Puppet Class: grafana

Defined in:

manifests/init.pp

Summary

Configure Grafana instance

Overview

Parameters:

• hostname (String) —

  sets the hostname for grafana

• datadir (String) —

  sets where the data is persisted

• admin_user (String) —

  sets the username for the primary Grafana account

• admin_password (String) —

  sets the password for the primary Grafana account

• secret_key (String) —

  sets the AES key used for encrypting Grafana sessions

• client_id (String) —

  sets the Github OAuth client ID

• client_secret (String) —

  sets the Github OAuth client secret

• database_password (String) —

  sets the postgres password for grafana

• aws_access_key_id (String) —

  sets the AWS key to use for Route53 challenge

• aws_secret_access_key (String) —

  sets the AWS secret key to use for the Route53 challenge

• email (String) —

  sets the contact address for the certificate

• root_domain (Optional[String]) (defaults to: undef) —

  sets the publicly visible root domain for the site

• root_url (Optional[String]) (defaults to: undef) —

  sets the publicly visible root URL for the site

• container_ip (String) (defaults to: '172.17.0.2') —

  sets the address of the Docker container

• postgres_ip (String) (defaults to: '172.17.0.3') —

  sets the address of the postgres Docker container

• allow_anonymous (Boolean) (defaults to: false) —

  determines whether unauthenticated users can view data

• anonymous_org (String) (defaults to: 'Main') —

  sets the org for anonymous users

• anonymous_role (String) (defaults to: 'Viewer') —

  sets the role for anonymous users

• viewers_can_edit (Boolean) (defaults to: false) —

  controls whether viewers can use Explore and modify dashboard panels

• allowed_organizations (Array[String]) (defaults to: []) —

  sets the organization requirements for Github auth

• team_ids (Array[String]) (defaults to: []) —

  sets the team requirements for Github auth

• plugins (Array[String]) (defaults to: []) —

  sets the plugins to install

• extra_config (Array[String]) (defaults to: []) —

  sets extra grafana config flags to use

• backup_target (Optional[String]) (defaults to: undef) —

  sets the target repo for backups

• backup_data_watchdog (Optional[String]) (defaults to: undef) —

  sets the watchdog URL to confirm backups are working

• backup_provisioning_watchdog (Optional[String]) (defaults to: undef) —

  sets the watchdog URL to confirm backups are working

• backup_database_watchdog (Optional[String]) (defaults to: undef) —

  sets the watchdog URL to confirm backups are working

• backup_password (Optional[String]) (defaults to: undef) —

  sets the encryption key for backup snapshots

• backup_environment (Optional[Hash[String, String]]) (defaults to: undef) —

  sets the env vars to use for backups

• backup_rclone (Optional[String]) (defaults to: undef) —

  sets the config for an rclone backend

• postgres_watchdog (Optional[String]) (defaults to: undef) —

  sets the watchdog URL for postgres dumps

# File 'manifests/init.pp', line 34

class grafana (
  String $hostname,
  String $datadir,
  String $admin_user,
  String $admin_password,
  String $secret_key,
  String $client_id,
  String $client_secret,
  String $database_password,
  String $aws_access_key_id,
  String $aws_secret_access_key,
  String $email,
  Optional[String] $root_domain = undef,
  Optional[String] $root_url = undef,
  String $container_ip = '172.17.0.2',
  String $postgres_ip = '172.17.0.3',
  Boolean $allow_anonymous = false,
  String $anonymous_org = 'Main',
  String $anonymous_role = 'Viewer',
  Boolean $viewers_can_edit = false,
  Array[String] $allowed_organizations = [],
  Array[String] $team_ids = [],
  Array[String] $plugins = [],
  Array[String] $extra_config = [],
  Optional[String] $backup_target = undef,
  Optional[String] $backup_data_watchdog = undef,
  Optional[String] $backup_provisioning_watchdog = undef,
  Optional[String] $backup_database_watchdog = undef,
  Optional[String] $backup_password = undef,
  Optional[Hash[String, String]] $backup_environment = undef,
  Optional[String] $backup_rclone = undef,
  Optional[String] $postgres_watchdog = undef,
) {
  $hook_script =  "#!/usr/bin/env bash
cp \$LEGO_CERT_PATH ${datadir}/certs/cert
cp \$LEGO_CERT_KEY_PATH ${datadir}/certs/key
/usr/bin/systemctl restart container@grafana"

  file { [
      $datadir,
      "${datadir}/data",
      "${datadir}/provisioning",
      "${datadir}/certs",
      "${datadir}/backup",
      "${datadir}/postgres",
    ]:
      ensure => directory,
  }

