tamat:
<div class="sourceCode" id="cb12"><pre class="sourceCode bash"><code class="sourceCode bash"><a href="#cb12-1" aria-hidden="true" tabindex="-1"></a>#!/bin/bash
<a href="#cb12-2" aria-hidden="true" tabindex="-1"></a># /usr/local/bin/check-ssl-expiry.sh
<a href="#cb12-3" aria-hidden="true" tabindex="-1"></a>
<a href="#cb12-4" aria-hidden="true" tabindex="-1"></a>DOMAINS=(
<a href="#cb12-5" aria-hidden="true" tabindex="-1"></a> "cloud.lab.local"
<a href="#cb12-6" aria-hidden="true" tabindex="-1"></a> "git.lab.local"
<a href="#cb12-7" aria-hidden="true" tabindex="-1"></a> "vault.lab.local"
<a href="#cb12-8" aria-hidden="true" tabindex="-1"></a> "grafana.lab.local"
<a href="#cb12-9" aria-hidden="true" tabindex="-1"></a>)
<a href="#cb12-10" aria-hidden="true" tabindex="-1"></a>
<a href="#cb12-11" aria-hidden="true" tabindex="-1"></a>for domain in "${DOMAINS[@]}"; do
<a href="#cb12-12" aria-hidden="true" tabindex="-1"></a> EXPIRY=$(echo | openssl s_client -servername "$domain" \
<a href="#cb12-13" aria-hidden="true" tabindex="-1"></a> -connect "$domain:443" 2>/dev/null | \
<a href="#cb12-14" aria-hidden="true" tabindex="-1"></a> openssl x509 -noout -enddate 2>/dev/null | \
<a href="#cb12-15" aria-hidden="true" tabindex="-1"></a> cut -d= -f2)
<a href="#cb12-16" aria-hidden="true" tabindex="-1"></a>
<a href="#cb12-17" aria-hidden="true" tabindex="-1"></a> if [ -n "$EXPIRY" ]; then
<a href="#cb12-18" aria-hidden="true" tabindex="-1"></a> DAYS_LEFT=$(( ($(date -d "$EXPIRY" +%s) - $(date +%s)) / 86400 ))
<a href="#cb12-19" aria-hidden="true" tabindex="-1"></a>
<a href="#cb12-20" aria-hidden="true" tabindex="-1"></a> if [ "$DAYS_LEFT" -lt 30 ]; then
<a href="#cb12-21" aria-hidden="true" tabindex="-1"></a> curl -d "Amaran: Sijil SSL untuk $domain tamat dalam $DAYS_LEFT hari!" \
<a href="#cb12-22" aria-hidden="true" tabindex="-1"></a> http://ntfy.lab.local/ssl-alerts
<a href="#cb12-23" aria-hidden="true" tabindex="-1"></a> fi
<a href="#cb12-24" aria-hidden="true" tabindex="-1"></a> fi
<a href="#cb12-25" aria-hidden="true" tabindex="-1"></a>done</code></pre></div>
<h2 id="langkah-4-pemantauan-lanjutan-dengan-grafana">Langkah 4: Pemantauan Lanjutan dengan Grafana</h2>
Sekarang anda dah ada Grafana dari bab sebelumnya, jom buat dashboard yang lebih power.
