deploy alerta on grafana.hosts.hamburg.ccc.de

resources/chaosknoten/grafana/docker_compose/alertad.conf.j2

@@ -0,0 +1,30 @@
+# {{ ansible_managed }}
+# https://docs.alerta.io/configuration.html#authentication-settings
+
+DEBUG = True
+SECRET_KEY = "{{ secret__alerta_secret_key }}"
+BASE_URL = "https://alerta.hamburg.ccc.de"
+USE_PROXYFIX = True
+
+AUTH_REQUIRED = True
+USER_DEFAULT_SCOPES = ['read', 'write']
+OAUTH2_CLIENT_ID = "alerta"
+OAUTH2_CLIENT_SECRET = "{{ secret__alerta_oauth_client_secret }}"
+
+# AUTH_PROVIDER = "keycloak"
+# KEYCLOAK_URL = "https://id.hamburg.ccc.de"
+# KEYCLOAK_REALM = "ccchh"
+# ALLOWED_KEYCLOAK_ROLES = "*"
+
+AUTH_PROVIDER = "openid"
+OIDC_ISSUER_URL = "https://id.hamburg.ccc.de/realms/ccchh"
+OIDC_VERIFY_TOKEN = True
+ALLOWED_OIDC_ROLES = "*"
+
+# AUTH_REQUIRED = True
+# ADMIN_USERS = ['admin@alerta.io', 'devops@example.com']
+# DEFAULT_ADMIN_ROLE = 'ops'
+# ADMIN_ROLES = ['ops', 'devops', 'coolkids']
+# USER_DEFAULT_SCOPES = ['read', 'write:alerts']
+# CUSTOMER_VIEWS = True
+

resources/chaosknoten/grafana/docker_compose/alertmanager.yaml.j2

@@ -9,6 +9,9 @@ route:
   group_interval: 5m
   repeat_interval: 26h
   routes:
+    - receiver: alerta
+      matchers: {}
+      continue: true
     - receiver: "null"
       matchers:
         - sendAlert = "false"
@@ -73,3 +76,8 @@ receivers:
         smarthost: "cow.hamburg.ccc.de:587"
         auth_username: "alert-manager@hamburg.ccc.de"
         auth_password: {{ secret__alert_manager_email_password }}
+
+  - name: "alerta"
+    webhook_configs:
+      - url: "http://alerta.hamburg.ccc.de/webhooks/prometheus"
+        send_resolved: true

resources/chaosknoten/grafana/docker_compose/compose.yaml.j2

@@ -105,9 +105,30 @@ services:
       - 8011:8011
     restart: unless-stopped
 
+  alerta-mongodb:
+    image: docker.io/mongodb/mongodb-community-server:8.2-ubi9-slim
+    container_name: alerta-mongodb
+    volumes:
+      - alerta_mongodb_data:/data/db
+    ports:
+      - 27017:27017
+    restart: unless-stopped
+
+  alerta-web:
+    image: docker.io/alerta/alerta-web:9.1.0
+    container_name: alerta-web
+    volumes:
+        - ./configs/alertad.conf:/app/alertad.conf:ro
+    environment:
+      - DATABASE_URL=mongodb://alerta-mongodb:27017/alerta
+    ports:
+      - 8012:8080
+    restart: unless-stopped
+
 volumes:
   graf_data: {}
   prom_data: {}
   alertmanager_data: {}
   loki_data: {}
   mimir_data: {}
+  alerta_mongodb_data: {}

resources/chaosknoten/grafana/nginx/alerta.hamburg.ccc.de.conf

@@ -0,0 +1,43 @@
+# partly generated 2022-01-08, Mozilla Guideline v5.6, nginx 1.17.7, OpenSSL 1.1.1k, intermediate configuration
+# https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1k&guideline=5.6
+server {
+    # Listen on a custom port for the proxy protocol.
+    listen [::]:8443 ssl proxy_protocol;
+    http2 on;
+    # Make use of the ngx_http_realip_module to set the $remote_addr and
+    # $remote_port to the client address and client port, when using proxy
+    # protocol.
+    # First set our proxy protocol proxy as trusted.
+    set_real_ip_from 2a00:14b0:4200:3000:125::1;
+    # Then tell the realip_module to get the addreses from the proxy protocol
+    # header.
+    real_ip_header proxy_protocol;
+
+    server_name alerta.hamburg.ccc.de;
+
+    ssl_certificate /etc/letsencrypt/live/alerta.hamburg.ccc.de/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/alerta.hamburg.ccc.de/privkey.pem;
+    # verify chain of trust of OCSP response using Root CA and Intermediate certs
+    ssl_trusted_certificate /etc/letsencrypt/live/alerta.hamburg.ccc.de/chain.pem;
+
+    # HSTS (ngx_http_headers_module is required) (63072000 seconds)
+    add_header Strict-Transport-Security "max-age=63072000" always;
+
+    proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Port 443;
+    # This is https in any case.
+    proxy_set_header X-Forwarded-Proto https;
+    # Hide the X-Forwarded header.
+    proxy_hide_header X-Forwarded;
+    # Assume we are the only Reverse Proxy (well using Proxy Protocol, but that
+    # is transparent).
+    # Also provide "_hidden" for by, since it's not relevant.
+    proxy_set_header Forwarded "for=$remote_addr;proto=https;host=$host;by=_hidden";
+
+    location / {
+        proxy_pass http://127.0.0.1:8012/;
+    }
+}