From cd023603b0c34b352de04e11d6a107f4d9ae5f5f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Eric=20B=C3=BCrki?= <eric.buerki@linuxfabrik.ch>
Date: Tue, 17 Feb 2026 14:32:42 +0100
Subject: [PATCH 1/9] feat(roles/graylog_datanode): add validation for
 graylog_datanode__password_secret length

---
 roles/graylog_datanode/tasks/main.yml | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/roles/graylog_datanode/tasks/main.yml b/roles/graylog_datanode/tasks/main.yml
index fb353ecde..6bd80c3c1 100644
--- a/roles/graylog_datanode/tasks/main.yml
+++ b/roles/graylog_datanode/tasks/main.yml
@@ -1,3 +1,16 @@
+- block:
+
+  - name: 'Validate that graylog_datanode__password_secret length > 16 characters'
+    ansible.builtin.assert:
+      that:
+        - 'graylog_datanode__password_secret | length > 16'
+      fail_msg: 'graylog_datanode__password_secret must be longer than 16 characters'
+      quiet: true
+
+  tags:
+    - 'graylog_datanode'
+    - 'graylog_datanode:configure'
+
 - block:
 
   - name: 'Install graylog-datanode'

From e8eb393d4c730cf322188aac78214f21589dd3da Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Eric=20B=C3=BCrki?= <eric.buerki@linuxfabrik.ch>
Date: Tue, 17 Feb 2026 14:33:33 +0100
Subject: [PATCH 2/9] feat(roles/graylog_server): add validation for
 graylog_server__password_secret length

---
 roles/graylog_server/tasks/main.yml | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/roles/graylog_server/tasks/main.yml b/roles/graylog_server/tasks/main.yml
index c97605877..e0a1f5786 100644
--- a/roles/graylog_server/tasks/main.yml
+++ b/roles/graylog_server/tasks/main.yml
@@ -1,3 +1,16 @@
+- block:
+
+  - name: 'Validate that graylog_server__password_secret length > 16 characters'
+    ansible.builtin.assert:
+      that:
+        - 'graylog_server__password_secret | length > 16'
+      fail_msg: 'graylog_server__password_secret must be longer than 16 characters'
+      quiet: true
+
+  tags:
+    - 'graylog_server'
+    - 'graylog_server:configure'
+
 - block:
 
   - name: 'Install graylog-server'

From 654538a367d22089361a2c2990395df047797c75 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Eric=20B=C3=BCrki?= <eric.buerki@linuxfabrik.ch>
Date: Tue, 17 Feb 2026 17:46:00 +0100
Subject: [PATCH 3/9] feat(roles/graylog_datanode): allow users to specify
 path_node variable in datanode.conf

---
 roles/graylog_datanode/README.md                              | 2 ++
 roles/graylog_datanode/defaults/main.yml                      | 3 ++-
 .../templates/etc/graylog/datanode/6.1-datanode.conf.j2       | 4 ++++
 .../templates/etc/graylog/datanode/6.2-datanode.conf.j2       | 4 ++++
 .../templates/etc/graylog/datanode/6.3-datanode.conf.j2       | 4 ++++
 .../templates/etc/graylog/datanode/7.0-datanode.conf.j2       | 4 ++++
 6 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/roles/graylog_datanode/README.md b/roles/graylog_datanode/README.md
index 7c381f9e3..e1294922f 100644
--- a/roles/graylog_datanode/README.md
+++ b/roles/graylog_datanode/README.md
@@ -56,6 +56,8 @@ graylog_datanode__password_secret: 'Linuxfabrik_GmbH'
 | `graylog_datanode__mongodb_uri`  | String. MongoDB connection string. See https://docs.mongodb.com/manual/reference/connection-string/ for details. | `'mongodb://127.0.0.1/graylog'` |
 | `graylog_datanode__opensearch_data_location` | String. Set this OpenSearch folder if you need OpenSearch to be located in a special place. | `/var/lib/graylog-datanode/opensearch/data` |
