pub-solar/matrix-docker-ansible-deploy
5
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

Replace matrix-grafana with an external role

Browse source
This commit is contained in:
Slavi Pantaleev 2023-02-15 10:30:58 +02:00
parent 94124263a7
commit 1006b8d899
21 changed files with 97 additions and 333 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
CHANGELOG.md
View file

@ -1,3 +1,14 @@
# 2023-02-15
## The matrix-grafana role lives independently now
**TLDR**: the `matrix-grafana` role is now included from another repository. Some variables have been renamed. All functionality remains intact.
The `matrix-grafana` role (which configures [Grafana](docs/configuring-playbook-prometheus-grafana.md)) has been extracted from the playbook and now lives in its [own repository](https://gitlab.com/etke.cc/roles/grafana). This makes it possible to easily use it in other Ansible playbooks.
You need to **update you roles** (`just roles` or `make roles`) regardless of whether you're enabling Grafana or not. If you're making use of Grafana via this playbook, you will need to update variable references in your `vars.yml` file (`matrix_grafana_` -> `grafana_`).
# 2023-02-13
## The matrix-backup-borg role lives independently now

14
docs/configuring-playbook-prometheus-grafana.md
View file

@ -18,16 +18,16 @@ prometheus_postgres_exporter_enabled: true
# You can remove this, if unnecessary.
matrix_prometheus_nginxlog_exporter_enabled: true
matrix_grafana_enabled: true
grafana_enabled: true
matrix_grafana_anonymous_access: false
grafana_anonymous_access: false
# This has no relation to your Matrix user id. It can be any username you'd like.
# Changing the username subsequently won't work.
matrix_grafana_default_admin_user: "some_username_chosen_by_you"
grafana_default_admin_user: "some_username_chosen_by_you"
# Changing the password subsequently won't work.
matrix_grafana_default_admin_password: "some_strong_password_chosen_by_you"
grafana_default_admin_password: "some_strong_password_chosen_by_you"
```
By default, a [Grafana](https://grafana.com/) web user-interface will be available at `https://stats.<your-domain>`.
@ -43,9 +43,9 @@ Name | Description
`prometheus_node_exporter_enabled`|[Node Exporter](https://prometheus.io/docs/guides/node-exporter/) is an addon of sorts to Prometheus that collects generic system information such as CPU, memory, filesystem, and even system temperatures
`prometheus_postgres_exporter_enabled`|[Postgres Exporter](configuring-playbook-prometheus-postgres.md) is an addon of sorts to expose Postgres database metrics to Prometheus.
`matrix_prometheus_nginxlog_exporter_enabled`|[NGINX Log Exporter](configuring-playbook-prometheus-nginxlog.md) is an addon of sorts to expose NGINX logs to Prometheus.
`matrix_grafana_enabled`|[Grafana](https://grafana.com/) is the visual component. It shows (on the `stats.<your-domain>` subdomain) the dashboards with the graphs that we're interested in
