From 4fe1869caebf267c7f663cf9df59a8de24a4cf08 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Eric=20B=C3=BCrki?= <eric.buerki@linuxfabrik.ch>
Date: Tue, 17 Feb 2026 14:32:42 +0100
Subject: [PATCH 01/10] feat(roles/graylog_datanode): add validation for
 graylog_datanode__password_secret length

---
 roles/graylog_datanode/tasks/main.yml | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/roles/graylog_datanode/tasks/main.yml b/roles/graylog_datanode/tasks/main.yml
index 93364490..04a3bb8a 100644
--- a/roles/graylog_datanode/tasks/main.yml
+++ b/roles/graylog_datanode/tasks/main.yml
@@ -1,3 +1,16 @@
+- block:
+
+  - name: 'Validate that graylog_datanode__password_secret length > 16 characters'
+    ansible.builtin.assert:
+      that:
+        - 'graylog_datanode__password_secret | length > 16'
+      fail_msg: 'graylog_datanode__password_secret must be longer than 16 characters'
+      quiet: true
+
+  tags:
+    - 'graylog_datanode'
+    - 'graylog_datanode:configure'
+
 - block:
 
   - name: 'Install graylog-datanode'

From ebd995e98a9ae26707ab32d375fd4f8b73d2169b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Eric=20B=C3=BCrki?= <eric.buerki@linuxfabrik.ch>
Date: Tue, 17 Feb 2026 14:33:33 +0100
Subject: [PATCH 02/10] feat(roles/graylog_server): add validation for
 graylog_server__password_secret length

---
 roles/graylog_server/tasks/main.yml | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/roles/graylog_server/tasks/main.yml b/roles/graylog_server/tasks/main.yml
index cde9578b..72d8b52d 100644
--- a/roles/graylog_server/tasks/main.yml
+++ b/roles/graylog_server/tasks/main.yml
@@ -1,3 +1,16 @@
+- block:
+
+  - name: 'Validate that graylog_server__password_secret length > 16 characters'
+    ansible.builtin.assert:
+      that:
+        - 'graylog_server__password_secret | length > 16'
+      fail_msg: 'graylog_server__password_secret must be longer than 16 characters'
+      quiet: true
+
+  tags:
+    - 'graylog_server'
+    - 'graylog_server:configure'
+
 - block:
 
   - name: 'Install graylog-server'

From 2c8e99d2f14cc79a8b458bfa85732360fae97ec5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Eric=20B=C3=BCrki?= <eric.buerki@linuxfabrik.ch>
Date: Tue, 17 Feb 2026 17:46:00 +0100
Subject: [PATCH 03/10] feat(roles/graylog_datanode): allow users to specify
 path_node variable in datanode.conf

---
 roles/graylog_datanode/README.md                           | 7 +++++++
 roles/graylog_datanode/defaults/main.yml                   | 3 ++-
 .../templates/etc/graylog/datanode/6.1-datanode.conf.j2    | 4 ++++
 .../templates/etc/graylog/datanode/6.2-datanode.conf.j2    | 4 ++++
 .../templates/etc/graylog/datanode/6.3-datanode.conf.j2    | 4 ++++
 .../templates/etc/graylog/datanode/7.0-datanode.conf.j2    | 4 ++++
 6 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/roles/graylog_datanode/README.md b/roles/graylog_datanode/README.md
index d704a547..3063030e 100644
--- a/roles/graylog_datanode/README.md
+++ b/roles/graylog_datanode/README.md
@@ -90,6 +90,13 @@ graylog_datanode__password_secret: 'Linuxfabrik_GmbH'
 * Type: String.
 * Default: 50% of system memory, e.g. `'8g'`
 
+`graylog_datanode__path_repo`
+
+* Filesystem paths where searchable snapshots should be stored
+* Type: List of Strings
+* Default: `[]`
+
+
 `graylog_datanode__service_enabled`
 