 | `graylog_datanode__opensearch_heap` | String. Ensure the heap settings are set to half your system memory, up to a max of 31 GB. | 50% of system memory, e.g. 8g |
+| `graylog_datanode__path_repo` | Filesystem paths where searchable snapshots should be stored. | `[]` |
+| `graylog_datanode__service_enabled` | Enables or disables the opensearch service, analogous to ``systemctl enable/disable --now``. | `true` |
 
 Example:
 ```yaml
diff --git a/roles/graylog_datanode/defaults/main.yml b/roles/graylog_datanode/defaults/main.yml
index efb7081f6..702df7d3f 100644
--- a/roles/graylog_datanode/defaults/main.yml
+++ b/roles/graylog_datanode/defaults/main.yml
@@ -1,8 +1,9 @@
 graylog_datanode__bind_address: '127.0.0.1'
 graylog_datanode__datanode_http_port: 8999
+graylog_datanode__mongodb_uri: 'mongodb://127.0.0.1/graylog'
 graylog_datanode__opensearch_data_location: '/var/lib/graylog-datanode/opensearch/data'
 graylog_datanode__opensearch_heap: '{{ [((ansible_facts["memtotal_mb"] * 0.5) | int), 31744] | min }}m'
-graylog_datanode__mongodb_uri: 'mongodb://127.0.0.1/graylog'
+graylog_datanode__path_repo: []
 graylog_datanode__service_enabled: true
 
 # ------
diff --git a/roles/graylog_datanode/templates/etc/graylog/datanode/6.1-datanode.conf.j2 b/roles/graylog_datanode/templates/etc/graylog/datanode/6.1-datanode.conf.j2
index e99cb9371..2be1544ec 100644
--- a/roles/graylog_datanode/templates/etc/graylog/datanode/6.1-datanode.conf.j2
+++ b/roles/graylog_datanode/templates/etc/graylog/datanode/6.1-datanode.conf.j2
@@ -163,3 +163,7 @@ opensearch_logs_location = /var/log/graylog-datanode/opensearch
 # indexer_jwt_auth_token_expiration_duration = 180s
 
 opensearch_heap = {{ graylog_datanode__opensearch_heap }}
+
+#### Data Tiering Properties
+
+path_repo = {{ graylog_datanode__path_repo | join(',') }}
diff --git a/roles/graylog_datanode/templates/etc/graylog/datanode/6.2-datanode.conf.j2 b/roles/graylog_datanode/templates/etc/graylog/datanode/6.2-datanode.conf.j2
index 21d6e67ab..b0617fa58 100644
--- a/roles/graylog_datanode/templates/etc/graylog/datanode/6.2-datanode.conf.j2
+++ b/roles/graylog_datanode/templates/etc/graylog/datanode/6.2-datanode.conf.j2
@@ -163,3 +163,7 @@ opensearch_logs_location = /var/log/graylog-datanode/opensearch
 # indexer_jwt_auth_token_expiration_duration = 180s
 
 opensearch_heap = {{ graylog_datanode__opensearch_heap }}
+
+#### Data Tiering Properties
+
+path_repo = {{ graylog_datanode__path_repo | join(',') }}
diff --git a/roles/graylog_datanode/templates/etc/graylog/datanode/6.3-datanode.conf.j2 b/roles/graylog_datanode/templates/etc/graylog/datanode/6.3-datanode.conf.j2
index 1424bde31..22c3f29f0 100644
--- a/roles/graylog_datanode/templates/etc/graylog/datanode/6.3-datanode.conf.j2
+++ b/roles/graylog_datanode/templates/etc/graylog/datanode/6.3-datanode.conf.j2
@@ -163,3 +163,7 @@ opensearch_logs_location = /var/log/graylog-datanode/opensearch
 # indexer_jwt_auth_token_expiration_duration = 180s
 
 opensearch_heap = {{ graylog_datanode__opensearch_heap }}
+
+#### Data Tiering Properties
+
+path_repo = {{ graylog_datanode__path_repo | join(',') }}
diff --git a/roles/graylog_datanode/templates/etc/graylog/datanode/7.0-datanode.conf.j2 b/roles/graylog_datanode/templates/etc/graylog/datanode/7.0-datanode.conf.j2
index 7dd1adf6c..c838d0eda 100644
--- a/roles/graylog_datanode/templates/etc/graylog/datanode/7.0-datanode.conf.j2
+++ b/roles/graylog_datanode/templates/etc/graylog/datanode/7.0-datanode.conf.j2