`matrix_grafana_anonymous_access`|By default you need to log in to see graphs. If you want to publicly share your graphs (e.g. when asking for help in [`#synapse:matrix.org`](https://matrix.to/#/#synapse:matrix.org?via=matrix.org&via=privacytools.io&via=mozilla.org)) you'll want to enable this option.
`matrix_grafana_default_admin_user`<br>`matrix_grafana_default_admin_password`|By default Grafana creates a user with `admin` as the username and password. If you feel this is insecure and you want to change it beforehand, you can do that here
`grafana_enabled`|[Grafana](https://grafana.com/) is the visual component. It shows (on the `stats.<your-domain>` subdomain) the dashboards with the graphs that we're interested in
`grafana_anonymous_access`|By default you need to log in to see graphs. If you want to publicly share your graphs (e.g. when asking for help in [`#synapse:matrix.org`](https://matrix.to/#/#synapse:matrix.org?via=matrix.org&via=privacytools.io&via=mozilla.org)) you'll want to enable this option.
`grafana_default_admin_user`<br>`grafana_default_admin_password`|By default Grafana creates a user with `admin` as the username and password. If you feel this is insecure and you want to change it beforehand, you can do that here
## Security and privacy

6
docs/configuring-playbook-prometheus-nginxlog.md
View file

@ -15,13 +15,13 @@ matrix_prometheus_nginxlog_exporter_enabled: true
matrix_prometheus_enabled: true
# optional for visualization
matrix_grafana_enabled: true
grafana_enabled: true
```
x | Prerequisites | Variable | Description
|:--:|:--:|:--:|:--|
**REQUIRED** | `matrix-prometheus`| `matrix_prometheus_enabled`|[Prometheus](https://prometheus.io) is a time series database. It holds all the data we're going to talk about.
_Optional_ | [`matrix-grafana`](configuring-playbook-prometheus-grafana.md) | [`matrix_grafana_enabled`](configuring-playbook-prometheus-grafana.md)|[Grafana](https://grafana.com) is the visual component. It shows (on the `stats.<your-domain>` subdomain) graphs that we're interested in. When enabled the `NGINX PROXY` dashboard is automatically added.
_Optional_ | [`matrix-grafana`](configuring-playbook-prometheus-grafana.md) | [`grafana_enabled`](configuring-playbook-prometheus-grafana.md)|[Grafana](https://grafana.com) is the visual component. It shows (on the `stats.<your-domain>` subdomain) graphs that we're interested in. When enabled the `NGINX PROXY` dashboard is automatically added.
## Docker Image Compatibility
@ -56,4 +56,4 @@ The following variables may be of interest:
Name | Description
-----|----------
`matrix_nginx_proxy_proxy_matrix_metrics_enabled`|Set this to `true` to enable metrics exposure for various services on `https://matrix.DOMAIN/metrics/*`. Refer to the individual `matrix_SERVICE_metrics_proxying_enabled` variables below for exposing metrics for each individual service.
`matrix_nginx_proxy_proxy_matrix_metrics_enabled`|Set this to `true` to enable metrics exposure for various services on `https://matrix.DOMAIN/metrics/*`. Refer to the individual `matrix_SERVICE_metrics_proxying_enabled` variables below for exposing metrics for each individual service.

