Joakim
1f3f111d88
Implement complete monitoring infrastructure following rick-infra principles: Components: - VictoriaMetrics: Prometheus-compatible TSDB (7x less RAM usage) - Grafana: Visualization dashboard with Authentik OAuth/OIDC integration - node_exporter: System metrics collection (CPU, memory, disk, network) Architecture: - All services run as native systemd binaries (no containers) - localhost-only binding for security - Grafana uses native OAuth integration with Authentik (not forward_auth) - Full systemd security hardening enabled - Proxied via Caddy at metrics.jnss.me with HTTPS Role Features: - Unified metrics role (single role for complete stack) - Automatic role mapping via Authentik groups: - authentik Admins OR grafana-admins -> Admin access - grafana-editors -> Editor access - All others -> Viewer access - VictoriaMetrics auto-provisioned as default Grafana datasource - 12-month metrics retention by default - Comprehensive documentation included Security: - OAuth/OIDC SSO via Authentik - All metrics services bind to 127.0.0.1 only - systemd hardening (NoNewPrivileges, ProtectSystem, etc.) - Grafana accessible only via Caddy HTTPS proxy Documentation: - roles/metrics/README.md: Complete role documentation - docs/metrics-deployment-guide.md: Step-by-step deployment guide Configuration: - Updated rick-infra.yml to include metrics deployment - Grafana port set to 3001 (Gitea uses 3000) - Ready for multi-host expansion (designed for future node_exporter deployment to production hosts)
69 lines
1.7 KiB
Django/Jinja
69 lines
1.7 KiB
Django/Jinja
# Grafana Configuration
|
|
# Managed by Ansible - DO NOT EDIT MANUALLY
|
|
|
|
[paths]
|
|
data = {{ grafana_data_dir }}
|
|
logs = {{ grafana_logs_dir }}
|
|
plugins = {{ grafana_plugins_dir }}
|
|
provisioning = {{ grafana_provisioning_dir }}
|
|
|
|
[server]
|
|
http_addr = {{ grafana_listen_address }}
|
|
http_port = {{ grafana_listen_port }}
|
|
domain = {{ grafana_domain }}
|
|
root_url = {{ grafana_root_url }}
|
|
enforce_domain = true
|
|
enable_gzip = true
|
|
|
|
[database]
|
|
type = {{ grafana_database_type }}
|
|
{% if grafana_database_type == 'sqlite3' %}
|
|
path = {{ grafana_database_path }}
|
|
{% endif %}
|
|
|
|
[security]
|
|
admin_user = {{ grafana_admin_user }}
|
|
admin_password = {{ grafana_admin_password }}
|
|
secret_key = {{ vault_grafana_secret_key }}
|
|
cookie_secure = {{ grafana_cookie_secure | lower }}
|
|
cookie_samesite = {{ grafana_cookie_samesite }}
|
|
disable_gravatar = true
|
|
disable_initial_admin_creation = false
|
|
|
|
[users]
|
|
allow_sign_up = {{ grafana_allow_signup | lower }}
|
|
allow_org_create = false
|
|
auto_assign_org = true
|
|
auto_assign_org_role = Viewer
|
|
|
|
[auth]
|
|
disable_login_form = {{ grafana_disable_login_form | lower }}
|
|
oauth_auto_login = false
|
|
|
|
{% if grafana_oauth_enabled %}
|
|
[auth.generic_oauth]
|
|
enabled = true
|
|
name = {{ grafana_oauth_name }}
|
|
client_id = {{ grafana_oauth_client_id }}
|
|
client_secret = {{ grafana_oauth_client_secret }}
|
|
scopes = {{ grafana_oauth_scopes }}
|
|
auth_url = {{ grafana_oauth_auth_url }}
|
|
token_url = {{ grafana_oauth_token_url }}
|
|
api_url = {{ grafana_oauth_api_url }}
|
|
allow_sign_up = {{ grafana_oauth_allow_sign_up | lower }}
|
|
role_attribute_path = {{ grafana_oauth_role_attribute_path }}
|
|
use_pkce = true
|
|
{% endif %}
|
|
|
|
[log]
|
|
mode = console
|
|
level = info
|
|
|
|
[analytics]
|
|
reporting_enabled = false
|
|
check_for_updates = false
|
|
check_for_plugin_updates = false
|
|
|
|
[snapshots]
|
|
external_enabled = false
|