@@ -163,3 +163,7 @@ opensearch_logs_location = /var/log/graylog-datanode/opensearch
 # indexer_jwt_auth_token_expiration_duration = 180s
 
 opensearch_heap = {{ graylog_datanode__opensearch_heap }}
+
+#### Data Tiering Properties
+
+path_repo = {{ graylog_datanode__path_repo | join(',') }}

From acc92cd466e3a62ebc31e42e8a4bb138dacb54a0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Eric=20B=C3=BCrki?= <eric.buerki@linuxfabrik.ch>
Date: Thu, 26 Mar 2026 19:01:31 +0100
Subject: [PATCH 4/9] fix assert logic

---
 roles/graylog_datanode/tasks/main.yml | 6 +++---
 roles/graylog_server/tasks/main.yml   | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/roles/graylog_datanode/tasks/main.yml b/roles/graylog_datanode/tasks/main.yml
index 6bd80c3c1..a5c820917 100644
--- a/roles/graylog_datanode/tasks/main.yml
+++ b/roles/graylog_datanode/tasks/main.yml
@@ -1,10 +1,10 @@
 - block:
 
-  - name: 'Validate that graylog_datanode__password_secret length > 16 characters'
+  - name: 'Validate that graylog_datanode__password_secret length >= 16 characters'
     ansible.builtin.assert:
       that:
-        - 'graylog_datanode__password_secret | length > 16'
-      fail_msg: 'graylog_datanode__password_secret must be longer than 16 characters'
+        - 'graylog_datanode__password_secret | length >= 16'
+      fail_msg: 'graylog_datanode__password_secret must at least 16 characters'
       quiet: true
 
   tags:
diff --git a/roles/graylog_server/tasks/main.yml b/roles/graylog_server/tasks/main.yml
index e0a1f5786..64926111c 100644
--- a/roles/graylog_server/tasks/main.yml
+++ b/roles/graylog_server/tasks/main.yml
@@ -1,10 +1,10 @@
 - block:
 
-  - name: 'Validate that graylog_server__password_secret length > 16 characters'
+  - name: 'Validate that graylog_server__password_secret length >= 16 characters'
     ansible.builtin.assert:
       that:
-        - 'graylog_server__password_secret | length > 16'
-      fail_msg: 'graylog_server__password_secret must be longer than 16 characters'
+        - 'graylog_server__password_secret | length >= 16'
+      fail_msg: 'graylog_server__password_secret must be at least 16 characters'
       quiet: true
 
   tags:

From 0b14c0edc9b30af91c9ed7c53f6e02f00bc0ca52 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Eric=20B=C3=BCrki?= <eric.buerki@linuxfabrik.ch>
Date: Thu, 26 Mar 2026 19:30:33 +0100
Subject: [PATCH 5/9] update docs, add setting for
 graylog_datanode__node_search_cache_size

---
 roles/graylog_datanode/README.md                 |  1 +
 roles/graylog_datanode/defaults/main.yml         |  1 +
 roles/graylog_datanode/tasks/main.yml            | 16 ++++++++++++++++
 .../etc/graylog/datanode/6.1-datanode.conf.j2    |  1 +
 .../etc/graylog/datanode/6.2-datanode.conf.j2    |  1 +
 .../etc/graylog/datanode/6.3-datanode.conf.j2    |  1 +
 .../etc/graylog/datanode/7.0-datanode.conf.j2    |  1 +
 7 files changed, 22 insertions(+)

diff --git a/roles/graylog_datanode/README.md b/roles/graylog_datanode/README.md
index e1294922f..0de605396 100644
--- a/roles/graylog_datanode/README.md
+++ b/roles/graylog_datanode/README.md
@@ -53,6 +53,7 @@ graylog_datanode__password_secret: 'Linuxfabrik_GmbH'
 | -------- | ----------- | ------------- |
 | `graylog_datanode__bind_address` | String. The network interface used by the Graylog DataNode to bind all services. | `'127.0.0.1'` |
 | `graylog_datanode__http_port`    | Number. The port where the DataNode REST api is listening. | `8999` |