 * Enables or disables the graylog-datanode service, analogous to `systemctl enable/disable --now`.
diff --git a/roles/graylog_datanode/defaults/main.yml b/roles/graylog_datanode/defaults/main.yml
index efb7081f..702df7d3 100644
--- a/roles/graylog_datanode/defaults/main.yml
+++ b/roles/graylog_datanode/defaults/main.yml
@@ -1,8 +1,9 @@
 graylog_datanode__bind_address: '127.0.0.1'
 graylog_datanode__datanode_http_port: 8999
+graylog_datanode__mongodb_uri: 'mongodb://127.0.0.1/graylog'
 graylog_datanode__opensearch_data_location: '/var/lib/graylog-datanode/opensearch/data'
 graylog_datanode__opensearch_heap: '{{ [((ansible_facts["memtotal_mb"] * 0.5) | int), 31744] | min }}m'
-graylog_datanode__mongodb_uri: 'mongodb://127.0.0.1/graylog'
+graylog_datanode__path_repo: []
 graylog_datanode__service_enabled: true
 
 # ------
diff --git a/roles/graylog_datanode/templates/etc/graylog/datanode/6.1-datanode.conf.j2 b/roles/graylog_datanode/templates/etc/graylog/datanode/6.1-datanode.conf.j2
index e99cb937..2be1544e 100644
--- a/roles/graylog_datanode/templates/etc/graylog/datanode/6.1-datanode.conf.j2
+++ b/roles/graylog_datanode/templates/etc/graylog/datanode/6.1-datanode.conf.j2
@@ -163,3 +163,7 @@ opensearch_logs_location = /var/log/graylog-datanode/opensearch
 # indexer_jwt_auth_token_expiration_duration = 180s
 
 opensearch_heap = {{ graylog_datanode__opensearch_heap }}
+
+#### Data Tiering Properties
+
+path_repo = {{ graylog_datanode__path_repo | join(',') }}
diff --git a/roles/graylog_datanode/templates/etc/graylog/datanode/6.2-datanode.conf.j2 b/roles/graylog_datanode/templates/etc/graylog/datanode/6.2-datanode.conf.j2
index 21d6e67a..b0617fa5 100644
--- a/roles/graylog_datanode/templates/etc/graylog/datanode/6.2-datanode.conf.j2
+++ b/roles/graylog_datanode/templates/etc/graylog/datanode/6.2-datanode.conf.j2
@@ -163,3 +163,7 @@ opensearch_logs_location = /var/log/graylog-datanode/opensearch
 # indexer_jwt_auth_token_expiration_duration = 180s
 
 opensearch_heap = {{ graylog_datanode__opensearch_heap }}
+
+#### Data Tiering Properties
+
+path_repo = {{ graylog_datanode__path_repo | join(',') }}
diff --git a/roles/graylog_datanode/templates/etc/graylog/datanode/6.3-datanode.conf.j2 b/roles/graylog_datanode/templates/etc/graylog/datanode/6.3-datanode.conf.j2
index 1424bde3..22c3f29f 100644
--- a/roles/graylog_datanode/templates/etc/graylog/datanode/6.3-datanode.conf.j2
+++ b/roles/graylog_datanode/templates/etc/graylog/datanode/6.3-datanode.conf.j2
@@ -163,3 +163,7 @@ opensearch_logs_location = /var/log/graylog-datanode/opensearch
 # indexer_jwt_auth_token_expiration_duration = 180s
 
 opensearch_heap = {{ graylog_datanode__opensearch_heap }}
+
+#### Data Tiering Properties
+
+path_repo = {{ graylog_datanode__path_repo | join(',') }}
diff --git a/roles/graylog_datanode/templates/etc/graylog/datanode/7.0-datanode.conf.j2 b/roles/graylog_datanode/templates/etc/graylog/datanode/7.0-datanode.conf.j2
index 7dd1adf6..c838d0ed 100644
--- a/roles/graylog_datanode/templates/etc/graylog/datanode/7.0-datanode.conf.j2
+++ b/roles/graylog_datanode/templates/etc/graylog/datanode/7.0-datanode.conf.j2
@@ -163,3 +163,7 @@ opensearch_logs_location = /var/log/graylog-datanode/opensearch
 # indexer_jwt_auth_token_expiration_duration = 180s
 
 opensearch_heap = {{ graylog_datanode__opensearch_heap }}
+
+#### Data Tiering Properties
+
+path_repo = {{ graylog_datanode__path_repo | join(',') }}