69
group_vars/matrix_servers
View file

@ -306,7 +306,7 @@ devture_systemd_service_manager_services_list_auto: |
+
([{'name': 'matrix-etherpad.service', 'priority': 4000, 'groups': ['matrix', 'etherpad']}] if matrix_etherpad_enabled else [])
+
([{'name': 'matrix-grafana.service', 'priority': 4000, 'groups': ['matrix', 'monitoring', 'grafana']}] if matrix_grafana_enabled else [])
([{'name': (grafana_identifier + '.service'), 'priority': 4000, 'groups': ['matrix', 'monitoring', 'grafana']}] if grafana_enabled else [])
+
([{'name': 'matrix-jitsi-web.service', 'priority': 4200, 'groups': ['matrix', 'jitsi', 'jitsi-web']}] if matrix_jitsi_enabled else [])
+
@ -2389,7 +2389,7 @@ matrix_nginx_proxy_proxy_bot_go_neb_enabled: "{{ matrix_bot_go_neb_enabled }}"
matrix_nginx_proxy_proxy_jitsi_enabled: "{{ matrix_jitsi_enabled }}"
matrix_nginx_proxy_proxy_jitsi_manage_wellknown: "{{ matrix_jitsi_require_well_known }}"
matrix_nginx_proxy_proxy_grafana_enabled: "{{ matrix_grafana_enabled }}"
matrix_nginx_proxy_proxy_grafana_enabled: "{{ grafana_enabled }}"
matrix_nginx_proxy_proxy_sygnal_enabled: "{{ matrix_sygnal_enabled }}"
matrix_nginx_proxy_proxy_ntfy_enabled: "{{ matrix_ntfy_enabled }}"
@ -2403,7 +2403,6 @@ matrix_nginx_proxy_container_labels_traefik_proxy_dimension_enabled: "{{ matrix_
matrix_nginx_proxy_container_labels_traefik_proxy_etherpad_enabled: "{{ matrix_etherpad_enabled and matrix_etherpad_mode == 'standalone' }}"
matrix_nginx_proxy_container_labels_traefik_proxy_bot_go_neb_enabled: "{{ matrix_bot_go_neb_enabled }}"
matrix_nginx_proxy_container_labels_traefik_proxy_jitsi_enabled: "{{ matrix_jitsi_enabled }}"
matrix_nginx_proxy_container_labels_traefik_proxy_grafana_enabled: "{{ matrix_grafana_enabled }}"
matrix_nginx_proxy_container_labels_traefik_proxy_sygnal_enabled: "{{ matrix_sygnal_enabled }}"
matrix_nginx_proxy_container_labels_traefik_proxy_ntfy_enabled: "{{ matrix_ntfy_enabled }}"
@ -2481,7 +2480,7 @@ matrix_nginx_proxy_systemd_wanted_services_list: |
+
(['matrix-client-hydrogen.service'] if matrix_client_hydrogen_enabled else [])
+
(['matrix-grafana.service'] if matrix_grafana_enabled else [])
([(grafana_idenifier + '.service')] if grafana_enabled else [])
+
(['matrix-dimension.service'] if matrix_dimension_enabled else [])
+
@ -2520,7 +2519,7 @@ matrix_ssl_domains_to_obtain_certificates_for: |
+
([matrix_server_fqn_jitsi] if matrix_jitsi_enabled else [])
+
([matrix_server_fqn_grafana] if matrix_grafana_enabled else [])
([matrix_server_fqn_grafana] if grafana_enabled else [])
+
([matrix_server_fqn_sygnal] if matrix_sygnal_enabled else [])
+
@ -2938,7 +2937,7 @@ matrix_client_element_container_additional_networks: "{{ [matrix_playbook_revers
matrix_client_element_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
matrix_client_element_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_client_element_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary if devture_traefik_enabled else '' }}"
matrix_client_element_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
matrix_client_element_default_hs_url: "{{ matrix_homeserver_url }}"
matrix_client_element_default_is_url: "{{ matrix_identity_server_url }}"
@ -2991,7 +2990,7 @@ matrix_client_hydrogen_container_additional_networks: "{{ [matrix_playbook_rever
matrix_client_hydrogen_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
matrix_client_hydrogen_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_client_hydrogen_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary if devture_traefik_enabled else '' }}"
matrix_client_hydrogen_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
matrix_client_hydrogen_default_hs_url: "{{ matrix_homeserver_url }}"
@ -3024,7 +3023,7 @@ matrix_client_cinny_container_additional_networks: "{{ [matrix_playbook_reverse_
matrix_client_cinny_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
matrix_client_cinny_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_client_cinny_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary if devture_traefik_enabled else '' }}"
