Joakim
1f3f111d88
Implement complete monitoring infrastructure following rick-infra principles: Components: - VictoriaMetrics: Prometheus-compatible TSDB (7x less RAM usage) - Grafana: Visualization dashboard with Authentik OAuth/OIDC integration - node_exporter: System metrics collection (CPU, memory, disk, network) Architecture: - All services run as native systemd binaries (no containers) - localhost-only binding for security - Grafana uses native OAuth integration with Authentik (not forward_auth) - Full systemd security hardening enabled - Proxied via Caddy at metrics.jnss.me with HTTPS Role Features: - Unified metrics role (single role for complete stack) - Automatic role mapping via Authentik groups: - authentik Admins OR grafana-admins -> Admin access - grafana-editors -> Editor access - All others -> Viewer access - VictoriaMetrics auto-provisioned as default Grafana datasource - 12-month metrics retention by default - Comprehensive documentation included Security: - OAuth/OIDC SSO via Authentik - All metrics services bind to 127.0.0.1 only - systemd hardening (NoNewPrivileges, ProtectSystem, etc.) - Grafana accessible only via Caddy HTTPS proxy Documentation: - roles/metrics/README.md: Complete role documentation - docs/metrics-deployment-guide.md: Step-by-step deployment guide Configuration: - Updated rick-infra.yml to include metrics deployment - Grafana port set to 3001 (Gitea uses 3000) - Ready for multi-host expansion (designed for future node_exporter deployment to production hosts)
91 lines
2.5 KiB
YAML
91 lines
2.5 KiB
YAML
---
|
|
- name: Create Grafana system user
|
|
ansible.builtin.user:
|
|
name: "{{ grafana_user }}"
|
|
system: true
|
|
create_home: false
|
|
shell: /usr/sbin/nologin
|
|
state: present
|
|
|
|
- name: Create Grafana directories
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
owner: "{{ grafana_user }}"
|
|
group: "{{ grafana_group }}"
|
|
mode: '0755'
|
|
loop:
|
|
- "{{ grafana_data_dir }}"
|
|
- "{{ grafana_logs_dir }}"
|
|
- "{{ grafana_plugins_dir }}"
|
|
- "{{ grafana_provisioning_dir }}"
|
|
- "{{ grafana_provisioning_dir }}/datasources"
|
|
- "{{ grafana_provisioning_dir }}/dashboards"
|
|
- "{{ grafana_data_dir }}/dashboards"
|
|
- /etc/grafana
|
|
|
|
- name: Download Grafana binary
|
|
ansible.builtin.get_url:
|
|
url: "https://dl.grafana.com/oss/release/grafana-{{ grafana_version }}.linux-amd64.tar.gz"
|
|
dest: "/tmp/grafana-{{ grafana_version }}.tar.gz"
|
|
mode: '0644'
|
|
register: grafana_download
|
|
|
|
- name: Extract Grafana
|
|
ansible.builtin.unarchive:
|
|
src: "/tmp/grafana-{{ grafana_version }}.tar.gz"
|
|
dest: /opt
|
|
remote_src: true
|
|
creates: "/opt/grafana-v{{ grafana_version }}"
|
|
when: grafana_download.changed
|
|
|
|
- name: Create Grafana symlink
|
|
ansible.builtin.file:
|
|
src: "/opt/grafana-v{{ grafana_version }}"
|
|
dest: /opt/grafana
|
|
state: link
|
|
|
|
- name: Deploy Grafana configuration
|
|
ansible.builtin.template:
|
|
src: grafana.ini.j2
|
|
dest: /etc/grafana/grafana.ini
|
|
owner: "{{ grafana_user }}"
|
|
group: "{{ grafana_group }}"
|
|
mode: '0640'
|
|
notify: restart grafana
|
|
|
|
- name: Deploy VictoriaMetrics datasource provisioning
|
|
ansible.builtin.template:
|
|
src: datasource-victoriametrics.yml.j2
|
|
dest: "{{ grafana_provisioning_dir }}/datasources/victoriametrics.yml"
|
|
owner: "{{ grafana_user }}"
|
|
group: "{{ grafana_group }}"
|
|
mode: '0644'
|
|
notify: restart grafana
|
|
when: grafana_datasource_vm_enabled
|
|
|
|
- name: Deploy dashboard provisioning
|
|
ansible.builtin.template:
|
|
src: dashboards.yml.j2
|
|
dest: "{{ grafana_provisioning_dir }}/dashboards/default.yml"
|
|
owner: "{{ grafana_user }}"
|
|
group: "{{ grafana_group }}"
|
|
mode: '0644'
|
|
notify: restart grafana
|
|
|
|
- name: Deploy Grafana systemd service
|
|
ansible.builtin.template:
|
|
src: grafana.service.j2
|
|
dest: /etc/systemd/system/grafana.service
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
notify: restart grafana
|
|
|
|
- name: Enable and start Grafana service
|
|
ansible.builtin.systemd:
|
|
name: grafana
|
|
enabled: "{{ grafana_service_enabled }}"
|
|
state: "{{ grafana_service_state }}"
|
|
daemon_reload: true
|