<h3 id="papan-pemuka-tersuai">Papan Pemuka Tersuai</h3>
Cipta papan pemuka Grafana yang menunjukkan keseluruhan homelab anda dalam satu pandangan:
Panel Disyorkan:
<ol type="1">
<li>Ringkasan Sistem:
<ul>
<li>Uptime semua pelayan</li>
<li>Bilangan kontena aktif</li>
<li>Penggunaan CPU keseluruhan</li>
<li>Penggunaan RAM keseluruhan</li>
</ul></li>
<li>Storan:
<ul>
<li>Penggunaan cakera setiap pelayan</li>
<li>IOPS dan throughput</li>
<li>Kesihatan ZFS/RAID</li>
</ul></li>
<li>Rangkaian:
<ul>
<li>Trafik masuk/keluar</li>
<li>Pertanyaan DNS (dari Pi-hole)</li>
<li>Sambungan VPN aktif</li>
</ul></li>
<li>Perkhidmatan:
<ul>
<li>Status kontena Docker</li>
<li>Masa tindak balas perkhidmatan web</li>
<li>Kadar ralat HTTP</li>
</ul></li>
<li>Persekitaran:
<ul>
<li>Suhu CPU</li>
<li>Status UPS (bateri, beban)</li>
<li>Kelajuan kipas</li>
</ul></li>
</ol>
<h3 id="grafana-dengan-variabel">Grafana dengan Variabel</h3>
Nak buat dashboard yang lebih interaktif? Guna variabel supaya anda boleh tukar antara server dengan satu klik:
<pre><code># Variabel 'host'
Type: Query
Data source: Prometheus
Query: label_values(node_uname_info, instance)

# Gunakan dalam panel:
node_cpu_seconds_total{instance="$host"}</code></pre>
<h3 id="anotasi">Anotasi</h3>
Tandakan peristiwa penting pada graf Grafana. Contohnya, bila deploy berlaku, anda boleh nampak tepat pada graf kalau ada kesan ke prestasi:
<div class="sourceCode" id="cb14"><pre class="sourceCode bash"><code class="sourceCode bash"><a href="#cb14-1" aria-hidden="true" tabindex="-1"></a># Hantar anotasi apabila deploy berlaku
<a href="#cb14-2" aria-hidden="true" tabindex="-1"></a>curl -X POST http://grafana.lab.local/api/annotations \
<a href="#cb14-3" aria-hidden="true" tabindex="-1"></a> -H "Authorization: Bearer api-key-anda" \
<a href="#cb14-4" aria-hidden="true" tabindex="-1"></a> -H "Content-Type: application/json" \
<a href="#cb14-5" aria-hidden="true" tabindex="-1"></a> -d '{
<a href="#cb14-6" aria-hidden="true" tabindex="-1"></a> "text": "Deploy v1.2.3",
<a href="#cb14-7" aria-hidden="true" tabindex="-1"></a> "tags": ["deploy", "production"]
<a href="#cb14-8" aria-hidden="true" tabindex="-1"></a> }'</code></pre></div>
<h2 id="langkah-5-pemberitahuan-pintar">Langkah 5: Pemberitahuan Pintar</h2>
<h3 id="mengelakkan-alert-fatigue">Mengelakkan Alert Fatigue</h3>
Ini perkara yang saya belajar dengan cara yang susah. Mula-mula setup monitoring, saya alert SEMUA benda. CPU naik sikit — alert. Disk usage naik 1% — alert. Hasilnya? Saya abaikan semua notification sebab terlalu banyak.
Jangan buat macam saya. Konfigurasi amaran dengan bijak:
<div class="sourceCode" id="cb15"><pre class="sourceCode yaml"><code class="sourceCode yaml"><a href="#cb15-1" aria-hidden="true" tabindex="-1"></a># Tahap amaran:
<a href="#cb15-2" aria-hidden="true" tabindex="-1"></a># 1. Info — Log sahaja, tiada pemberitahuan
<a href="#cb15-3" aria-hidden="true" tabindex="-1"></a># 2. Warning — Pemberitahuan sekali, boleh ditunggu
<a href="#cb15-4" aria-hidden="true" tabindex="-1"></a># 3. Critical — Pemberitahuan segera, perlu tindakan
<a href="#cb15-5" aria-hidden="true" tabindex="-1"></a>
<a href="#cb15-6" aria-hidden="true" tabindex="-1"></a># Contoh peraturan:
<a href="#cb15-7" aria-hidden="true" tabindex="-1"></a>rules:
<a href="#cb15-8" aria-hidden="true" tabindex="-1"></a> # CRITICAL: Pelayan tidak boleh diakses
<a href="#cb15-9" aria-hidden="true" tabindex="-1"></a> - alert: ServerDown
<a href="#cb15-10" aria-hidden="true" tabindex="-1"></a> expr: up == 0
<a href="#cb15-11" aria-hidden="true" tabindex="-1"></a> for: 2m
<a href="#cb15-12" aria-hidden="true" tabindex="-1"></a> severity: critical
<a href="#cb15-13" aria-hidden="true" tabindex="-1"></a>
<a href="#cb15-14" aria-hidden="true" tabindex="-1"></a> # WARNING: CPU tinggi (mungkin beban sementara)
<a href="#cb15-15" aria-hidden="true" tabindex="-1"></a> - alert: HighCPU
<a href="#cb15-16" aria-hidden="true" tabindex="-1"></a> expr: cpu_usage > 90
<a href="#cb15-17" aria-hidden="true" tabindex="-1"></a> for: 15m # Tunggu 15 minit sebelum amaran
<a href="#cb15-18" aria-hidden="true" tabindex="-1"></a> severity: warning
<a href="#cb15-19" aria-hidden="true" tabindex="-1"></a>
<a href="#cb15-20" aria-hidden="true" tabindex="-1"></a> # INFO: Cakera hampir penuh (masih ada masa)
<a href="#cb15-21" aria-hidden="true" tabindex="-1"></a> - alert: DiskAlmostFull
<a href="#cb15-22" aria-hidden="true" tabindex="-1"></a> expr: disk_usage > 80
<a href="#cb15-23" aria-hidden="true" tabindex="-1"></a> for: 1h
<a href="#cb15-24" aria-hidden="true" tabindex="-1"></a> severity: info</code></pre></div>
<h3 id="saluran-pemberitahuan">Saluran Pemberitahuan</h3>
Setup saluran pemberitahuan mengikut keutamaan. Tak semua alert perlu bunyi telefon anda:
<pre><code>Kritikal → Telegram + Ntfy (push notification)
Amaran → Telegram sahaja
Info → Log ke Grafana sahaja

Jadual:
 Waktu kerja (8am-10pm): Semua pemberitahuan
 Malam (10pm-8am): Kritikal sahaja</code></pre>
<blockquote>
Nota Beginner: Rule of thumb saya — kalau alert tu tak memerlukan tindakan segera, ia sepatutnya warning atau info, bukan critical. Critical bermakna “bangun tidur sekarang dan fix.”
</blockquote>
<h2 id="langkah-6-dokumentasi-automatik">Langkah 6: Dokumentasi Automatik</h2>
<h3 id="ansible-cmdb">Ansible CMDB</h3>
Pernah tak seseorang tanya “server tu spec apa?” dan anda kena SSH satu-satu untuk check? Ansible CMDB selesaikan masalah tu:
<div class="sourceCode" id="cb17"><pre class="sourceCode bash"><code class="sourceCode bash"><a href="#cb17-1" aria-hidden="true" tabindex="-1"></a># Pasang ansible-cmdb
<a href="#cb17-2" aria-hidden="true" tabindex="-1"></a>pip install ansible-cmdb
<a href="#cb17-3" aria-hidden="true" tabindex="-1"></a>
<a href="#cb17-4" aria-hidden="true" tabindex="-1"></a># Kumpul fakta dari semua host
<a href="#cb17-5" aria-hidden="true" tabindex="-1"></a>ansible -i inventory/hosts.yml all -m setup --tree /tmp/facts
<a href="#cb17-6" aria-hidden="true" tabindex="-1"></a>
<a href="#cb17-7" aria-hidden="true" tabindex="-1"></a># Jana laporan HTML
<a href="#cb17-8" aria-hidden="true" tabindex="-1"></a>ansible-cmdb /tmp/facts > homelab-inventory.html</code></pre></div>
Laporan ini mengandungi: - Senarai semua pelayan dengan spesifikasi - Versi OS dan kernel - Alamat IP dan MAC - Saiz RAM dan storan - Perisian yang dipasang
<h3 id="dokumentasi-rangkaian-automatik">Dokumentasi Rangkaian Automatik</h3>
Skrip ni scan rangkaian anda dan generate dokumen secara automatik. Jalankan sebulan sekali dan anda sentiasa ada dokumentasi terkini:
<div class="sourceCode" id="cb18"><pre class="sourceCode bash"><code class="sourceCode bash"><a href="#cb18-1" aria-hidden="true" tabindex="-1"></a>#!/bin/bash
<a href="#cb18-2" aria-hidden="true" tabindex="-1"></a># generate-network-doc.sh
<a href="#cb18-3" aria-hidden="true" tabindex="-1"></a>echo "# Dokumentasi Rangkaian Homelab" > network-doc.md
<a href="#cb18-4" aria-hidden="true" tabindex="-1"></a>echo "Dijana: $(date)" >> network-doc.md
<a href="#cb18-5" aria-hidden="true" tabindex="-1"></a>echo "" >> network-doc.md
<a href="#cb18-6" aria-hidden="true" tabindex="-1"></a>
<a href="#cb18-7" aria-hidden="true" tabindex="-1"></a>echo "## Peranti Aktif" >> network-doc.md
<a href="#cb18-8" aria-hidden="true" tabindex="-1"></a>nmap -sn 10.0.0.0/24 | grep "report\|MAC" >> network-doc.md
<a href="#cb18-9" aria-hidden="true" tabindex="-1"></a>echo "" >> network-doc.md
<a href="#cb18-10" aria-hidden="true" tabindex="-1"></a>
<a href="#cb18-11" aria-hidden="true" tabindex="-1"></a>echo "## Port Terbuka (Pelayan Utama)" >> network-doc.md
<a href="#cb18-12" aria-hidden="true" tabindex="-1"></a>nmap -sV 10.0.20.20 >> network-doc.md
<a href="#cb18-13" aria-hidden="true" tabindex="-1"></a>echo "" >> network-doc.md
<a href="#cb18-14" aria-hidden="true" tabindex="-1"></a>
<a href="#cb18-15" aria-hidden="true" tabindex="-1"></a>echo "## Rekod DNS" >> network-doc.md
<a href="#cb18-16" aria-hidden="true" tabindex="-1"></a>dig axfr lab.local @10.0.0.2 >> network-doc.md 2>/dev/null
<a href="#cb18-17" aria-hidden="true" tabindex="-1"></a>echo "" >> network-doc.md
<a href="#cb18-18" aria-hidden="true" tabindex="-1"></a>
<a href="#cb18-19" aria-hidden="true" tabindex="-1"></a>echo "## Kontena Docker" >> network-doc.md
<a href="#cb18-20" aria-hidden="true" tabindex="-1"></a>ssh admin@10.0.20.20 "docker ps --format 'table {{.Names}}\t{{.Status}}\t{{.Ports}}'" >> network-doc.md</code></pre></div>
<h3 id="checklist-siap-bab-ini">Checklist Siap Bab Ini</h3>
<ul class="task-list">
<li><label><input type="checkbox" />Saya tahu satu proses yang sesuai dijadikan Workflow automatik.</label></li>
<li><label><input type="checkbox" />Saya tahu keperluan rollback untuk automasi itu.</label></li>
<li><label><input type="checkbox" />Saya tahu bagaimana hendak audit hasil automasi melalui log atau notifikasi.</label></li>
</ul>
<h2 id="ringkasan">Ringkasan</h2>
Wah, bab yang panjang! Tapi anda dah sampai penghujung. Jom recap apa yang kita dah cover:
<ul>
<li>CI/CD dengan Gitea Actions — push code, auto deploy. Macam magic, tapi anda yang buat.</li>
<li>Ansible Roles — pengurusan konfigurasi yang lebih teratur dan boleh diguna semula</li>
<li>Skrip automasi penyelenggaraan — update, bersihkan, check health, semua automatik</li>
<li>Papan pemuka Grafana lanjutan — variabel, anotasi, panel tersuai</li>
<li>Strategi pemberitahuan pintar — alert yang berguna, bukan yang menyusahkan</li>
<li>Dokumentasi automatik — tak perlu update manual lagi</li>
</ul>
Automasi yang baik membebaskan masa anda untuk belajar perkara baru dan menambah projek baru ke homelab. Daripada habiskan masa buat kerja berulang, anda boleh fokus pada eksperimen dan pembelajaran.
Percayalah, bila anda dah rasa nikmat automasi yang berjalan lancar, anda takkan mahu balik ke cara manual lagi. Selamat mengautomasikan!

Batal