matrix_client_cinny_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
matrix_client_cinny_default_hs_url: "{{ matrix_homeserver_url }}"
@ -3192,7 +3191,7 @@ matrix_synapse_admin_container_additional_networks: "{{ [matrix_playbook_reverse
matrix_synapse_admin_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
matrix_synapse_admin_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_synapse_admin_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary if devture_traefik_enabled else '' }}"
matrix_synapse_admin_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
######################################################################
#
@ -3329,18 +3328,52 @@ matrix_prometheus_scraper_nginxlog_server_port: "{{ (matrix_prometheus_nginxlog_
######################################################################
#
# matrix-grafana
# etke/grafana
#
######################################################################
matrix_grafana_enabled: false
grafana_enabled: false
grafana_identifier: matrix-grafana
grafana_uid: "{{ matrix_user_uid }}"
grafana_gid: "{{ matrix_user_gid }}"
grafana_hostname: "{{ matrix_server_fqn_grafana }}"
grafana_base_path: "{{ matrix_base_data_path }}/grafana"
grafana_container_network: "{{ matrix_nginx_proxy_container_network if matrix_playbook_reverse_proxy_type == 'playbook-managed-nginx' else grafana_identifier }}"
grafana_container_additional_networks: |
{{
(
([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else [])
+
([matrix_prometheus_container_network] if matrix_prometheus_enabled and matrix_prometheus_container_network != grafana_container_network else [])
) | unique
}}
grafana_container_labels_traefik_enabled: "{{ matrix_playbook_traefik_labels_enabled }}"
grafana_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
grafana_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
# Normally, matrix-nginx-proxy is enabled and nginx can reach Grafana over the container network.
# If matrix-nginx-proxy is not enabled, or you otherwise have a need for it, you can expose
# Grafana's HTTP port to the local host.
matrix_grafana_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '3000') if matrix_playbook_service_host_bind_interface_prefix else '' }}"
grafana_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '3000') if matrix_playbook_service_host_bind_interface_prefix else '' }}"
matrix_grafana_dashboard_download_urls: |
grafana_provisioning_datasources: |
{{
([{
'name': (matrix_server_fqn_matrix + ' - Prometheus'),
'type': 'prometheus',
'access': 'proxy',
'url': 'http://matrix-prometheus:9090',
}] if matrix_prometheus_enabled else [])
}}
grafana_dashboard_download_urls: |
{{
(matrix_synapse_grafana_dashboard_urls if matrix_homeserver_implementation == 'synapse' and matrix_synapse_metrics_enabled else [])
+
@ -3351,18 +3384,18 @@ matrix_grafana_dashboard_download_urls: |
(matrix_prometheus_nginxlog_exporter_dashboard_urls if matrix_prometheus_nginxlog_exporter_enabled else [])
}}
matrix_grafana_default_home_dashboard_path: |-
grafana_default_home_dashboard_path: |-
{{
{
'synapse': ('/etc/grafana/dashboards/synapse.json' if matrix_synapse_metrics_enabled else '/etc/grafana/dashboards/node-exporter-full.json'),
'dendrite': '/etc/grafana/dashboards/node-exporter-full.json',
'conduit': '/etc/grafana/dashboards/node-exporter-full.json',
'synapse': ('/etc/grafana/dashboards/synapse.json' if matrix_synapse_metrics_enabled and matrix_synapse_metrics_enabled else ('/etc/grafana/dashboards/node-exporter-full.json' if prometheus_node_exporter_enabled else '')),
'dendrite': ('/etc/grafana/dashboards/node-exporter-full.json' if prometheus_node_exporter_enabled else ''),
'conduit': ('/etc/grafana/dashboards/node-exporter-full.json' if prometheus_node_exporter_enabled else ''),
}[matrix_homeserver_implementation]
}}
######################################################################
#
# /matrix-grafana
# /etke/grafana
#
######################################################################

