From 68337ff760ab04b714e46fe7ecf855079ec3af13 Mon Sep 17 00:00:00 2001
From: teutat3s <teutates@mailbox.org>
Date: Sun, 3 Dec 2023 14:19:30 +0100
Subject: [PATCH] feat(flora-6): init grafana + prometheus on

grafana.pub.solar
---
 hosts/flora-6/apps/caddy.nix               |   8 +++
 hosts/flora-6/apps/grafana.nix             |  67 +++++++++++++++++++++
 hosts/flora-6/apps/prometheus.nix          |  27 +++++++++
 hosts/flora-6/default.nix                  |   2 +
 secrets/grafana-admin-password.age         | Bin 0 -> 1506 bytes
 secrets/grafana-keycloak-client-secret.age |  28 +++++++++
 secrets/grafana-smtp-password.age          | Bin 0 -> 1543 bytes
 secrets/secrets.nix                        |   4 ++
 terraform/dns.tf                           |   5 ++
 9 files changed, 141 insertions(+)
 create mode 100644 hosts/flora-6/apps/grafana.nix
 create mode 100644 hosts/flora-6/apps/prometheus.nix
 create mode 100644 secrets/grafana-admin-password.age
 create mode 100644 secrets/grafana-keycloak-client-secret.age
 create mode 100644 secrets/grafana-smtp-password.age

diff --git a/hosts/flora-6/apps/caddy.nix b/hosts/flora-6/apps/caddy.nix
index a241de2..bc6fac3 100644
--- a/hosts/flora-6/apps/caddy.nix
+++ b/hosts/flora-6/apps/caddy.nix
@@ -27,6 +27,14 @@
           reverse_proxy :4000
         '';
       };
+      "grafana.pub.solar" = {
+        logFormat = lib.mkForce ''
+          output discard
+        '';
+        extraConfig = ''
+          reverse_proxy :${toString config.services.grafana.settings.server.http_port}
+        '';
+      };
       "obs-portal.pub.solar" = {
         logFormat = lib.mkForce ''
           output discard
diff --git a/hosts/flora-6/apps/grafana.nix b/hosts/flora-6/apps/grafana.nix
new file mode 100644
index 0000000..2727b8e
--- /dev/null
+++ b/hosts/flora-6/apps/grafana.nix
@@ -0,0 +1,67 @@
+{
+  config,
+  lib,
+  pkgs,
+  flake,
+  ...
+}: {
+  age.secrets.grafana-admin-password = {
+    file = "${flake.self}/secrets/grafana-admin-password.age";
+    mode = "644";
+    owner = "grafana";
+  };
+  age.secrets.grafana-smtp-password = {
+    file = "${flake.self}/secrets/grafana-smtp-password.age";
+    mode = "644";
+    owner = "grafana";
+  };
+  age.secrets.grafana-keycloak-client-secret = {
+    file = "${flake.self}/secrets/grafana-keycloak-client-secret.age";
+    mode = "644";
+    owner = "grafana";
+  };
+
+  services.grafana = {
+    enable = true;
+    settings = {
+      server = {
+        # Listening Address
+        http_addr = "127.0.0.1";
+        # and Port
+        http_port = 3000;
+        # Grafana needs to know on which domain and URL it's running
+        domain = "grafana.pub.solar";
+        enable_gzip = true;
+      };
+      smtp = {
+        enabled = true;
+        host = "mx2.greenbaum.cloud:465";
+        user = "admins@pub.solar";
+        password = "\$__file{${config.age.secrets.grafana-smtp-password.path}}";
+        from_address = "no-reply@pub.solar";
+        from_name = "grafana.pub.solar";
+        ehlo_identity = "flora-6.pub.solar";
+      };
+      security = {
+        admin_email = "crew@pub.solar";
+        admin_password = "\$__file{${config.age.secrets.grafana-admin-password.path}}";
+      };
+      "auth.generic_oauth" = {
+        enabled = true;
+        name = "pub.solar ID";
+        allow_sign_up = true;
+        client_id = "grafana";
+        client_secret = "\$__file{${config.age.secrets.grafana-keycloak-client-secret.path}}";
+        scopes = "openid email profile offline_access roles";
+        email_attribute_path = "email";
+        login_attribute_path = "preferred_username";
+        name_attribute_path = "full_name";
+        auth_url = "https://auth.pub.solar/realms/pub.solar/protocol/openid-connect/auth";
+        token_url = "https://auth.pub.solar/realms/pub.solar/protocol/openid-connect/token";
+        api_url = "https://auth.pub.solar/realms/pub.solar/protocol/openid-connect/userinfo";
+        role_attribute_path = "contains(info.roles[*], 'admin') && 'GrafanaAdmin' || contains(info.roles[*], 'editor') && 'Editor' || 'Viewer'";
+        allow_assign_grafana_admin = true;
+      };
+    };
+  };
+}
diff --git a/hosts/flora-6/apps/prometheus.nix b/hosts/flora-6/apps/prometheus.nix
new file mode 100644
index 0000000..7ae27ea
--- /dev/null
+++ b/hosts/flora-6/apps/prometheus.nix
@@ -0,0 +1,27 @@
+{
+  config,
+  lib,
+  pkgs,
+  flake,
+  ...
+}: {
+  services.prometheus = {
+    enable = true;
+    port = 9001;
+    exporters = {
+      node = {
+        enable = true;
+        enabledCollectors = [ "systemd" ];
+        port = 9002;
+      };
+    };
+    scrapeConfigs = [
+      {
+        job_name = "flora-6";
+        static_configs = [{
+          targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.node.port}" ];
+        }];
+      }
+    ];
+  };
+}
diff --git a/hosts/flora-6/default.nix b/hosts/flora-6/default.nix
index 6511a00..6478858 100644
--- a/hosts/flora-6/default.nix
+++ b/hosts/flora-6/default.nix
@@ -11,5 +11,7 @@
 
       ./apps/drone.nix
       ./apps/forgejo-actions-runner.nix
+      ./apps/grafana.nix
+      ./apps/prometheus.nix
     ];
 }
diff --git a/secrets/grafana-admin-password.age b/secrets/grafana-admin-password.age
new file mode 100644
index 0000000000000000000000000000000000000000..9ce754dfdb4172a7e7196658428151f4c00382d5
GIT binary patch
literal 1506
zcmZXTx$fkI0f$ptN<l>`G}PuFdwfrWG`7drc<k|gBvRJb_#EHY_$^o=Bnqe~5XS>R
zLk9>Uq(n-dfP!Kpr3@WQu_-oB@acDaL7F@zb<{uFF>mTWH+>4td*JEa-7sWNNsQq5
z{;>04-w&2uSo_sJV-whCq(!_PVgj~9W2St@s_J5p>aHh1&^q;K1Z0)tCB<BjRVDTC
zlp$@nR&J)01k?Mf!-4YM7%r!?Lc_1qCNE-@WtSbyaUt>jwuO0kRR-Gak-{RJY{_Ky
z$h%A}4H#2Ckdp<FqNRBjXf8|=GAowOi+O3_=5Cj{n89dCh;Y_$TA<6=D_TDUyOLuK
z_y`z<e^hz+aJjB&bc(eUcSYF{td1WBGbJvgGFL4xKOAsHrt#Q2c0adtn@DvI(R85z
z<sFnZl&%~YY0ENdGrBNa!$Iy=Rr*$YsR_`UZqC_GA=5tBuIpj@0fX-XuR6GS6M;Ly
zsBA)B?v%a`9JWA5sI_EXQHsV9@!LTmD<~UlEKyrDJrvhGy=q!Cs}CsCwfJEI*uV?&
zlF@fl+;~k+V0aelw1?Xa)O+4J3It^t+*mP%b}5CF&8&K4loL9kyg91Q1Ox;uRu$qS
zoYYD$%M9)WInS^?RORtv7#@uqEfhW+e!Na$ruU`6#XPea$I5u{47dRJFe_!$^(}!?
zr+9C~xH$wfzV~lDyZMx6lc7U_>`=!Xm(VRWOYO18DbMtSbFG&OU`DvTUFnrMVS+L1
ziiJj=D~OrXA~GtQj9<G0;(;#2Hyv!P+<0pDDkoqpaYIl^TYz5l_HhLs+~6SzEGW|X
zCF4OmR6X5zY}<Kn(TfUBigvPDYj~Kjj8<2_<jyjdR5?)q0yWyx(A6}B%AJuT)<elH
z))LfA?;4~Ebs`g!oK&aY3l~y>t$viTl7K`JNwXp;0erQli>I)X3s%FnCsmi`Lnw4L
z-$k)-Of+??#rfqyI5jAR+c6Gk32%B=Vb#Y`mnUFL!9AK>&@gMG)liGD>&obM>u30&
z^V1P>)DD`@P`et<s~`W*QO;0@bmy5SiRV_7b9Eq}7oBV_CT2~|+7qReh^1p~XwH)}
z&xwH6@YP{`S-A<FC`Z$_CWTehpVrfi9Q{a00^iQg7RpBd=V&h21bW;Rj7r`ye=cG+
zg}UBMg?YJ2Iw@vLPD^4i`PDY~j}B!nfS8=}9v0Ajlb1Gu;D-V(c%Dkx3OdE@0OA&z
zjs$-_r|Ik2X#3?{$6XKxRwPth(Lip4P~eH{nS!A2u+j%L_y9*t6U|9i_v->U1BJ(G
z>}}McCl6;dMkj)|ntKl-MPEAb9N$bhA`kXL{Z1SI5;R@^l=ew5Bs<aEcF*K4+`Sz+
z&vxguEKvZ=)?OX8>%6~bD-$~Ue82>zJDV4~K+Qf*?KliUz7O3r!1)ct(u3DsJmBf+
zY4^yksHWedfrnHXVZfnUS0bZ$aimAQab`)L!2EFLK==fF{kQemzmVtu30LGUciBI_
zQvdMn5AXc^-1_^+FaG_-H=lj<-3$MX{hObD@z-<kBlF9PFF*M4={q)ZKKb>hta|?6
YKmAI*HGTj74y@hJKYZ`4Kbrsi4TlN$LI3~&

literal 0
HcmV?d00001

diff --git a/secrets/grafana-keycloak-client-secret.age b/secrets/grafana-keycloak-client-secret.age
new file mode 100644
index 0000000..b4c01fa
--- /dev/null
+++ b/secrets/grafana-keycloak-client-secret.age
@@ -0,0 +1,28 @@
+age-encryption.org/v1
+-> ssh-ed25519 Y0ZZaw M6ha3gQ4Oq4PdymYZ5ZG0qGwFlpCYfJdhOBwH9n1gxg
+zCtB0PJanufNdV0ShynDT0Z/2jxMFDRby8xsfv6YPaA
+-> ssh-ed25519 uYcDNw V89Ll4HJ3ZkQegiCI6gswz736domVgDGSDCA8bZBwHs
+W7IrEL+1xUXuVdy6A61z6P+pS/ajTGPL+qv+9Jh8UxI
+-> ssh-rsa kFDS0A
+SV6QVIW8MCQVB8ABiOGxLTXEMO6rfeG82CktBFtf76WeIYzlkho/IaGgWXoqoIQ0
+KC/ev7vNGnB01AOWe/xkuMZDRvK+qGaOLB7wpZG1cJhqSon9oZtztoDjd/Crp5K0
+nfeHjY9E/jgFr0KYeaLedw5OJuaOw4YiuKyTThVbpRZwbof30nvHXqrYKPZJi1gq
+s5spoWYH2ijZi9mrJojP2ZqK5DJjCteXqP1YHdz3LjxomoDyl5cv/tLNsvrptfxD
+FvZMcPrvrC/IWqJ8qGW+f8ENUGyjXxx6jFQ2WN9IMIdJYk5bz458ip3GKqnAlwi3
+SZbaxRuEYEoy6ikKGRuXMAwpJd3YXcRcaRdetw0a4grdD6hF21bTl2+LnTb1ydnb
+frzeoXaqbBdhEyLpZFAmGLydteIyA/Kl/D/PEJ0MHc0G0EGofMm6YsNJJrP3mQgi
+mXC2Kto6WV/JLVEnURayf12rPR1T/VPIyYZ/Xi9HfPh0p3Y21nadPAcEq/PltWgR
+AqELfBbVpNtcxTP2pjEJqGskJCYKAmMeM+yQ0moKVmuMWicahMqjQRJO1jnvTwwd
+GhJlUO32EuI6Fn6sApthv2FfLrle+x0H4/v9xvHDJIVSmLYtzK+9ueUPn/A1x8X1
+lGeJh+ecEV2r630insGAp8WQzyXhraHrn3lgyacwRmA
+-> ssh-ed25519 YFSOsg KKhXh/XW7iF7wMA7JD9fbgmty5yVPaSS1vGdHz0Xh0M
+eLJc+F/yIR1ckZX/npLI+l3I2iB+OrKBkJAQTkbWVF4
+-> ssh-ed25519 iHV63A xoJ7Tr8mKgYVPPeJYBnOHLBY5E0i34vEQR3pMVKxbAc
+TKqc9Y/RpnfTP3CNvCearB4FuvNmW0mcGVLh7Ebjzeo
+-> ssh-ed25519 BVsyTA LaMK6X/MJyQTQ24p9uHXh75leMcp/akCA2YZACEG03M
+psw6sVlNGT8WsG3L9kbXdrhqxp8hIdSF7s4o60jTYgY
+-> vcxmk`-grease 8^p$~+LB -G)+N&$^ P)7#7[wX
+8TyK2RrSHFuMyFy9YY7ZI6RSduF5hw6xZKhiysVkif4Husb1flN8QVmWtoW8laWz
+n8772TmNTcfq5ebUp+UA+S6MVgf75D1GnDumEDH/LbM4LNjRZzyw3nBGu/Q
+--- Ouu56e69gTpAY1ouLPlzI/n6geKz1CMmTl8wAVyIDPM
+���5��7W>J@���j����l_�����/����=�ջ�4(���K����ѥ�zS�s�
\ No newline at end of file
diff --git a/secrets/grafana-smtp-password.age b/secrets/grafana-smtp-password.age
new file mode 100644
index 0000000000000000000000000000000000000000..44cf171fcf5b446f2d37e23f371bd89981751cfa
GIT binary patch
literal 1543
zcmZXTyY9ng0mYduh7OfjgOI8s_g~**TSy=~PMr7>Ut{MpLc+Ivu^nGO+lehz^fh2%
zL#RWiN_~Ke1t!>#cm#GjFz{z6LwSIs-#JI;#4vx$n{-&Zv1pr5+W`_Yg}wcJgV6mg
z&uEUL#0?;$D1L72oNW)a96JH@nwPvZOHx@V$yl2n)Kmnr_yCf4B*1~ibe-G3yy+F&
z6Q?_TdtwKo>ZRASIc32aA&({EX1(VnDSV$cfmAs^H|%tTfqkV=Q#;KTU+eAu?A?M!
z=kR{M*qTj5Nv9E%p;p+@P_olBP%bxv9b_2y1@C$}?>%i2s=nr$2uDH2yRHPkqYWtD
zR0qW)CCo7=W({{@ROCtFxWkif#0R0I%(^{_wR_|iJrCs_)K8P(LEbkz`>aN6mUFwd
zeDWRkWX^z(ctW`6t$;^dbyUtGKaL@RaH#`AB~&T3UVzMOZ9f~WqZ%u|zOOAVBzX6R
zW5a^P@UXB&r%dwhNx7*TvA!yFOqIkU-5<ra(*oQSb9re`cUCrva(5#hnH`>#6S-pf
z9jXxW0hHXn%3NIY7`@TD-Rn|bGCdG$rJd$<Uuv*TgVLG<PCL8{^xpHlX_j)VtMIjG
zOW@ixP^OT(dWD4m!w!?%y;K}+oz|h<ZlxJB?LCLS7RAoBh5L9cZUU7?*g+!AhiHzT
zuN6~e#ZlC%GxD4;9q6#>S5jIHFQe?WI!Dpk8TiB=Q>dMX&hn>KDzN5UUq_&LrTiLX
zHyF;fEd#%1pD}xH+pz7sSY^?pp5%)`9afc0&Ug~)m6q?Ib0Kfow5yN`ja_;q^FX0j
zf!iyVif|x#M@N}=2360l=m_vYGNrs|BOv58+qdGuI&w#dusUs1(OCG^_j`6Y9oOw}
zCWf|~w=^pY<_?ZhUz~fYVN;;JI0D(JCb?aG+rHG?mMpC3WAoulJ`JXWS_<~v->G|M
zxwOdeEl4NhOY-e|8?VN-?D+W5f=Xn_e9skgwBj<rwDCmT<aLj8+x_B{oN^Ka$U#5h
zO_S=Vn<pn(j)Qi-f$w(wzmFa~3&D;31Ugsro>@1E9bS~a?-J38*UTbh2jMhfXnZ4u
z?xS$9o(2Zg#CXgf+>{U5qVVFKR3&6er;1ZuS|{jUdIDkh{64KX23tnj&>~kj^eO8*
zp4uB*Rd3D3F<COCsHJu@s47dy%VJUZ08_-+y)w&9?@De$)%ZdTZQU%PuM$6uL<6w9
z*R9s6y!}6#9H7OQHcwQ|51c07bJ)UDA2`>fAn(=}1u$d-Co)K%!?QE4O^P*B+MH(9
z;?Z`w${ew!-cJ<(RN7bhfg?ACC#~kYK4P8!X1m<gH#p=m$~W6jhUgdk#`?+m(~mdp
z$J+)r^v^aQ{hF?Sg*Ab^mfRuAAMzq=H(DK&X^6?-ESM-1BC5E*TXY0t#VOB}21je5
zdDWe(Anx&ixSCj<+$UU8OGt|}xF{n!f$ne<eO>TFD!jBbC8vroX4gARG=U=4X?+Dt
zP-1UyZ=1>k^LusfYaV4|G`4d%pM_%IshKb&mjih6{CuboF=`0=<JZ6Z@`K-e^}|1X
xZv6Cj*uQ>YfB3h5@LzoWP5=Af{^iF%`sfe;R-He8{?$J}`}VJ&+^>KC_CLiN`vm|1

literal 0
HcmV?d00001

diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index 594748b..3abf74f 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -62,4 +62,8 @@ in {
   "mediawiki-secret-key.age".publicKeys = nachtigallKeys ++ baseKeys;
 
   "coturn-static-auth-secret.age".publicKeys = nachtigallKeys ++ baseKeys;
+
+  "grafana-admin-password.age".publicKeys = flora6Keys ++ baseKeys;
+  "grafana-keycloak-client-secret.age".publicKeys = flora6Keys ++ baseKeys;
+  "grafana-smtp-password.age".publicKeys = flora6Keys ++ baseKeys;
 }
diff --git a/terraform/dns.tf b/terraform/dns.tf
index 57b230c..f7380ab 100644
--- a/terraform/dns.tf
+++ b/terraform/dns.tf
@@ -83,6 +83,11 @@ resource "namecheap_domain_records" "pub-solar" {
     address = "138.201.80.102"
     ttl = 300
   }
+  record {
+    hostname = "grafana"
+    type = "CNAME"
+    address = "nachtigall.pub.solar."
+  }
   record {
     hostname = "hpb"
     type = "A"