From 6f6e08ff3742b704ac66e4d32bab9566acecd091 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Eric=20B=C3=BCrki?= <eric.buerki@linuxfabrik.ch>
Date: Thu, 26 Mar 2026 19:01:31 +0100
Subject: [PATCH 04/10] fix assert logic

---
 roles/graylog_datanode/tasks/main.yml | 6 +++---
 roles/graylog_server/tasks/main.yml   | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/roles/graylog_datanode/tasks/main.yml b/roles/graylog_datanode/tasks/main.yml
index 04a3bb8a..afe56b34 100644
--- a/roles/graylog_datanode/tasks/main.yml
+++ b/roles/graylog_datanode/tasks/main.yml
@@ -1,10 +1,10 @@
 - block:
 
-  - name: 'Validate that graylog_datanode__password_secret length > 16 characters'
+  - name: 'Validate that graylog_datanode__password_secret length >= 16 characters'
     ansible.builtin.assert:
       that:
-        - 'graylog_datanode__password_secret | length > 16'
-      fail_msg: 'graylog_datanode__password_secret must be longer than 16 characters'
+        - 'graylog_datanode__password_secret | length >= 16'
+      fail_msg: 'graylog_datanode__password_secret must at least 16 characters'
       quiet: true
 
   tags:
diff --git a/roles/graylog_server/tasks/main.yml b/roles/graylog_server/tasks/main.yml
index 72d8b52d..f42f6af3 100644
--- a/roles/graylog_server/tasks/main.yml
+++ b/roles/graylog_server/tasks/main.yml
@@ -1,10 +1,10 @@
 - block:
 
-  - name: 'Validate that graylog_server__password_secret length > 16 characters'
+  - name: 'Validate that graylog_server__password_secret length >= 16 characters'
     ansible.builtin.assert:
       that:
-        - 'graylog_server__password_secret | length > 16'
-      fail_msg: 'graylog_server__password_secret must be longer than 16 characters'
+        - 'graylog_server__password_secret | length >= 16'
+      fail_msg: 'graylog_server__password_secret must be at least 16 characters'
       quiet: true
 
   tags:

From 00b14f7cdb538a0b133861bf35c4bfef16fde9ff Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Eric=20B=C3=BCrki?= <eric.buerki@linuxfabrik.ch>
Date: Thu, 26 Mar 2026 19:30:33 +0100
Subject: [PATCH 05/10] update docs, add setting for
 graylog_datanode__node_search_cache_size

---
 roles/graylog_datanode/defaults/main.yml         |  1 +
 roles/graylog_datanode/tasks/main.yml            | 16 ++++++++++++++++
 .../etc/graylog/datanode/6.1-datanode.conf.j2    |  1 +
 .../etc/graylog/datanode/6.2-datanode.conf.j2    |  1 +
 .../etc/graylog/datanode/6.3-datanode.conf.j2    |  1 +
 .../etc/graylog/datanode/7.0-datanode.conf.j2    |  1 +
 6 files changed, 21 insertions(+)