2
playbooks/matrix.yml
View file

@ -91,7 +91,7 @@
- galaxy/prometheus_postgres_exporter
- custom/matrix-prometheus-nginxlog-exporter
- custom/matrix-prometheus
- custom/matrix-grafana
- galaxy/grafana
- custom/matrix-prometheus-services-proxy-connect
- custom/matrix-registration
- custom/matrix-client-element

3
requirements.yml
View file

@ -39,6 +39,9 @@
- src: git+https://gitlab.com/etke.cc/roles/backup_borg.git
version: v1.2.3-1.7.6-0
- src: git+https://gitlab.com/etke.cc/roles/grafana.git
version: v9.3.6-0
- src: git+https://github.com/devture/com.devture.ansible.role.traefik.git
version: fb09fd26f877372417d5586f1e79e83f983f0bd6

65
roles/custom/matrix-grafana/defaults/main.yml
View file

@ -1,65 +0,0 @@
---
# matrix-grafana is open source visualization and analytics software
# See: https://github.com/matrix-org/synapse/blob/master/docs/metrics-howto.md
# Project source code URL: https://github.com/grafana/grafana
matrix_grafana_enabled: true
matrix_grafana_version: 9.3.6
matrix_grafana_docker_image: "{{ matrix_container_global_registry_prefix }}grafana/grafana:{{ matrix_grafana_version }}"
matrix_grafana_docker_image_force_pull: "{{ matrix_grafana_docker_image.endswith(':latest') }}"
# matrix_grafana_dashboard_download_urls holds a list of URLs of dashboards to download
matrix_grafana_dashboard_download_urls: []
matrix_grafana_base_path: "{{ matrix_base_data_path }}/grafana"
matrix_grafana_config_path: "{{ matrix_grafana_base_path }}/config"
matrix_grafana_data_path: "{{ matrix_grafana_base_path }}/data"
# Allow viewing Grafana without logging in
matrix_grafana_anonymous_access: false
# When `false`, sends a `X-Frame-Options: deny` HTTP header, which allows Grafana from being embeded in a frame.
# Read more here: https://grafana.com/docs/grafana/latest/administration/configuration/#allow_embedding
matrix_grafana_allow_embedding: false
# specify organization name that should be used for unauthenticated users
# if you change this in the Grafana admin panel, this needs to be updated
# to match to keep anonymous logins working
matrix_grafana_anonymous_access_org_name: 'Main Org.'
# default admin credentials, you are asked to change these on first login
matrix_grafana_default_admin_user: admin
matrix_grafana_default_admin_password: admin
# Set to true to add the Content-Security-Policy header to your requests.
# CSP allows to control resources that the user agent can load and helps
# prevent XSS attacks.
# [Content Security Policy](https://grafana.com/docs/grafana/latest/administration/configuration/#content_security_policy)
matrix_grafana_content_security_policy: true
# specify content security policy template to customized template
# added https: and http: url schemes (ignored by browsers supporting 'strict-dynamic') to be backward compatible with older browsers.
# [Content Security Policy Browser Test] (https://content-security-policy.com/browser-test/)
# [Content Security Policy Reference](https://content-security-policy.com/script-src/)
matrix_grafana_content_security_policy_customized: false
matrix_grafana_content_security_policy_template: "script-src 'self' 'unsafe-eval' 'unsafe-inline' http: https: 'strict-dynamic' $NONCE;object-src 'none';font-src 'self';style-src 'self' 'unsafe-inline' blob:;img-src * data:;base-uri 'self';connect-src 'self' grafana.com ws://$ROOT_PATH wss://$ROOT_PATH;manifest-src 'self';media-src 'none';form-action 'self';"
# matrix_grafana_default_home_dashboard_path influences the `default_home_dashboard_path` grafana.ini setting,
# which is an in-container path for the default dashboard.
matrix_grafana_default_home_dashboard_path: /etc/grafana/dashboards/node-exporter-full.json
# A list of extra arguments to pass to the container
matrix_grafana_container_extra_arguments: []
# List of systemd services that matrix-grafana.service depends on
matrix_grafana_systemd_required_services_list: ['docker.service']
# List of systemd services that matrix-grafana.service wants
matrix_grafana_systemd_wanted_services_list: []
# Controls whether the matrix-grafana container exposes its HTTP port (tcp/3000 in the container).
#
# Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:3000"), or empty string to not expose.
matrix_grafana_container_http_host_bind_port: ''

20
roles/custom/matrix-grafana/tasks/main.yml
View file

@ -1,20 +0,0 @@
---
- block:
- when: matrix_grafana_enabled | bool
ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
- when: matrix_grafana_enabled | bool
ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
tags:
- setup-all
- setup-grafana
- install-all
- install-grafana
- block:
- when: not matrix_grafana_enabled | bool
ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
tags:
- setup-all
- setup-grafana

