Skip to content

Commit 21c2f27

Browse files
GrotaxGrotax
committed
add new role for public grafana
1 parent 7d3e580 commit 21c2f27

7 files changed

Lines changed: 167 additions & 0 deletions

File tree

‎roles/grafana_public/defaults/main.yml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
---
2+
grafana_public_apt_key_url: https://apt.grafana.com/gpg.key
3+
grafana_public_apt_keyring: /etc/apt/keyrings/grafana.gpg
4+
grafana_public_apt_repository: "deb [signed-by={{ grafana_public_apt_keyring }}] https://apt.grafana.com stable main"
5+
6+
grafana_public_domain: grafana.freifunk-suedholstein.de
7+
grafana_public_root_url: "https://{{ grafana_public_domain }}/"
8+
grafana_public_http_addr: 127.0.0.1
9+
grafana_public_http_port: 3000
10+
grafana_public_cert_file: "/etc/letsencrypt/live/{{ grafana_public_domain }}/fullchain.pem"
11+
grafana_public_cert_key: "/etc/letsencrypt/live/{{ grafana_public_domain }}/privkey.pem"
12+
13+
grafana_public_nginx_sites_available_dir: /etc/nginx/sites-available
14+
grafana_public_nginx_sites_enabled_dir: /etc/nginx/sites-enabled

‎roles/grafana_public/handlers/main.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
---
2+
- name: Restart Grafana
3+
ansible.builtin.systemd:
4+
name: grafana-server
5+
state: restarted
6+
7+
- name: Reload nginx
8+
ansible.builtin.systemd:
9+
name: nginx
10+
state: reloaded

‎roles/grafana_public/tasks/main.yml‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
---
2+
- name: Skip public Grafana on non-map hosts
3+
ansible.builtin.meta: end_role
4+
when: inventory_hostname != "map-ffsh"
5+
6+
- name: Install prerequisites for Grafana repository
7+
ansible.builtin.apt:
8+
name: gnupg
9+
state: present
10+
11+
- name: Create APT keyrings directory
12+
ansible.builtin.file:
13+
path: /etc/apt/keyrings
14+
state: directory
15+
owner: root
16+
group: root
17+
mode: "0755"
18+
19+
- name: Download Grafana repository signing key
20+
ansible.builtin.get_url:
21+
url: "{{ grafana_public_apt_key_url }}"
22+
dest: /tmp/grafana-public.gpg.key
23+
mode: "0644"
24+
25+
- name: Convert Grafana repository signing key
26+
ansible.builtin.command:
27+
cmd: "gpg --dearmor --output {{ grafana_public_apt_keyring }} /tmp/grafana-public.gpg.key"
28+
creates: "{{ grafana_public_apt_keyring }}"
29+
30+
- name: Configure Grafana APT repository
31+
ansible.builtin.apt_repository:
32+
repo: "{{ grafana_public_apt_repository }}"
33+
filename: grafana-public
34+
state: present
35+
update_cache: true
36+
37+
- name: Install Grafana
38+
ansible.builtin.apt:
39+
name: grafana
40+
state: present
41+
42+
- name: Ensure Grafana service is enabled and running
43+
ansible.builtin.systemd:
44+
name: grafana-server
45+
enabled: true
46+
state: started
47+
48+
- name: Configure Grafana public instance
49+
ansible.builtin.template:
50+
src: grafana.ini.j2
51+
dest: /etc/grafana/grafana.ini
52+
owner: root
53+
group: grafana
54+
mode: "0640"
55+
notify: Restart Grafana
56+
57+
- name: Ensure nginx vhost directory exists
58+
ansible.builtin.file:
59+
path: "{{ grafana_public_nginx_sites_available_dir }}"
60+
state: directory
61+
owner: root
62+
group: root
63+
mode: "0755"
64+
65+
- name: Configure Grafana nginx vhost
66+
ansible.builtin.template:
67+
src: grafana.conf.j2
68+
dest: "{{ grafana_public_nginx_sites_available_dir }}/{{ grafana_public_domain | replace('.', '-') }}.conf"
69+
owner: root
70+
group: root
71+
mode: "0644"
72+
notify:
73+
- Reload nginx
74+
75+
- name: Enable Grafana nginx vhost
76+
ansible.builtin.file:
77+
src: "{{ grafana_public_nginx_sites_available_dir }}/{{ grafana_public_domain | replace('.', '-') }}.conf"
78+
dest: "{{ grafana_public_nginx_sites_enabled_dir }}/{{ grafana_public_domain | replace('.', '-') }}.conf"
79+
state: link
80+
force: true
81+
82+
- name: Validate nginx configuration
83+
ansible.builtin.command: nginx -t
84+
changed_when: false
85+
notify:
86+
- Reload nginx

‎roles/grafana_public/templates/grafana.conf.j2‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
server {
2+
listen 80;
3+
listen [::]:80;
4+
5+
server_name {{ grafana_public_domain }};
6+
7+
return 301 https://$host$request_uri;
8+
}
9+
10+
server {
11+
listen 443 ssl http2;
12+
listen [::]:443 ssl http2;
13+
14+
server_name {{ grafana_public_domain }};
15+
16+
ssl_certificate {{ grafana_public_cert_file }};
17+
ssl_certificate_key {{ grafana_public_cert_key }};
18+
ssl_session_timeout 1d;
19+
ssl_session_cache shared:SSL:50m;
20+
ssl_session_tickets off;
21+
ssl_protocols TLSv1.2 TLSv1.3;
22+
ssl_prefer_server_ciphers off;
23+
24+
add_header Strict-Transport-Security "max-age=31536000" always;
25+
26+
location / {
27+
proxy_pass http://127.0.0.1:3000;
28+
proxy_set_header Host $http_host;
29+
proxy_set_header X-Real-IP $remote_addr;
30+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
31+
proxy_set_header X-Forwarded-Proto $scheme;
32+
}
33+
}

‎roles/grafana_public/templates/grafana.ini.j2‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
##################### Grafana Configuration #####################
2+
[paths]
3+
[server]
4+
http_addr = {{ grafana_public_http_addr }}
5+
http_port = {{ grafana_public_http_port }}
6+
domain = {{ grafana_public_domain }}
7+
root_url = {{ grafana_public_root_url }}
8+
9+
[database]
10+
;type = sqlite3
11+
;path = grafana.db
12+
13+
[security]
14+
allow_embedding = true
15+
16+
[users]
17+
allow_sign_up = false
18+
19+
[auth.anonymous]
20+
enabled = true
21+
org_name = Freifunk Südholstein
22+
org_role = Viewer

‎roles/meshviewer/defaults/main.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ meshviewer_site_name: Freifunk Südholstein
1616
meshviewer_max_age: 21
1717
meshviewer_node_zoom: 19
1818

19+
# Grafana is proxied through the meshviewer nginx config to prevent cors issues
1920
meshviewer_grafana:
2021
url: /_grafana
2122
orgId: 1

‎setup.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -104,6 +104,7 @@
104104
- {role: firmware_release, tags: "firmware-release"}
105105
- {role: firmware_selector, tags: "firmware-selector"}
106106
- {role: website, tags: "website"}
107+
- {role: grafana_public, tags: "grafana-public"}
107108
- {role: meshviewer, tags: "meshviewer"}
108109

109110
post_tasks:

0 commit comments

Comments
 (0)