diff --git a/roles/graylog_datanode/defaults/main.yml b/roles/graylog_datanode/defaults/main.yml
index 702df7d3..7959e793 100644
--- a/roles/graylog_datanode/defaults/main.yml
+++ b/roles/graylog_datanode/defaults/main.yml
@@ -1,6 +1,7 @@
 graylog_datanode__bind_address: '127.0.0.1'
 graylog_datanode__datanode_http_port: 8999
 graylog_datanode__mongodb_uri: 'mongodb://127.0.0.1/graylog'
+graylog_datanode__node_search_cache_size: '10gb'
 graylog_datanode__opensearch_data_location: '/var/lib/graylog-datanode/opensearch/data'
 graylog_datanode__opensearch_heap: '{{ [((ansible_facts["memtotal_mb"] * 0.5) | int), 31744] | min }}m'
 graylog_datanode__path_repo: []
diff --git a/roles/graylog_datanode/tasks/main.yml b/roles/graylog_datanode/tasks/main.yml
index afe56b34..2d1d8a36 100644
--- a/roles/graylog_datanode/tasks/main.yml
+++ b/roles/graylog_datanode/tasks/main.yml
@@ -7,6 +7,13 @@
       fail_msg: 'graylog_datanode__password_secret must at least 16 characters'
       quiet: true
 
+  - name: 'Validate graylog_datanode__node_search_cache_size'
+    ansible.builtin.assert:
+      that:
+        - 'graylog_datanode__password_secret | length >= 16'
+      fail_msg: 'graylog_datanode__password_secret must at least 16 characters'
+      quiet: true
+
   tags:
     - 'graylog_datanode'
     - 'graylog_datanode:configure'
@@ -75,6 +82,15 @@
       group: 'graylog-datanode'
       mode: 0o755
 
+  - name: 'mkdir -p {{ item }}; chown graylog-datanode:graylog-datanode {{ item }}'
+    ansible.builtin.file:
+      path: '{{ item }}'
+      state: 'directory'
+      owner: 'graylog-datanode'
+      group: 'graylog-datanode'
+      mode: 0o755
+    loop: '{{ graylog_datanode__path_repo }}'
+
   tags:
     - 'graylog_datanode'
     - 'graylog_datanode:configure'
diff --git a/roles/graylog_datanode/templates/etc/graylog/datanode/6.1-datanode.conf.j2 b/roles/graylog_datanode/templates/etc/graylog/datanode/6.1-datanode.conf.j2
index 2be1544e..a4190828 100644
--- a/roles/graylog_datanode/templates/etc/graylog/datanode/6.1-datanode.conf.j2
+++ b/roles/graylog_datanode/templates/etc/graylog/datanode/6.1-datanode.conf.j2
@@ -166,4 +166,5 @@ opensearch_heap = {{ graylog_datanode__opensearch_heap }}
 
 #### Data Tiering Properties
 
+node_search_cache_size = {{ graylog_datanode__node_search_cache_size }}
 path_repo = {{ graylog_datanode__path_repo | join(',') }}
diff --git a/roles/graylog_datanode/templates/etc/graylog/datanode/6.2-datanode.conf.j2 b/roles/graylog_datanode/templates/etc/graylog/datanode/6.2-datanode.conf.j2
index b0617fa5..5432efa1 100644
--- a/roles/graylog_datanode/templates/etc/graylog/datanode/6.2-datanode.conf.j2
+++ b/roles/graylog_datanode/templates/etc/graylog/datanode/6.2-datanode.conf.j2
@@ -166,4 +166,5 @@ opensearch_heap = {{ graylog_datanode__opensearch_heap }}
 
 #### Data Tiering Properties
 
+node_search_cache_size = {{ graylog_datanode__node_search_cache_size }}
 path_repo = {{ graylog_datanode__path_repo | join(',') }}
diff --git a/roles/graylog_datanode/templates/etc/graylog/datanode/6.3-datanode.conf.j2 b/roles/graylog_datanode/templates/etc/graylog/datanode/6.3-datanode.conf.j2
index 22c3f29f..24c4be2d 100644
--- a/roles/graylog_datanode/templates/etc/graylog/datanode/6.3-datanode.conf.j2
+++ b/roles/graylog_datanode/templates/etc/graylog/datanode/6.3-datanode.conf.j2
@@ -166,4 +166,5 @@ opensearch_heap = {{ graylog_datanode__opensearch_heap }}
 