73
roles/custom/matrix-grafana/tasks/setup_install.yml
View file

@ -1,73 +0,0 @@
---
- name: Ensure matrix-grafana image is pulled
community.docker.docker_image:
name: "{{ matrix_grafana_docker_image }}"
source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
force_source: "{{ matrix_grafana_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_grafana_docker_image_force_pull }}"
register: result
retries: "{{ devture_playbook_help_container_retries_count }}"
delay: "{{ devture_playbook_help_container_retries_delay }}"
until: result is not failed
- name: Ensure grafana paths exists
ansible.builtin.file:
path: "{{ item }}"
state: directory
mode: 0750
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
with_items:
- "{{ matrix_grafana_base_path }}"
- "{{ matrix_grafana_config_path }}"
- "{{ matrix_grafana_config_path }}/provisioning"
- "{{ matrix_grafana_config_path }}/provisioning/datasources"
- "{{ matrix_grafana_config_path }}/provisioning/dashboards"
- "{{ matrix_grafana_config_path }}/dashboards"
- "{{ matrix_grafana_data_path }}"
- name: Ensure grafana.ini present
ansible.builtin.template:
src: "{{ role_path }}/templates/grafana.ini.j2"
dest: "{{ matrix_grafana_config_path }}/grafana.ini"
mode: 0440
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
- name: Ensure provisioning/datasources/default.yaml present
ansible.builtin.template:
src: "{{ role_path }}/templates/datasources.yaml.j2"
dest: "{{ matrix_grafana_config_path }}/provisioning/datasources/default.yaml"
mode: 0440
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
- name: Ensure provisioning/dashboards/default.yaml present
ansible.builtin.template:
src: "{{ role_path }}/templates/dashboards.yaml.j2"
dest: "{{ matrix_grafana_config_path }}/provisioning/dashboards/default.yaml"
mode: 0440
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
- name: Ensure dashboard(s) downloaded
ansible.builtin.get_url:
url: "{{ item }}"
dest: "{{ matrix_grafana_config_path }}/dashboards/"
force: true
mode: 0440
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
with_items: "{{ matrix_grafana_dashboard_download_urls }}"
register: result
retries: "{{ devture_playbook_help_geturl_retries_count }}"
delay: "{{ devture_playbook_help_geturl_retries_delay }}"
until: result is not failed
- name: Ensure matrix-grafana.service installed
ansible.builtin.template:
src: "{{ role_path }}/templates/systemd/matrix-grafana.service.j2"
dest: "{{ devture_systemd_docker_base_systemd_path }}/matrix-grafana.service"
mode: 0644
register: matrix_grafana_systemd_service_result

20
roles/custom/matrix-grafana/tasks/setup_uninstall.yml
View file

@ -1,20 +0,0 @@
---
- name: Check existence of matrix-grafana service
ansible.builtin.stat:
path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-grafana.service"
register: matrix_grafana_service_stat
- when: matrix_grafana_service_stat.stat.exists | bool
block:
- name: Ensure matrix-grafana is stopped
ansible.builtin.service:
name: matrix-grafana
state: stopped
enabled: false
daemon_reload: true
- name: Ensure matrix-grafana.service doesn't exist
ansible.builtin.file:
path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-grafana.service"
state: absent

16
roles/custom/matrix-grafana/tasks/validate_config.yml
View file

@ -1,16 +0,0 @@
---
- name: Fail if Prometheus not enabled
ansible.builtin.fail:
msg: >
You need to enable `matrix_prometheus_enabled` to use Prometheus as data source for Grafana.
when: "not matrix_prometheus_enabled"
- name: (Deprecation) Catch and report renamed settings
ansible.builtin.fail:
msg: >-
Your configuration contains a variable, which now has a different name.
Please change your configuration to rename the variable (`{{ item.old }}` -> `{{ item.new }}`).
when: "item.old in vars"
with_items:
- {'old': 'matrix_grafana_dashboard_download_urls_all', 'new': 'matrix_grafana_dashboard_download_urls'}

9
roles/custom/matrix-grafana/templates/dashboards.yaml.j2
View file

@ -1,9 +0,0 @@
apiVersion: 1
providers:
- name: {{ matrix_server_fqn_matrix }} - Dashboards
folder: '' # The folder where to place the dashboards
type: file
allowUiUpdates: true
options:
path: /etc/grafana/dashboards

8
roles/custom/matrix-grafana/templates/datasources.yaml.j2
View file

@ -1,8 +0,0 @@
apiVersion: 1
datasources:
- name: {{ matrix_server_fqn_matrix }} - Prometheus
type: prometheus
# Access mode - proxy (server in the UI) or direct (browser in the UI).
access: proxy
url: http://matrix-prometheus:9090

29
roles/custom/matrix-grafana/templates/grafana.ini.j2
View file

@ -1,29 +0,0 @@
[server]
root_url = "https://{{ matrix_server_fqn_grafana }}"
[security]
# default admin user, created on startup
admin_user = "{{ matrix_grafana_default_admin_user }}"
# default admin password, can be changed before first start of grafana, or in profile settings
admin_password = """{{ matrix_grafana_default_admin_password }}"""
# specify content_security_policy to add the Content-Security-Policy header to your requests
content_security_policy = "{{ matrix_grafana_content_security_policy }}"
# specify content security policy template to customized template
{% if matrix_grafana_content_security_policy_customized %}
content_security_policy_template = """{{ matrix_grafana_content_security_policy_template }}"""
{% endif %}
allow_embedding = {{ matrix_grafana_allow_embedding }}
[auth.anonymous]
# enable anonymous access
enabled = {{ matrix_grafana_anonymous_access }}
# specify organization name that should be used for unauthenticated users
org_name = "{{ matrix_grafana_anonymous_access_org_name }}"
[dashboards]
default_home_dashboard_path = {{ matrix_grafana_default_home_dashboard_path }}