+| `graylog_datanode__node_search_cache_size` | Cache size for searchable snaphots. This space will be automatically reserved if `graylog_datanode__path_repo` is configured | `10gb` |
 | `graylog_datanode__mongodb_uri`  | String. MongoDB connection string. See https://docs.mongodb.com/manual/reference/connection-string/ for details. | `'mongodb://127.0.0.1/graylog'` |
 | `graylog_datanode__opensearch_data_location` | String. Set this OpenSearch folder if you need OpenSearch to be located in a special place. | `/var/lib/graylog-datanode/opensearch/data` |
 | `graylog_datanode__opensearch_heap` | String. Ensure the heap settings are set to half your system memory, up to a max of 31 GB. | 50% of system memory, e.g. 8g |
diff --git a/roles/graylog_datanode/defaults/main.yml b/roles/graylog_datanode/defaults/main.yml
index 702df7d3f..7959e793a 100644
--- a/roles/graylog_datanode/defaults/main.yml
+++ b/roles/graylog_datanode/defaults/main.yml
@@ -1,6 +1,7 @@
 graylog_datanode__bind_address: '127.0.0.1'
 graylog_datanode__datanode_http_port: 8999
 graylog_datanode__mongodb_uri: 'mongodb://127.0.0.1/graylog'
+graylog_datanode__node_search_cache_size: '10gb'
 graylog_datanode__opensearch_data_location: '/var/lib/graylog-datanode/opensearch/data'
 graylog_datanode__opensearch_heap: '{{ [((ansible_facts["memtotal_mb"] * 0.5) | int), 31744] | min }}m'
 graylog_datanode__path_repo: []
diff --git a/roles/graylog_datanode/tasks/main.yml b/roles/graylog_datanode/tasks/main.yml
index a5c820917..cd7e96394 100644
--- a/roles/graylog_datanode/tasks/main.yml
+++ b/roles/graylog_datanode/tasks/main.yml
@@ -7,6 +7,13 @@
       fail_msg: 'graylog_datanode__password_secret must at least 16 characters'
       quiet: true
 
+  - name: 'Validate graylog_datanode__node_search_cache_size'
+    ansible.builtin.assert:
+      that:
+        - 'graylog_datanode__password_secret | length >= 16'
+      fail_msg: 'graylog_datanode__password_secret must at least 16 characters'
+      quiet: true
+
   tags:
     - 'graylog_datanode'
     - 'graylog_datanode:configure'
@@ -73,6 +80,15 @@
       group: 'graylog-datanode'
       mode: 0o755
 
+  - name: 'mkdir -p {{ item }}; chown graylog-datanode:graylog-datanode {{ item }}'
+    ansible.builtin.file:
+      path: '{{ item }}'
+      state: 'directory'
+      owner: 'graylog-datanode'
+      group: 'graylog-datanode'
+      mode: 0o755
+    loop: '{{ graylog_datanode__path_repo }}'
+
   tags:
     - 'graylog_datanode'
     - 'graylog_datanode:configure'
diff --git a/roles/graylog_datanode/templates/etc/graylog/datanode/6.1-datanode.conf.j2 b/roles/graylog_datanode/templates/etc/graylog/datanode/6.1-datanode.conf.j2
index 2be1544ec..a4190828c 100644
--- a/roles/graylog_datanode/templates/etc/graylog/datanode/6.1-datanode.conf.j2
+++ b/roles/graylog_datanode/templates/etc/graylog/datanode/6.1-datanode.conf.j2
@@ -166,4 +166,5 @@ opensearch_heap = {{ graylog_datanode__opensearch_heap }}
 
 #### Data Tiering Properties
 
+node_search_cache_size = {{ graylog_datanode__node_search_cache_size }}
 path_repo = {{ graylog_datanode__path_repo | join(',') }}
diff --git a/roles/graylog_datanode/templates/etc/graylog/datanode/6.2-datanode.conf.j2 b/roles/graylog_datanode/templates/etc/graylog/datanode/6.2-datanode.conf.j2
index b0617fa58..5432efa1e 100644
--- a/roles/graylog_datanode/templates/etc/graylog/datanode/6.2-datanode.conf.j2
+++ b/roles/graylog_datanode/templates/etc/graylog/datanode/6.2-datanode.conf.j2