 #### Data Tiering Properties
 
+node_search_cache_size = {{ graylog_datanode__node_search_cache_size }}
 path_repo = {{ graylog_datanode__path_repo | join(',') }}
diff --git a/roles/graylog_datanode/templates/etc/graylog/datanode/7.0-datanode.conf.j2 b/roles/graylog_datanode/templates/etc/graylog/datanode/7.0-datanode.conf.j2
index c838d0ed..ccdfa907 100644
--- a/roles/graylog_datanode/templates/etc/graylog/datanode/7.0-datanode.conf.j2
+++ b/roles/graylog_datanode/templates/etc/graylog/datanode/7.0-datanode.conf.j2
@@ -166,4 +166,5 @@ opensearch_heap = {{ graylog_datanode__opensearch_heap }}
 
 #### Data Tiering Properties
 
+node_search_cache_size = {{ graylog_datanode__node_search_cache_size }}
 path_repo = {{ graylog_datanode__path_repo | join(',') }}

From d189bb14d6a02ef9458c4c919c90dd0c7935fb71 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Eric=20B=C3=BCrki?= <eric.buerki@linuxfabrik.ch>
Date: Thu, 26 Mar 2026 23:04:31 +0100
Subject: [PATCH 06/10] add validation and readme entry for
 graylog_datanode__node_search_cache_size

---
 roles/graylog_datanode/README.md      | 1 -
 roles/graylog_datanode/tasks/main.yml | 7 +++++++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/roles/graylog_datanode/README.md b/roles/graylog_datanode/README.md
index 3063030e..7989d289 100644
--- a/roles/graylog_datanode/README.md
+++ b/roles/graylog_datanode/README.md
@@ -96,7 +96,6 @@ graylog_datanode__password_secret: 'Linuxfabrik_GmbH'
 * Type: List of Strings
 * Default: `[]`
 
-
 `graylog_datanode__service_enabled`
 
 * Enables or disables the graylog-datanode service, analogous to `systemctl enable/disable --now`.
diff --git a/roles/graylog_datanode/tasks/main.yml b/roles/graylog_datanode/tasks/main.yml
index 2d1d8a36..a7bcd4ea 100644
--- a/roles/graylog_datanode/tasks/main.yml
+++ b/roles/graylog_datanode/tasks/main.yml
@@ -14,6 +14,13 @@
       fail_msg: 'graylog_datanode__password_secret must at least 16 characters'
       quiet: true
 
+  - name: 'Validate that graylog_datanode__node_search_cache_size follows OpenSearch Bytes format'
+    ansible.builtin.assert:
+      that:
+      -  'graylog_datanode__node_search_cache_size | regex_search("^[0-9]+(b|kb|mb|gb|tb|pb)$")'
+      fail_msg: '"{{ graylog_datanode__node_search_cache_size }}" does not follow OpenSearch Bytes format'
+      quiet: true
+
   tags:
     - 'graylog_datanode'
     - 'graylog_datanode:configure'

From b609b699d3b24aa49f0da3070c3fbeb6989efa1e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Eric=20B=C3=BCrki?= <eric.buerki@linuxfabrik.ch>
Date: Fri, 27 Mar 2026 11:42:24 +0100
Subject: [PATCH 07/10] remove invalid assert

---
 roles/graylog_datanode/tasks/main.yml | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/roles/graylog_datanode/tasks/main.yml b/roles/graylog_datanode/tasks/main.yml
index a7bcd4ea..6d6e4907 100644
--- a/roles/graylog_datanode/tasks/main.yml
+++ b/roles/graylog_datanode/tasks/main.yml
@@ -7,13 +7,6 @@
       fail_msg: 'graylog_datanode__password_secret must at least 16 characters'
       quiet: true
 
