From 7fd36b33bff887b194b3303227717c91a69cc54d Mon Sep 17 00:00:00 2001 From: Jan Koppe Date: Wed, 31 Jan 2024 17:10:16 +0100 Subject: [PATCH] grafana: switch to chaoswest.tv --- modules/swarm/grafana/cfg/grafana.ini | 18 +++++++++--------- modules/swarm/grafana/main.tf | 27 ++++++++++++++++++--------- stacks/ax41-1/secrets.enc.yaml | 7 +++---- 3 files changed, 30 insertions(+), 22 deletions(-) diff --git a/modules/swarm/grafana/cfg/grafana.ini b/modules/swarm/grafana/cfg/grafana.ini index 5146bde..9d54902 100644 --- a/modules/swarm/grafana/cfg/grafana.ini +++ b/modules/swarm/grafana/cfg/grafana.ini @@ -38,7 +38,7 @@ http_addr = 0.0.0.0 http_port = 3000 # The public facing domain name used to access grafana from a browser -domain = "grafana.montage2.de" +domain = "grafana.chaoswest.tv" # Redirect to correct domain if host header does not match domain # Prevents DNS rebinding attacks @@ -47,7 +47,7 @@ domain = "grafana.montage2.de" # The full public facing url you use in browser, used for redirects and emails # If you use reverse proxy and sub path specify full url (with sub path) ;root_url = %(protocol)s://%(domain)s:%(http_port)s/ -root_url = "https://grafana.montage2.de/" +root_url = "https://grafana.chaoswest.tv/" # Serve Grafana from subpath specified in `root_url` setting. By default it is set to `false` for compatibility reasons. ;serve_from_sub_path = false @@ -307,7 +307,7 @@ verify_email_enabled = false enabled = true # specify organization name that should be used for unauthenticated users -org_name = Montage2 +org_name = CWTV # specify role for unauthenticated users org_role = Viewer @@ -328,14 +328,14 @@ org_role = Viewer #################################### GitLab Auth ######################### [auth.gitlab] -enabled = true -allow_sign_up = true +;enabled = true +;allow_sign_up = true ;client_id = some_id ;client_secret = some_secret -scopes = read_user -auth_url = https://gitlab.montage2.de/oauth/authorize -token_url = https://gitlab.montage2.de/oauth/token -api_url = https://gitlab.montage2.de/api/v4 +;scopes = read_user +;auth_url = https://gitlab.montage2.de/oauth/authorize +;token_url = https://gitlab.montage2.de/oauth/token +;api_url = https://gitlab.montage2.de/api/v4 ;allowed_domains = ;allowed_groups = diff --git a/modules/swarm/grafana/main.tf b/modules/swarm/grafana/main.tf index 80470d8..a516bc5 100644 --- a/modules/swarm/grafana/main.tf +++ b/modules/swarm/grafana/main.tf @@ -8,15 +8,12 @@ data "docker_network" "traefik" { locals { labels = { - "shepherd.auto-update" = "true", - "traefik.enable" = "true" - "traefik.http.services.grafana.loadbalancer.server.port" = "3000", - "traefik.http.routers.grafana.rule" = "Host(`grafana.montage2.de`)||Host(`grafana.chaoswest.tv`)", - "traefik.http.routers.grafana.tls" = "true", - "traefik.http.routers.grafana.tls.certresolver" = "default", - "traefik.http.routers.grafana.middlewares" = "grafana-redirect", - "traefik.http.middlewares.grafana-redirect.redirectregex.regex" = "^https://grafana.chaoswest.tv/(.