  -> file { "${datadir}/grafana.ini":
    ensure  => file,
    content => template('grafana/grafana.ini.erb'),
    notify  => Service['container@grafana'],
  }

  -> acme::certificate { $hostname:
    hook_script           => $hook_script,
    aws_access_key_id     => $aws_access_key_id,
    aws_secret_access_key => $aws_secret_access_key,
    email                 => $email,
  }

  -> firewall { '100 dnat for grafana ui':
    chain  => 'DOCKER_EXPOSE',
    jump   => 'DNAT',
    proto  => 'tcp',
    dport  => 443,
    todest => "${container_ip}:3000",
    table  => 'nat',
  }

  -> docker::container { 'grafana':
    image => 'grafana/grafana-oss:latest',
    args  => [
      '--user root',
      "--ip ${container_ip}",
      "-v ${datadir}/data:/var/lib/grafana",
      "-v ${datadir}/provisioning:/etc/grafana/provisioning",
      "-v ${datadir}/grafana.ini:/etc/grafana/grafana.ini",
      "-v ${datadir}/certs:/mnt/certs",
      "-e GF_INSTALL_PLUGINS=${plugins.join(',')}",
      *$extra_config,
    ],
    cmd   => '',
  }

  firewall { '101 allow cross container from grafana to postgres':
    chain       => 'FORWARD',
    action      => 'accept',
    proto       => 'tcp',
    source      => $container_ip,
    destination => $postgres_ip,
    dport       => 5432,
  }

  docker::container { 'postgres':
    image   => 'postgres:14',
    args    => [
      "--ip ${postgres_ip}",
      "-v ${datadir}/postgres:/var/lib/postgresql/data",
      '-e POSTGRES_USER=grafana',
      "-e POSTGRES_PASSWORD=${database_password}",
      '-e POSTGRES_DB=grafana',
    ],
    cmd     => '-c ssl=on -c ssl_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem -c ssl_key_file=/etc/ssl/private/ssl-cert-snakeoil.key',
    require => File["${datadir}/postgres"],
  }

  file { '/usr/local/bin/grafana-backup.sh':
    ensure => file,
    source => 'puppet:///modules/grafana/grafana-backup.sh',
    mode   => '0755',
  }

  file { '/etc/systemd/system/grafana-backup.service':
    ensure  => file,
    content => template('grafana/grafana-backup.service.erb'),
    notify  => Service['grafana-backup.timer'],
  }

  file { '/etc/systemd/system/grafana-backup.timer':
    ensure => file,
    source => 'puppet:///modules/grafana/grafana-backup.timer',
    notify => Service['grafana-backup.timer'],
  }

  service { 'grafana-backup.timer':
    ensure => running,
    enable => true,
  }

  tidy { "${datadir}/backup weekly":
    path    => "${datadir}/backup",
    age     => '1d',
    recurse => true,
    matches => 'dump_??????{01,07,14,21,28}-??????.sql',
  }

  tidy { "${datadir}/backup all":
    path    => "${datadir}/backup",
    age     => '14d',
    recurse => true,
    matches => 'dump_*.sql',
  }

  if $backup_target != '' {
    backup::repo { 'grafana':
      source        => "${datadir}/data",
      target        => $backup_target,
      watchdog_url  => $backup_data_watchdog,
      password      => $backup_password,
      environment   => $backup_environment,
      rclone_config => $backup_rclone,
    }

    backup::repo { 'grafana-provisioning':
      source        => "${datadir}/provisioning",
      target        => $backup_target,
      watchdog_url  => $backup_provisioning_watchdog,
      password      => $backup_password,
      environment   => $backup_environment,
      rclone_config => $backup_rclone,
    }

    backup::repo { 'grafana-database':
      source        => "${datadir}/backup",
      target        => $backup_target,
      watchdog_url  => $backup_database_watchdog,
      password      => $backup_password,
      environment   => $backup_environment,
      rclone_config => $backup_rclone,
    }
  }
}