-  - name: 'Validate graylog_datanode__node_search_cache_size'
-    ansible.builtin.assert:
-      that:
-        - 'graylog_datanode__password_secret | length >= 16'
-      fail_msg: 'graylog_datanode__password_secret must at least 16 characters'
-      quiet: true
-
   - name: 'Validate that graylog_datanode__node_search_cache_size follows OpenSearch Bytes format'
     ansible.builtin.assert:
       that:

From 5a54dd2c4efbabbc5e3fb196b8940b6996e36f28 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Eric=20B=C3=BCrki?= <eric.buerki@linuxfabrik.ch>
Date: Fri, 27 Mar 2026 16:06:39 +0100
Subject: [PATCH 08/10] fix(roles/graylog_server): update server configuration
 to disable telemetry

---
 .../templates/etc/graylog/server/6.1-server.conf.j2       | 8 +++++++-
 .../templates/etc/graylog/server/6.2-server.conf.j2       | 8 +++++++-
 .../templates/etc/graylog/server/6.3-server.conf.j2       | 8 +++++++-
 .../templates/etc/graylog/server/7.0-server.conf.j2       | 8 +++++++-
 4 files changed, 28 insertions(+), 4 deletions(-)

diff --git a/roles/graylog_server/templates/etc/graylog/server/6.1-server.conf.j2 b/roles/graylog_server/templates/etc/graylog/server/6.1-server.conf.j2
index 363453b5..297e607b 100644
--- a/roles/graylog_server/templates/etc/graylog/server/6.1-server.conf.j2
+++ b/roles/graylog_server/templates/etc/graylog/server/6.1-server.conf.j2
@@ -1,5 +1,5 @@
 # {{ ansible_managed }}
-# 2026012102
+# 2026032701
 # 6.1
 ############################
 # GRAYLOG CONFIGURATION FILE
@@ -781,3 +781,9 @@ integrations_scripts_dir = /usr/share/graylog-server/scripts
 #   event-processor-execution-v1
 #   notification-execution-v1
 #job_scheduler_concurrency_limits = event-processor-execution-v1:2,notification-execution-v1:2
+
+##################
+# Privacy settings
+##################
+
+telemetry_enabled = false
diff --git a/roles/graylog_server/templates/etc/graylog/server/6.2-server.conf.j2 b/roles/graylog_server/templates/etc/graylog/server/6.2-server.conf.j2
index a61976a5..3ce0e256 100644
--- a/roles/graylog_server/templates/etc/graylog/server/6.2-server.conf.j2
+++ b/roles/graylog_server/templates/etc/graylog/server/6.2-server.conf.j2
@@ -1,5 +1,5 @@
 # {{ ansible_managed }}
-# 2026012102
+# 2026032701
 # 6.2
 ############################
 # GRAYLOG CONFIGURATION FILE
@@ -815,3 +815,9 @@ integrations_scripts_dir = /usr/share/graylog-server/scripts
 #          instability. Proceed with caution.
 # Default: 0
 #search_query_engine_data_lake_jobs_queue_size = 0
+
+##################
+# Privacy settings
+##################
+
+telemetry_enabled = false
diff --git a/roles/graylog_server/templates/etc/graylog/server/6.3-server.conf.j2 b/roles/graylog_server/templates/etc/graylog/server/6.3-server.conf.j2
index 7ff391eb..bb71f9bc 100644
--- a/roles/graylog_server/templates/etc/graylog/server/6.3-server.conf.j2
+++ b/roles/graylog_server/templates/etc/graylog/server/6.3-server.conf.j2
@@ -1,5 +1,5 @@
 # {{ ansible_managed }}
-# 2026012102
+# 2026032701
 # 6.3
 ############################
 # GRAYLOG CONFIGURATION FILE
@@ -815,3 +815,9 @@ integrations_scripts_dir = /usr/share/graylog-server/scripts
 #          instability. Proceed with caution.
 # Default: 0
 #search_query_engine_data_lake_jobs_queue_size = 0
+
+##################
+# Privacy settings
+##################
+
+telemetry_enabled = false
diff --git a/roles/graylog_server/templates/etc/graylog/server/7.0-server.conf.j2 b/roles/graylog_server/templates/etc/graylog/server/7.0-server.conf.j2
index d1513278..7f4aaeb4 100644
--- a/roles/graylog_server/templates/etc/graylog/server/7.0-server.conf.j2
+++ b/roles/graylog_server/templates/etc/graylog/server/7.0-server.conf.j2
@@ -1,5 +1,5 @@
 # {{ ansible_managed }}
-# 2026012102
+# 2026032701
 # 7.0
 ############################
 # GRAYLOG CONFIGURATION FILE
@@ -819,3 +819,9 @@ integrations_scripts_dir = /usr/share/graylog-server/scripts
 #          instability. Proceed with caution.
 # Default: 0
 #search_query_engine_data_lake_jobs_queue_size = 0
+
+##################
+# Privacy settings
+##################
+
+telemetry_enabled = false