@@ -166,4 +166,5 @@ opensearch_heap = {{ graylog_datanode__opensearch_heap }}
 
 #### Data Tiering Properties
 
+node_search_cache_size = {{ graylog_datanode__node_search_cache_size }}
 path_repo = {{ graylog_datanode__path_repo | join(',') }}
diff --git a/roles/graylog_datanode/templates/etc/graylog/datanode/6.3-datanode.conf.j2 b/roles/graylog_datanode/templates/etc/graylog/datanode/6.3-datanode.conf.j2
index 22c3f29f0..24c4be2d6 100644
--- a/roles/graylog_datanode/templates/etc/graylog/datanode/6.3-datanode.conf.j2
+++ b/roles/graylog_datanode/templates/etc/graylog/datanode/6.3-datanode.conf.j2
@@ -166,4 +166,5 @@ opensearch_heap = {{ graylog_datanode__opensearch_heap }}
 
 #### Data Tiering Properties
 
+node_search_cache_size = {{ graylog_datanode__node_search_cache_size }}
 path_repo = {{ graylog_datanode__path_repo | join(',') }}
diff --git a/roles/graylog_datanode/templates/etc/graylog/datanode/7.0-datanode.conf.j2 b/roles/graylog_datanode/templates/etc/graylog/datanode/7.0-datanode.conf.j2
index c838d0eda..ccdfa9072 100644
--- a/roles/graylog_datanode/templates/etc/graylog/datanode/7.0-datanode.conf.j2
+++ b/roles/graylog_datanode/templates/etc/graylog/datanode/7.0-datanode.conf.j2
@@ -166,4 +166,5 @@ opensearch_heap = {{ graylog_datanode__opensearch_heap }}
 
 #### Data Tiering Properties
 
+node_search_cache_size = {{ graylog_datanode__node_search_cache_size }}
 path_repo = {{ graylog_datanode__path_repo | join(',') }}

From 19f72f31091f6d4278649b1e2f606caf9a6a4a51 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Eric=20B=C3=BCrki?= <eric.buerki@linuxfabrik.ch>
Date: Thu, 26 Mar 2026 23:04:31 +0100
Subject: [PATCH 6/9] add validation and readme entry for
 graylog_datanode__node_search_cache_size

---
 roles/graylog_datanode/README.md      | 2 +-
 roles/graylog_datanode/tasks/main.yml | 7 +++++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/roles/graylog_datanode/README.md b/roles/graylog_datanode/README.md
index 0de605396..eef8f940a 100644
--- a/roles/graylog_datanode/README.md
+++ b/roles/graylog_datanode/README.md
@@ -53,7 +53,7 @@ graylog_datanode__password_secret: 'Linuxfabrik_GmbH'
 | -------- | ----------- | ------------- |
 | `graylog_datanode__bind_address` | String. The network interface used by the Graylog DataNode to bind all services. | `'127.0.0.1'` |
 | `graylog_datanode__http_port`    | Number. The port where the DataNode REST api is listening. | `8999` |
-| `graylog_datanode__node_search_cache_size` | Cache size for searchable snaphots. This space will be automatically reserved if `graylog_datanode__path_repo` is configured | `10gb` |
+| `graylog_datanode__node_search_cache_size` | Cache size for searchable snaphots. This space will be automatically reserved if `graylog_datanode__path_repo` is configured. See [docs.opensearch.org - Supported Units](https://docs.opensearch.org/latest/api-reference/units/) for a list of possible options. | `10gb` |
 | `graylog_datanode__mongodb_uri`  | String. MongoDB connection string. See https://docs.mongodb.com/manual/reference/connection-string/ for details. | `'mongodb://127.0.0.1/graylog'` |
 | `graylog_datanode__opensearch_data_location` | String. Set this OpenSearch folder if you need OpenSearch to be located in a special place. | `/var/lib/graylog-datanode/opensearch/data` |
 | `graylog_datanode__opensearch_heap` | String. Ensure the heap settings are set to half your system memory, up to a max of 31 GB. | 50% of system memory, e.g. 8g |