43
roles/custom/matrix-grafana/templates/systemd/matrix-grafana.service.j2
View file

@ -1,43 +0,0 @@
#jinja2: lstrip_blocks: "True"
[Unit]
Description=matrix-grafana
{% for service in matrix_grafana_systemd_required_services_list %}
Requires={{ service }}
After={{ service }}
{% endfor %}
{% for service in matrix_grafana_systemd_wanted_services_list %}
Wants={{ service }}
{% endfor %}
DefaultDependencies=no
[Service]
Type=simple
Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}"
ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} kill matrix-grafana 2>/dev/null || true'
ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-grafana 2>/dev/null || true'
ExecStart={{ devture_systemd_docker_base_host_command_docker }} run --rm --name matrix-grafana \
--log-driver=none \
--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
--cap-drop=ALL \
--read-only \
--network={{ matrix_docker_network }} \
{% if matrix_grafana_container_http_host_bind_port %}
-p {{ matrix_grafana_container_http_host_bind_port }}:3000 \
{% endif %}
-v {{ matrix_grafana_config_path }}:/etc/grafana:z \
-v {{ matrix_grafana_data_path }}:/var/lib/grafana:z \
{% for arg in matrix_grafana_container_extra_arguments %}
{{ arg }} \
{% endfor %}
{{ matrix_grafana_docker_image }}
ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} kill matrix-grafana 2>/dev/null || true'
ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-grafana 2>/dev/null || true'
Restart=always
RestartSec=30
SyslogIdentifier=matrix-grafana
[Install]
WantedBy=multi-user.target

5
roles/custom/matrix-nginx-proxy/defaults/main.yml
View file

@ -86,11 +86,6 @@ matrix_nginx_proxy_container_labels_traefik_proxy_jitsi_hostname: "{{ matrix_ser
matrix_nginx_proxy_container_labels_traefik_proxy_jitsi_tls: "{{ matrix_nginx_proxy_container_labels_traefik_entrypoints != 'web' }}"
matrix_nginx_proxy_container_labels_traefik_proxy_jitsi_rule: "Host(`{{ matrix_nginx_proxy_container_labels_traefik_proxy_jitsi_hostname }}`)"
matrix_nginx_proxy_container_labels_traefik_proxy_grafana_enabled: false
matrix_nginx_proxy_container_labels_traefik_proxy_grafana_hostname: "{{ matrix_server_fqn_grafana }}"
matrix_nginx_proxy_container_labels_traefik_proxy_grafana_tls: "{{ matrix_nginx_proxy_container_labels_traefik_entrypoints != 'web' }}"
matrix_nginx_proxy_container_labels_traefik_proxy_grafana_rule: "Host(`{{ matrix_nginx_proxy_container_labels_traefik_proxy_grafana_hostname }}`)"
matrix_nginx_proxy_container_labels_traefik_proxy_sygnal_enabled: false
matrix_nginx_proxy_container_labels_traefik_proxy_sygnal_hostname: "{{ matrix_server_fqn_sygnal }}"
matrix_nginx_proxy_container_labels_traefik_proxy_sygnal_tls: "{{ matrix_nginx_proxy_container_labels_traefik_entrypoints != 'web' }}"