*)", - "traefik.http.middlewares.grafana-redirect.redirectregex.replacement" = "https://grafana.montage2.de/$$${1}", # double escaping is necessary here + "shepherd.auto-update" = "true", + "traefik.enable" = "true" + "traefik.http.services.grafana.loadbalancer.server.port" = "3000", + "traefik.http.routers.grafana.rule" = "Host(`grafana.chaoswest.tv`)", + "traefik.http.routers.grafana.tls" = "true", + "traefik.http.routers.grafana.tls.certresolver" = "default", } } @@ -72,3 +69,15 @@ resource "docker_service" "grafana" { } } } + + +data "hetznerdns_zone" "primary" { + name = "chaoswest.tv" +} + +resource "hetznerdns_record" "primary" { + zone_id = data.hetznerdns_zone.primary.id + name = "grafana" + value = "ax41-1.fsn.mon2.de." + type = "CNAME" +} diff --git a/stacks/ax41-1/secrets.enc.yaml b/stacks/ax41-1/secrets.enc.yaml index c8b8bc5..6ce81e2 100644 --- a/stacks/ax41-1/secrets.enc.yaml +++ b/stacks/ax41-1/secrets.enc.yaml @@ -2,8 +2,7 @@ hetzner_dns_api_token: ENC[AES256_GCM,data:6m0svnZBgwLeMu12tSz1oUHHaA69dU/dHi7oW swarm: grafana: gf_security_secret_key: ENC[AES256_GCM,data:o6iR/KCnM1Ru56i0ANylmZFqiERuNfwx8sHeM4wE/k7aHI8l0Lg2oifrTx38m5puCBw79U4qqFQqe9QJjZMROhRblBK/RWi+3vSv+rwYv2W8wcvMeqcjJgZV0erOMyFkuZpapbfTnbDvidWg4kKbS0k2OmdRHVYc89IETU7hdow=,iv:B5EC8gwEK0g8T2I/EgoLFGCzR0Uhtaot01xeoWU0mp0=,tag:vlYNnn+fI5m6Dw+IpTPfuw==,type:str] - gf_auth_gitlab_client_id: ENC[AES256_GCM,data:xZfnyduTnDVpenAMqqcETqQiaphfVdKXJ7lsloynL1ka1V6FTz5i85MK8mgrRPY4zLiPCgmp8gzFiV2PDxDLOQ==,iv:egOxWveuFg9hyQAhO9V5ILwNSjmm4QLSYZQhknZPjvU=,tag:GRLP3QERCZ0hhJ9GpSmWxg==,type:str] - gf_auth_gitlab_client_secret: ENC[AES256_GCM,data:SgNbtzg8o0U2NJi2CN3Dmlox7F3v7boURNBZytxuOgnFi6N30xSUW0gHT1UivSEz9V+lo1km4tMI2+HqrukzPQ==,iv:Qbo/T5Er+8oY6rYfbPNHRKFuWLpAnRMAlQQ0Fp/FEKg=,tag:sUNsXhywIkt3Vcq+rIABoA==,type:str] + gf_security_admin_password: ENC[AES256_GCM,data:BJbUVen8wlU2QxJ99dD0ZrmHMKoC3En4qKkv6JFzqXxZm10elP1EtY6dscnVAaGWOPOv3O+OZ1+bJ24jVvXjVg==,iv:6g+KWKFv14ZAifRqWG01GfCyGhLa0f3hk896rsFR6to=,tag:WVDDaeloZycEERhzuSYwag==,type:str] gf_auth_generic_oauth_client_id: ENC[AES256_GCM,data:XLp880bI5ANkbk1t49839gs8EwI1LlfZwJgtlVPd21jmhXkpRSuKLw==,iv:u+wkKImGyNo0t7nXg7MdbRBBDEC08tWfE1sMo5fbIcY=,tag:CXl/6P9U6kANNFrmDlLvnA==,type:str] gf_auth_generic_oauth_client_secret: ENC[AES256_GCM,data:AHWpqQbHVyL6rliQeOsf+hVEwDI0mFOuOtllz3Aqfm/FWQTai4sgdQ9F+AkuiqCsKtdvOyCYdsBNv6BolR1Ef8vNBECKpkt1N97hPvlEuStBzbt0Hcu9uHxo0h1+L10SaM7VzUfVcYJ2gNY/HdU01C7av1NUHsYBMlIb8vE+Eww=,iv:ax6nnqrvYrxa5m08Hby6hCkawJZoJYBVA4JiPur10AU=,tag:ilSrpwsp3GC/AT9CgrfsGw==,type:str] jitsi: @@ -32,8 +31,8 @@ sops: WmlRUnowa2lMNWpDT0xEU0htV0w3U00K1f/SO/FBvC9lIBzveBEwhopj5ryMVCmD jw8AdxvmMwsCSfIROKkzMqiUs2zsj6FOMlYFI1Rb07mItSO2Yd7TsA== -----END AGE ENCRYPTED FILE----- - lastmodified: "2024-01-30T17:00:41Z" - mac: ENC[AES256_GCM,data:GvVUAo5Qtp0Dcnffh42jGkpT3khDRYXf6ws6Q3n2dWk+q39+xDQ3oxCGKMsYwbxrQ5s1oSI7dENSfxQA1Rwk3+Z0wmrRry9fxlYEnDeYLiR2Jxp0+7zDWUcusfSnjC/ASmwCYSFBcQM4jhD4uyVmhluS0E5KrjOD223Z6vtjxck=,iv:5OFMGJatztWTUR2Xb49CYl0Z42UsieYPTR6YoBn9UmM=,tag:yibooLYgoAN+IeiHVyexKg==,type:str] + lastmodified: "2024-01-31T16:00:34Z" + mac: ENC[AES256_GCM,data:XJsH39oi1N0JRwoIP6mvdQfSsBtaxn4N6KZYIHhTXR6Yz2/U2HpGyYoKl7vl2HJBPdjECeje4R1lS4w/I0G++qMpsZHdQglVrSjkpq2P1yZVYFRjN1Xyfjzi58O3WegNLftQpXdlx0T9FCNDLdD6+8BSownLxWWUlp0bpwOIWBc=,iv:f8TSh+aBUuFbLHD/kbA2qkqsZI5oGvlyQt2sO4TRQxk=,tag:DVS91MmrQa8I1Hbz07Ff8Q==,type:str] pgp: [] unencrypted_suffix: _unencrypted version: 3.8.1