diff --git a/roles/graylog_datanode/tasks/main.yml b/roles/graylog_datanode/tasks/main.yml
index cd7e96394..b7a061597 100644
--- a/roles/graylog_datanode/tasks/main.yml
+++ b/roles/graylog_datanode/tasks/main.yml
@@ -14,6 +14,13 @@
       fail_msg: 'graylog_datanode__password_secret must at least 16 characters'
       quiet: true
 
+  - name: 'Validate that graylog_datanode__node_search_cache_size follows OpenSearch Bytes format'
+    ansible.builtin.assert:
+      that:
+      -  'graylog_datanode__node_search_cache_size | regex_search("^[0-9]+(b|kb|mb|gb|tb|pb)$")'
+      fail_msg: '"{{ graylog_datanode__node_search_cache_size }}" does not follow OpenSearch Bytes format'
+      quiet: true
+
   tags:
     - 'graylog_datanode'
     - 'graylog_datanode:configure'

From aeb22863519639007f60347c1090989edf90e36c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Eric=20B=C3=BCrki?= <eric.buerki@linuxfabrik.ch>
Date: Fri, 27 Mar 2026 11:42:24 +0100
Subject: [PATCH 7/9] remove invalid assert

---
 roles/graylog_datanode/tasks/main.yml | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/roles/graylog_datanode/tasks/main.yml b/roles/graylog_datanode/tasks/main.yml
index b7a061597..f8eb8a642 100644
--- a/roles/graylog_datanode/tasks/main.yml
+++ b/roles/graylog_datanode/tasks/main.yml
@@ -7,13 +7,6 @@
       fail_msg: 'graylog_datanode__password_secret must at least 16 characters'
       quiet: true
 
-  - name: 'Validate graylog_datanode__node_search_cache_size'
-    ansible.builtin.assert:
-      that:
-        - 'graylog_datanode__password_secret | length >= 16'
-      fail_msg: 'graylog_datanode__password_secret must at least 16 characters'
-      quiet: true
-
   - name: 'Validate that graylog_datanode__node_search_cache_size follows OpenSearch Bytes format'
     ansible.builtin.assert:
       that:

From eda13ea3fa064b39024deedd24d7c58fdd1f6445 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Eric=20B=C3=BCrki?= <eric.buerki@linuxfabrik.ch>
Date: Fri, 27 Mar 2026 16:06:39 +0100
Subject: [PATCH 8/9] fix(roles/graylog_server): update server configuration to
 disable telemetry

---
 .../templates/etc/graylog/server/6.1-server.conf.j2       | 8 +++++++-
 .../templates/etc/graylog/server/6.2-server.conf.j2       | 8 +++++++-
 .../templates/etc/graylog/server/6.3-server.conf.j2       | 8 +++++++-
 .../templates/etc/graylog/server/7.0-server.conf.j2       | 8 +++++++-
 4 files changed, 28 insertions(+), 4 deletions(-)

diff --git a/roles/graylog_server/templates/etc/graylog/server/6.1-server.conf.j2 b/roles/graylog_server/templates/etc/graylog/server/6.1-server.conf.j2
index 363453b5f..297e607b8 100644
--- a/roles/graylog_server/templates/etc/graylog/server/6.1-server.conf.j2
+++ b/roles/graylog_server/templates/etc/graylog/server/6.1-server.conf.j2
@@ -1,5 +1,5 @@
 # {{ ansible_managed }}
-# 2026012102
+# 2026032701
 # 6.1
 ############################
 # GRAYLOG CONFIGURATION FILE
@@ -781,3 +781,9 @@ integrations_scripts_dir = /usr/share/graylog-server/scripts
 #   event-processor-execution-v1
 #   notification-execution-v1
 #job_scheduler_concurrency_limits = event-processor-execution-v1:2,notification-execution-v1:2
+
+##################
+# Privacy settings
+##################
+
+telemetry_enabled = false
diff --git a/roles/graylog_server/templates/etc/graylog/server/6.2-server.conf.j2 b/roles/graylog_server/templates/etc/graylog/server/6.2-server.conf.j2