From df27a8ae598d542f813e960fd539fd5f95c9eba1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Eric=20B=C3=BCrki?= <eric.buerki@linuxfabrik.ch>
Date: Fri, 27 Mar 2026 17:55:26 +0100
Subject: [PATCH 09/10] fix(roles/graylog_datanode): restrict permissions for
 snapshot repo paths

---
 roles/graylog_datanode/tasks/main.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roles/graylog_datanode/tasks/main.yml b/roles/graylog_datanode/tasks/main.yml
index 6d6e4907..3ed0ca87 100644
--- a/roles/graylog_datanode/tasks/main.yml
+++ b/roles/graylog_datanode/tasks/main.yml
@@ -88,7 +88,7 @@
       state: 'directory'
       owner: 'graylog-datanode'
       group: 'graylog-datanode'
-      mode: 0o755
+      mode: 0o740
     loop: '{{ graylog_datanode__path_repo }}'
 
   tags:

From a2dcb75862bf1cd2deb16b06fc3c53d72ee29a12 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Eric=20B=C3=BCrki?= <eric.buerki@linuxfabrik.ch>
Date: Tue, 7 Apr 2026 18:17:35 +0200
Subject: [PATCH 10/10] fix(roles/graylog_datanode): extend datanode
 configuration options to allow __raw configs

---
 roles/graylog_datanode/README.md                      | 11 +++++++++++
 .../etc/graylog/datanode/6.1-datanode.conf.j2         |  5 +++++
 .../etc/graylog/datanode/6.2-datanode.conf.j2         |  5 +++++
 .../etc/graylog/datanode/6.3-datanode.conf.j2         |  5 +++++
 .../etc/graylog/datanode/7.0-datanode.conf.j2         |  5 +++++
 5 files changed, 31 insertions(+)

diff --git a/roles/graylog_datanode/README.md b/roles/graylog_datanode/README.md
index 7989d289..76342099 100644
--- a/roles/graylog_datanode/README.md
+++ b/roles/graylog_datanode/README.md
@@ -78,6 +78,12 @@ graylog_datanode__password_secret: 'Linuxfabrik_GmbH'
 * Type: String.
 * Default: `'mongodb://127.0.0.1/graylog'`
 
+`graylog_datanode__node_search_cache_size`
+
+* Cache size for searchable snaphots. This space will be automatically reserved if `graylog_datanode__path_repo` is configured. See [docs.opensearch.org - Supported Units](https://docs.opensearch.org/latest/api-reference/units/) for a list of possible options. 
+* Type: String
+* Default: `10gb`
+
 `graylog_datanode__opensearch_data_location`
 
 * Set this OpenSearch folder if you need OpenSearch to be located in a special place.
@@ -96,6 +102,11 @@ graylog_datanode__password_secret: 'Linuxfabrik_GmbH'
 * Type: List of Strings
 * Default: `[]`
 
