From 5fcbe5cfab204a5e54f1d4ae25b97906e813bbe4 Mon Sep 17 00:00:00 2001 From: Stefan Bethke Date: Tue, 19 Dec 2023 18:37:24 +0100 Subject: [PATCH] Add grafana --- .../chaosknoten/host_vars/grafana.yaml | 12 ++++++ inventories/chaosknoten/hosts.yaml | 9 ++++ .../grafana/nginx/grafana.hamburg.ccc.de.conf | 43 +++++++++++++++++++ .../nginx/acme_challenge.conf | 2 +- .../public-reverse-proxy/nginx/nginx.conf | 2 +- .../configs/grafana/compose.yaml.j2 | 29 +++++++++++++ 6 files changed, 95 insertions(+), 2 deletions(-) create mode 100644 inventories/chaosknoten/host_vars/grafana.yaml create mode 100644 playbooks/files/chaosknoten/configs/grafana/nginx/grafana.hamburg.ccc.de.conf create mode 100644 playbooks/templates/chaosknoten/configs/grafana/compose.yaml.j2 diff --git a/inventories/chaosknoten/host_vars/grafana.yaml b/inventories/chaosknoten/host_vars/grafana.yaml new file mode 100644 index 0000000..331f782 --- /dev/null +++ b/inventories/chaosknoten/host_vars/grafana.yaml @@ -0,0 +1,12 @@ +docker_compose__compose_file_content: "{{ lookup('ansible.builtin.template', 'chaosknoten/configs/grafana/compose.yaml.j2') }}" +docker_compose__configuration_files: [] + +certbot__version_spec: "" +certbot__acme_account_email_address: le-admin@hamburg.ccc.de +certbot__certificate_domains: + - "grafana.hamburg.ccc.de" + +nginx__version_spec: "" +nginx__configurations: + - name: grafana.hamburg.ccc.de + content: "{{ lookup('ansible.builtin.file', 'chaosknoten/configs/grafana/nginx/grafana.hamburg.ccc.de.conf') }}" diff --git a/inventories/chaosknoten/hosts.yaml b/inventories/chaosknoten/hosts.yaml index 0686c25..b6d7839 100644 --- a/inventories/chaosknoten/hosts.yaml +++ b/inventories/chaosknoten/hosts.yaml @@ -6,6 +6,11 @@ all: ansible_host: cloud-intern.hamburg.ccc.de ansible_user: chaos ansible_ssh_common_args: -J ssh://chaos@public-reverse-proxy.hamburg.ccc.de:42666 + grafana: + ansible_host: grafana-intern.hamburg.ccc.de + ansible_port: 42666 + ansible_user: chaos + ansible_ssh_common_args: -J ssh://chaos@public-reverse-proxy.hamburg.ccc.de:42666 hackertours: ansible_host: hackertours-intern.hamburg.ccc.de ansible_port: 42666 @@ -43,6 +48,7 @@ all: ansible_ssh_common_args: -J ssh://chaos@public-reverse-proxy.hamburg.ccc.de:42666 docker_compose_hosts: hosts: + grafana: hackertours: keycloak: lists: @@ -54,6 +60,7 @@ all: cloud: nginx_hosts: hosts: + grafana: hackertours: keycloak: lists: @@ -71,6 +78,7 @@ all: wiki: certbot_hosts: hosts: + grafana: hackertours: keycloak: lists: @@ -80,6 +88,7 @@ all: zammad: infrastructure_authorized_keys_hosts: hosts: + grafana: hackertours: cloud: keycloak: diff --git a/playbooks/files/chaosknoten/configs/grafana/nginx/grafana.hamburg.ccc.de.conf b/playbooks/files/chaosknoten/configs/grafana/nginx/grafana.hamburg.ccc.de.conf new file mode 100644 index 0000000..a3218d1 --- /dev/null +++ b/playbooks/files/chaosknoten/configs/grafana/nginx/grafana.hamburg.ccc.de.conf @@ -0,0 +1,43 @@ +# partly generated 2022-01-08, Mozilla Guideline v5.6, nginx 1.17.7, OpenSSL 1.1.1k, intermediate configuration +# https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1k&guideline=5.6 +server { + # Listen on a custom port for the proxy protocol. + listen 8443 ssl http2 proxy_protocol; + # Make use of the ngx_http_realip_module to set the $remote_addr and + # $remote_port to the client address and client port, when using proxy + # protocol. + # First set our proxy protocol proxy as trusted. + set_real_ip_from 172.31.17.140; + # Then tell the realip_module to get the addreses from the proxy protocol + # header. + real_ip_header proxy_protocol; + + server_name grafana.hamburg.ccc.de; + + ssl_certificate /etc/letsencrypt/live/grafana.hamburg.ccc.de/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/grafana.hamburg.ccc.de/privkey.pem; + # verify chain of trust of OCSP response using Root CA and Intermediate certs + ssl_trusted_certificate /etc/letsencrypt/live/grafana.hamburg.ccc.de/chain.pem; + + # HSTS (ngx_http_headers_module is required) (63072000 seconds) + add_header Strict-Transport-Security "max-age=63072000" always; + + proxy_set_header Host $host; + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Port 443; + # This is https in any case. + proxy_set_header X-Forwarded-Proto https; + # Hide the X-Forwarded header. + proxy_hide_header X-Forwarded; + # Assume we are the only Reverse Proxy (well using Proxy Protocol, but that + # is transparent). + # Also provide "_hidden" for by, since it's not relevant. + proxy_set_header Forwarded "for=$remote_addr;proto=https;host=$host;by=_hidden"; + + location / { + proxy_pass http://127.0.0.1:3000/; + } + +} diff --git a/playbooks/files/chaosknoten/configs/public-reverse-proxy/nginx/acme_challenge.conf b/playbooks/files/chaosknoten/configs/public-reverse-proxy/nginx/acme_challenge.conf index dad37c4..573d484 100644 --- a/playbooks/files/chaosknoten/configs/public-reverse-proxy/nginx/acme_challenge.conf +++ b/playbooks/files/chaosknoten/configs/public-reverse-proxy/nginx/acme_challenge.conf @@ -3,7 +3,7 @@ map $host $upstream_acme_challenge_host { pad.hamburg.ccc.de 172.31.17.141:31820; id.hamburg.ccc.de 172.31.17.144:31820; keycloak-admin.hamburg.ccc.de 172.31.17.144:31820; - aes.ccchh.net 172.31.17.145:31820; + grafana.hamburg.ccc.de 172.31.17.145:31820; wiki.ccchh.net 172.31.17.146:31820; onlyoffice.hamburg.ccc.de 172.31.17.147:31820; hackertours.hamburg.ccc.de 172.31.17.148:31820; diff --git a/playbooks/files/chaosknoten/configs/public-reverse-proxy/nginx/nginx.conf b/playbooks/files/chaosknoten/configs/public-reverse-proxy/nginx/nginx.conf index a4e221f..fdf6533 100644 --- a/playbooks/files/chaosknoten/configs/public-reverse-proxy/nginx/nginx.conf +++ b/playbooks/files/chaosknoten/configs/public-reverse-proxy/nginx/nginx.conf @@ -22,7 +22,7 @@ stream { pad.hamburg.ccc.de pad-intern.hamburg.ccc.de:8443; id.hamburg.ccc.de 172.31.17.144:8443; keycloak-admin.hamburg.ccc.de 172.31.17.144:8444; - aes.ccchh.net 172.31.17.145:8443; + grafana.hamburg.ccc.de grafana-intern.hamburg.ccc.de:8443; wiki.ccchh.net 172.31.17.146:8443; onlyoffice.hamburg.ccc.de 172.31.17.147:8443; hackertours.hamburg.ccc.de 172.31.17.148:8443; diff --git a/playbooks/templates/chaosknoten/configs/grafana/compose.yaml.j2 b/playbooks/templates/chaosknoten/configs/grafana/compose.yaml.j2 new file mode 100644 index 0000000..7b2de0d --- /dev/null +++ b/playbooks/templates/chaosknoten/configs/grafana/compose.yaml.j2 @@ -0,0 +1,29 @@ +--- +version: "3.6" + +services: + prometheus: + image: prom/prometheus + container_name: prometheus + command: + - '--config.file=/etc/prometheus/prometheus.yml' + ports: + - 9090:9090 + restart: unless-stopped + volumes: + - ./prometheus:/etc/prometheus + - prom_data:/prometheus + grafana: + image: grafana/grafana + container_name: grafana + ports: + - 3000:3000 + restart: unless-stopped + environment: + - GF_SECURITY_ADMIN_USER=admin + - "GF_SECURITY_ADMIN_PASSWORD={{ lookup("community.general.passwordstore", "noc/vm-secrets/chaosknoten/grafana/GF_SECURITY_ADMIN_PASSWORD", create=false, missing="error") }}" + volumes: + - ./grafana:/etc/grafana/provisioning/datasources + +volumes: + prom_data: {}