index a61976a5f..3ce0e2563 100644
--- a/roles/graylog_server/templates/etc/graylog/server/6.2-server.conf.j2
+++ b/roles/graylog_server/templates/etc/graylog/server/6.2-server.conf.j2
@@ -1,5 +1,5 @@
 # {{ ansible_managed }}
-# 2026012102
+# 2026032701
 # 6.2
 ############################
 # GRAYLOG CONFIGURATION FILE
@@ -815,3 +815,9 @@ integrations_scripts_dir = /usr/share/graylog-server/scripts
 #          instability. Proceed with caution.
 # Default: 0
 #search_query_engine_data_lake_jobs_queue_size = 0
+
+##################
+# Privacy settings
+##################
+
+telemetry_enabled = false
diff --git a/roles/graylog_server/templates/etc/graylog/server/6.3-server.conf.j2 b/roles/graylog_server/templates/etc/graylog/server/6.3-server.conf.j2
index 7ff391eb1..bb71f9bc9 100644
--- a/roles/graylog_server/templates/etc/graylog/server/6.3-server.conf.j2
+++ b/roles/graylog_server/templates/etc/graylog/server/6.3-server.conf.j2
@@ -1,5 +1,5 @@
 # {{ ansible_managed }}
-# 2026012102
+# 2026032701
 # 6.3
 ############################
 # GRAYLOG CONFIGURATION FILE
@@ -815,3 +815,9 @@ integrations_scripts_dir = /usr/share/graylog-server/scripts
 #          instability. Proceed with caution.
 # Default: 0
 #search_query_engine_data_lake_jobs_queue_size = 0
+
+##################
+# Privacy settings
+##################
+
+telemetry_enabled = false
diff --git a/roles/graylog_server/templates/etc/graylog/server/7.0-server.conf.j2 b/roles/graylog_server/templates/etc/graylog/server/7.0-server.conf.j2
index d15132781..7f4aaeb45 100644
--- a/roles/graylog_server/templates/etc/graylog/server/7.0-server.conf.j2
+++ b/roles/graylog_server/templates/etc/graylog/server/7.0-server.conf.j2
@@ -1,5 +1,5 @@
 # {{ ansible_managed }}
-# 2026012102
+# 2026032701
 # 7.0
 ############################
 # GRAYLOG CONFIGURATION FILE
@@ -819,3 +819,9 @@ integrations_scripts_dir = /usr/share/graylog-server/scripts
 #          instability. Proceed with caution.
 # Default: 0
 #search_query_engine_data_lake_jobs_queue_size = 0
+
+##################
+# Privacy settings
+##################
+
+telemetry_enabled = false

From 3c8883f6e5313f8e9f3477fda29ba96907d859a8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Eric=20B=C3=BCrki?= <eric.buerki@linuxfabrik.ch>
Date: Fri, 27 Mar 2026 17:55:26 +0100
Subject: [PATCH 9/9] fix(roles/graylog_datanode): restrict permissions for
 snapshot repo paths

---
 roles/graylog_datanode/tasks/main.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roles/graylog_datanode/tasks/main.yml b/roles/graylog_datanode/tasks/main.yml
index f8eb8a642..caa59b5af 100644
--- a/roles/graylog_datanode/tasks/main.yml
+++ b/roles/graylog_datanode/tasks/main.yml
@@ -86,7 +86,7 @@
       state: 'directory'
       owner: 'graylog-datanode'
       group: 'graylog-datanode'
-      mode: 0o755
+      mode: 0o740
     loop: '{{ graylog_datanode__path_repo }}'
 
   tags: