This uses the Grafana container created with Iddfafe852166fe95b3e433420e2e2a4a6380fc64 to run the grafana.opendev.org service. We retain the old model of an Apache reverse-proxy; it's well tested and understood, it's much easier than trying to map all the SSL termination/renewal/etc. into the Grafana container and we don't have to convince ourselves the container is safe to be directly web-facing. Otherwise this is a fairly straight forward deployment of the container. As before, it uses the graph configuration kept in project-config which is loaded in with grafyaml, which is included in the container. Once nice advantage is that it makes it quite easy to develop graphs locally, using the container which can talk to the public graphite instance. The documentation has been updated with a reference on how to do this. Change-Id: I0cc76d29b6911aecfebc71e5fdfe7cf4fcd071a4changes/06/737406/19
Ian Wienand
3 years ago
parent
9b54e7205c
commit
b146181174
@ -0,0 +1,5 @@
|
||||
letsencrypt_certs:
|
||||
grafana01-opendev-org-main:
|
||||
- grafana01.opendev.org
|
||||
- grafana.opendev.org
|
||||
- grafana.openstack.org
|
||||
@ -0,0 +1 @@
|
||||
Run Grafana
|
||||
@ -0,0 +1,4 @@
|
||||
- name: grafana Reload apache2
|
||||
service:
|
||||
name: apache2
|
||||
state: reloaded
|
||||
@ -0,0 +1,87 @@
|
||||
- name: Ensure docker-compose directory exists
|
||||
file:
|
||||
state: directory
|
||||
path: /etc/grafana-docker
|
||||
|
||||
- name: Write settings file
|
||||
template:
|
||||
src: docker-compose.yaml.j2
|
||||
dest: /etc/grafana-docker/docker-compose.yaml
|
||||
|
||||
- name: Ensure config directory exists
|
||||
file:
|
||||
state: directory
|
||||
path: /etc/grafana
|
||||
|
||||
- name: Ensure secrets config directory exists
|
||||
file:
|
||||
state: directory
|
||||
path: /etc/grafana/secrets
|
||||
|
||||
- name: Make admin_password
|
||||
copy:
|
||||
content: '{{ grafana_admin_password }}'
|
||||
dest: /etc/grafana/secrets/admin_password
|
||||
|
||||
- name: Make admin_user
|
||||
copy:
|
||||
content: '{{ grafana_admin_user }}'
|
||||
dest: /etc/grafana/secrets/admin_user
|
||||
|
||||
- name: Make secret_key
|
||||
copy:
|
||||
content: '{{ grafana_secret_key }}'
|
||||
dest: /etc/grafana/secrets/secret_key
|
||||
|
||||
- name: Install apache2
|
||||
apt:
|
||||
name:
|
||||
- apache2
|
||||
- apache2-utils
|
||||
state: present
|
||||
|
||||
- name: Apache modules
|
||||
apache2_module:
|
||||
state: present
|
||||
name: "{{ item }}"
|
||||
loop:
|
||||
- rewrite
|
||||
- proxy
|
||||
- proxy_http
|
||||
- ssl
|
||||
- headers
|
||||
- proxy_wstunnel
|
||||
|
||||
- name: Copy apache config
|
||||
template:
|
||||
src: grafana.vhost.j2
|
||||
dest: /etc/apache2/sites-enabled/000-default.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
notify: grafana Reload apache2
|
||||
|
||||
- name: Sync project-config
|
||||
include_role:
|
||||
name: sync-project-config
|
||||
|
||||
- name: Run docker-compose pull
|
||||
shell:
|
||||
cmd: docker-compose pull
|
||||
chdir: /etc/grafana-docker/
|
||||
|
||||
- name: Run docker-compose up
|
||||
shell:
|
||||
cmd: docker-compose up -d
|
||||
chdir: /etc/grafana-docker/
|
||||
|
||||
- name: Run docker prune to cleanup unneeded images
|
||||
shell:
|
||||
cmd: docker image prune -f
|
||||
|
||||
- name: Import dashboards to container
|
||||
shell:
|
||||
cmd: |
|
||||
docker-compose exec -T grafana /usr/local/bin/update-grafana
|
||||
chdir: /etc/grafana-docker/
|
||||
|
||||
@ -0,0 +1,18 @@
|
||||
# Version 2 is the latest that is supported by docker-compose in
|
||||
# Ubuntu Xenial.
|
||||
version: '2'
|
||||
|
||||
services:
|
||||
grafana:
|
||||
restart: always
|
||||
image: docker.io/opendevorg/grafana
|
||||
network_mode: host
|
||||
environment:
|
||||
GF_SECURITY_ADMIN_PASSWORD__FILE: '/etc/grafana/secrets/admin_password'
|
||||
GF_SECURITY_ADMIN_USER__FILE: '/etc/grafana/secrets/admin_user'
|
||||
GF_SECURITY_SECRET_KEY__FILE: '/etc/grafana/secrets/secret_key'
|
||||
GF_AUTH_ANONYMOUS_ENABLED: 'true'
|
||||
GF_USERS_ALLOW_SIGN_UP: 'false'
|
||||
volumes:
|
||||
- /opt/project-config:/opt/project-config
|
||||
- /etc/grafana/secrets:/etc/grafana/secrets
|
||||
@ -0,0 +1,41 @@
|
||||
<VirtualHost *:80>
|
||||
ServerName {{ inventory_hostname }}
|
||||
ServerAdmin webmaster@openstack.org
|
||||
|
||||
ErrorLog ${APACHE_LOG_DIR}/grafana-error.log
|
||||
|
||||
LogLevel warn
|
||||
|
||||
CustomLog ${APACHE_LOG_DIR}/grafana-access.log combined
|
||||
|
||||
Redirect / https://{{ inventory_hostname }}/
|
||||
|
||||
</VirtualHost>
|
||||
|
||||
<VirtualHost *:443>
|
||||
ServerName {{ inventory_hostname }}
|
||||
ServerAdmin webmaster@openstack.org
|
||||
|
||||
AllowEncodedSlashes On
|
||||
|
||||
ErrorLog ${APACHE_LOG_DIR}/grafana-ssl-error.log
|
||||
|
||||
LogLevel warn
|
||||
|
||||
CustomLog ${APACHE_LOG_DIR}/grafana-ssl-access.log combined
|
||||
|
||||
SSLEngine on
|
||||
SSLProtocol All -SSLv2 -SSLv3
|
||||
# Note: this list should ensure ciphers that provide forward secrecy
|
||||
SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:!AES256:!aNULL:!eNULL:!MD5:!DSS:!PSK:!SRP
|
||||
SSLHonorCipherOrder on
|
||||
|
||||
SSLCertificateFile /etc/letsencrypt-certs/{{ inventory_hostname }}/{{ inventory_hostname }}.cer
|
||||
SSLCertificateKeyFile /etc/letsencrypt-certs/{{ inventory_hostname }}/{{ inventory_hostname }}.key
|
||||
SSLCertificateChainFile /etc/letsencrypt-certs/{{ inventory_hostname }}/ca.cer
|
||||
|
||||
ProxyPass / http://localhost:3000/ retry=0
|
||||
ProxyPassReverse / http://localhost:3000/
|
||||
|
||||
</VirtualHost>
|
||||
|
||||
@ -0,0 +1,6 @@
|
||||
- hosts: "grafana_opendev:!disabled"
|
||||
name: "Base: configure grafana"
|
||||
roles:
|
||||
- iptables
|
||||
- install-docker
|
||||
- grafana
|
||||
@ -0,0 +1,3 @@
|
||||
grafana_admin_password: adminpassword
|
||||
grafana_admin_user: admin
|
||||
grafana_secret_key: grafanaSecretKey
|
||||
@ -0,0 +1,27 @@
|
||||
# Copyright 2020 Red Hat, Inc.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
# not use this file except in compliance with the License. You may obtain
|
||||
# a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
||||
# License for the specific language governing permissions and limitations
|
||||
# under the License.
|
||||
|
||||
|
||||
testinfra_hosts = ['grafana01.opendev.org']
|
||||
|
||||
|
||||
def test_grafana_container_listening(host):
|
||||
grafana = host.socket("tcp://127.0.0.1:3000")
|
||||
assert grafana.is_listening
|
||||
|
||||
def tets_grafana_proxy(host):
|
||||
cmd = host.run('curl --insecure '
|
||||
'--resolve grafana.opendev.org:443:127.0.0.1 '
|
||||
'https://grafana.opendev.org')
|
||||
assert '<title>Grafana</title>' in cmd.stdout
|
||||
Loading…
Reference in new issue