13
roles/custom/matrix-nginx-proxy/templates/labels.j2
View file

@ -97,19 +97,6 @@ traefik.http.routers.matrix-nginx-proxy-jitsi.tls.certResolver={{ matrix_nginx_p
traefik.http.routers.matrix-nginx-proxy-jitsi.entrypoints={{ matrix_nginx_proxy_container_labels_traefik_entrypoints }}
{% endif %}
{% if matrix_nginx_proxy_container_labels_traefik_proxy_grafana_enabled %}
# Grafana
traefik.http.routers.matrix-nginx-proxy-grafana.rule={{ matrix_nginx_proxy_container_labels_traefik_proxy_grafana_rule }}
traefik.http.routers.matrix-nginx-proxy-grafana.service=matrix-nginx-proxy-web
traefik.http.routers.matrix-nginx-proxy-grafana.tls={{ matrix_nginx_proxy_container_labels_traefik_proxy_grafana_tls | to_json }}
{% if matrix_nginx_proxy_container_labels_traefik_proxy_grafana_tls %}
traefik.http.routers.matrix-nginx-proxy-grafana.tls.certResolver={{ matrix_nginx_proxy_container_labels_traefik_tls_certResolver }}
{% endif %}
traefik.http.routers.matrix-nginx-proxy-grafana.entrypoints={{ matrix_nginx_proxy_container_labels_traefik_entrypoints }}
{% endif %}
{% if matrix_nginx_proxy_container_labels_traefik_proxy_sygnal_enabled %}
# Sygnal
traefik.http.routers.matrix-nginx-proxy-sygnal.rule={{ matrix_nginx_proxy_container_labels_traefik_proxy_sygnal_rule }}

4
roles/custom/matrix-prometheus-nginxlog-exporter/tasks/setup_install.yml
View file

@ -33,11 +33,11 @@
- name: Ensure grafana dashboard is installed
ansible.builtin.template:
src: "{{ role_path }}/templates/nginx-proxy.json"
dest: "{{ matrix_grafana_config_path }}/dashboards/"
dest: "{{ grafana_config_path }}/dashboards/"
mode: 0644
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
when: matrix_grafana_enabled
when: grafana_enabled
- name: Ensure matrix-prometheus-nginxlog-exporter.service installed
ansible.builtin.template:

2
roles/custom/matrix-prometheus-nginxlog-exporter/tasks/setup_uninstall.yml
View file

@ -35,5 +35,5 @@
- name: Ensure matrix-prometheus-nginxlog-exporter grafana dashboard doesn't exist
ansible.builtin.file:
path: "{{ matrix_grafana_config_path }}/dashboards/nginx-proxy.json"
path: "{{ grafana_config_path }}/dashboards/nginx-proxy.json"
state: absent

3
roles/custom/matrix_playbook_migration/defaults/main.yml
View file

@ -8,3 +8,6 @@ matrix_playbook_migration_matrix_prometheus_postgres_exporter_migration_validati
# Controls if (`matrix_backup_borg` -> `backup_borg`) validation will run.
matrix_playbook_migration_matrix_backup_borg_migration_validation_enabled: true
# Controls if (`matrix_grafana` -> `grafana`) validation will run.
matrix_playbook_migration_matrix_grafana_migration_validation_enabled: true

15
roles/custom/matrix_playbook_migration/tasks/validate_config.yml
View file

@ -95,3 +95,18 @@
Please change your configuration (vars.yml) to rename all variables (`matrix_backup_borg_` -> `backup_borg_`).
We found usage of the following variables: {{ matrix_playbook_migration_backup_borg_migration_vars.keys() | join(', ') }}
when: "matrix_playbook_migration_backup_borg_migration_vars | length > 0"
- when: matrix_playbook_migration_matrix_grafana_migration_validation_enabled | bool
block:
- ansible.builtin.set_fact:
matrix_playbook_migration_grafana_migration_vars: |-
{{ vars | dict2items | selectattr('key', 'match', 'matrix_grafana_.*') | list | items2dict }}
- name: (Deprecation) Catch and report matrix_grafana variables
ansible.builtin.fail:
msg: >-
The matrix-grafana role that used to be part of this playbook has been replaced by https://gitlab.com/etke.cc/roles/grafana.
The new role is compatible with the old one, but uses different names for its variables.
Please change your configuration (vars.yml) to rename all variables (`matrix_grafana_` -> `grafana_`).
We found usage of the following variables: {{ matrix_playbook_migration_grafana_migration_vars.keys() | join(', ') }}
when: "matrix_playbook_migration_grafana_migration_vars | length > 0"