+`graylog_datanode__raw`
+* Multiline string. Raw content which will be appended to the `datanode.conf` config file.
+* Type: String
+* Default: unset
+
 `graylog_datanode__service_enabled`
 
 * Enables or disables the graylog-datanode service, analogous to `systemctl enable/disable --now`.
diff --git a/roles/graylog_datanode/templates/etc/graylog/datanode/6.1-datanode.conf.j2 b/roles/graylog_datanode/templates/etc/graylog/datanode/6.1-datanode.conf.j2
index a4190828..3603dcdc 100644
--- a/roles/graylog_datanode/templates/etc/graylog/datanode/6.1-datanode.conf.j2
+++ b/roles/graylog_datanode/templates/etc/graylog/datanode/6.1-datanode.conf.j2
@@ -168,3 +168,8 @@ opensearch_heap = {{ graylog_datanode__opensearch_heap }}
 
 node_search_cache_size = {{ graylog_datanode__node_search_cache_size }}
 path_repo = {{ graylog_datanode__path_repo | join(',') }}
+
+{% if graylog_datanode__raw is defined and graylog_datanode__raw | length %}
+#### Raw ####
+{{ graylog_datanode__raw }}
+{% endif %}
diff --git a/roles/graylog_datanode/templates/etc/graylog/datanode/6.2-datanode.conf.j2 b/roles/graylog_datanode/templates/etc/graylog/datanode/6.2-datanode.conf.j2
index 5432efa1..37275f0c 100644
--- a/roles/graylog_datanode/templates/etc/graylog/datanode/6.2-datanode.conf.j2
+++ b/roles/graylog_datanode/templates/etc/graylog/datanode/6.2-datanode.conf.j2
@@ -168,3 +168,8 @@ opensearch_heap = {{ graylog_datanode__opensearch_heap }}
 
 node_search_cache_size = {{ graylog_datanode__node_search_cache_size }}
 path_repo = {{ graylog_datanode__path_repo | join(',') }}
+
+{% if graylog_datanode__raw is defined and graylog_datanode__raw | length %}
+#### Raw ####
+{{ graylog_datanode__raw }}
+{% endif %}
diff --git a/roles/graylog_datanode/templates/etc/graylog/datanode/6.3-datanode.conf.j2 b/roles/graylog_datanode/templates/etc/graylog/datanode/6.3-datanode.conf.j2
index 24c4be2d..18339c90 100644
--- a/roles/graylog_datanode/templates/etc/graylog/datanode/6.3-datanode.conf.j2
+++ b/roles/graylog_datanode/templates/etc/graylog/datanode/6.3-datanode.conf.j2
@@ -168,3 +168,8 @@ opensearch_heap = {{ graylog_datanode__opensearch_heap }}
 
 node_search_cache_size = {{ graylog_datanode__node_search_cache_size }}
 path_repo = {{ graylog_datanode__path_repo | join(',') }}
+
+{% if graylog_datanode__raw is defined and graylog_datanode__raw | length %}
+#### Raw ####
+{{ graylog_datanode__raw }}
+{% endif %}
diff --git a/roles/graylog_datanode/templates/etc/graylog/datanode/7.0-datanode.conf.j2 b/roles/graylog_datanode/templates/etc/graylog/datanode/7.0-datanode.conf.j2
index ccdfa907..b9820742 100644
--- a/roles/graylog_datanode/templates/etc/graylog/datanode/7.0-datanode.conf.j2
+++ b/roles/graylog_datanode/templates/etc/graylog/datanode/7.0-datanode.conf.j2
@@ -168,3 +168,8 @@ opensearch_heap = {{ graylog_datanode__opensearch_heap }}
 
 node_search_cache_size = {{ graylog_datanode__node_search_cache_size }}
 path_repo = {{ graylog_datanode__path_repo | join(',') }}
+
+{% if graylog_datanode__raw is defined and graylog_datanode__raw | length %}
+#### Raw ####
+{{ graylog_datanode__raw }}
+{% endif %}