Updates

.vscode/settings.json

@@ -0,0 +1,8 @@
+{
+    "ansible.python.interpreterPath": "/bin/python3.11",
+    "files.associations": {
+        "*.j2": "ansible-jinja",
+        "*.yaml": "ansible",
+        "*.yml": "ansible"
+    },
+}

README.md

@@ -3,12 +3,16 @@ Grafana
 
 [Grafana](https://grafana.com) ist eine Redering-Enging für Zeitreihen.
 
+# Variablen
+Die folgenden Variablen müssen vor der Ausführung der Rolle gesetzt werden:
+
+| Variable | Wert | Bedeutung |
+|----------|------|--------------|
+| `grafana_domain` | string | Domainname der Grafana-Instanz |
+| `grafana_db_password` | string | Passwort des Datenbanknutzers |
+
 # Ausführen der Rolle
-- In der jeweiligen `host_vars`-Datei die Variablen in einer `grafana`-Map setzen:
+- Erstelle ein Playbook namen `grafana.yml` und führe die Rolle aus:
-  | Variable | Wert | Beschreibung |
-  |----------|------|--------------|
-  | `domain` | string | Domainname der Grafana-Instanz |
-- Rolle ausführen:
   ```Shell
   ansible-playbook playbooks/grafana.yml
   ```

defaults/main.yml

@@ -1,4 +1,3 @@
 ---
 grafana_db: grafana
 grafana_db_user: grafana
-grafana_db_password: "{{ lookup('password', '/tmp/grafana_database_pwd length=42 chars=ascii_letters,digits') }}"

handlers/main.yml

@@ -1,7 +1,4 @@
 ---
-- name: get certificate
-  ansible.builtin.command: dehydrated --cron -g
-
 - name: restart grafana
   ansible.builtin.service:
     name: grafana-server
@@ -11,8 +8,3 @@
   ansible.builtin.service:
     name: monit
     state: reloaded
-
-- name: reload fail2ban
-  ansible.builtin.service:
-    name: fail2ban
-    state: reloaded

meta/main.yml

@@ -3,7 +3,7 @@ galaxy_info:
   description: Role to install Grafana
   company: Sense.Lab e.V.
   license: GPLv3
-  min_ansible_version: "2.9"
+  min_ansible_version: "2.14"
   platforms:
     - name: Debian
       versions:

tasks/database.yml

@@ -1,12 +1,12 @@
 ---
-- name: "database | Erstelle Datenbank"
+- name: "Database | Erstelle Datenbank"
-  ansible.builtin.mysql_db:
+  community.mysql.mysql_db:
     name: "{{ grafana_db }}"
     login_unix_socket: "{{ mysql_socket }}"
     login_user: root
 
-- name: "database | Erstelle Datenbank-Nutzer"
+- name: "Database | Erstelle Datenbank-Nutzer"
-  ansible.builtin.mysql_user:
+  community.mysql.mysql_user:
     name: "{{ grafana_db_user }}"
     password: "{{ grafana_db_password }}"
     priv: "{{ grafana_db }}.*:ALL"

tasks/grafana.yml

@@ -1,26 +1,19 @@
 ---
-- name: grafana | Aktivere und starte Service"
+- name: "Grafana | Aktivere und starte Service"
   ansible.builtin.systemd:
     name: grafana-server
     enabled: true
     state: started
     daemon_reload: true
 
-- name: "grafana | Erzeuge Grafana-Konfiguration"
+- name: "Grafana | Erzeuge Grafana-Konfiguration"
   ansible.builtin.template:
     src: grafana.ini
     dest: /etc/grafana/grafana.ini
-    mode: 0640
+    mode: "0640"
   notify: restart grafana
 
-- name: "grafana | Installiere Image Renderer Module"
+- name: "Grafana | Installiere Image Renderer Module"
   ansible.builtin.command:
     cmd: grafana-cli plugins install grafana-image-renderer
     creates: /var/lib/grafana/plugins/grafana-image-renderer
-
-- name: "grafana | Aktiviere Monit-Ueberwachung"
-  ansible.builtin.copy:
-    src: "grafana.monit"
-    dest: "/etc/monit/conf-enabled/grafana"
-    mode: 0644
-  notify: reload monit

tasks/main.yml

@@ -1,12 +1,16 @@
 ---
-- import_tasks: packages.yml
+- name: Packages
+  ansible.builtin.import_tasks: packages.yml
   tags: packages
 
-- import_tasks: database.yml
+- name: Database
+  ansible.builtin.import_tasks: database.yml
   delegate_to: "{{ database_host }}"
 
-- import_tasks: grafana.yml
+- name: Grafana
+  ansible.builtin.import_tasks: grafana.yml
   tags: grafana
 
-- import_tasks: webserver.yml
+- name: Webserver
+  ansible.builtin.import_tasks: webserver.yml
   tags: webserver

tasks/packages.yml

@@ -1,18 +1,18 @@
 ---
-- name: "packages | Fuege apt-key hinzu"
+- name: "Packages | Fuege apt-key hinzu"
   ansible.builtin.apt_key:
     url: https://packages.grafana.com/gpg.key
 
-- name: "packages | Fuege deb-Repository hinzu"
+- name: "Packages | Fuege deb-Repository hinzu"
   ansible.builtin.apt_repository:
     repo: deb https://packages.grafana.com/oss/deb stable main
     filename: grafana
 
-- name: "packages | Installiere Grafana"
+- name: "Packages | Installiere Grafana"
   ansible.builtin.apt:
     name: grafana
 
-- name: "packages | Installiere chromium"
+- name: "Packages | Installiere chromium"
   ansible.builtin.apt:
     name: chromium
     install_recommends: false

tasks/webserver.yml

@@ -1,12 +1,6 @@
 ---
-- name: "webserver | Erzeuge Letsencrypt-Zertifikat"
+- name: "Webserver | Aktiviere Apache-Modul"
-  ansible.builtin.lineinfile:
+  community.general.apache2_module:
-    path: /etc/dehydrated/domains.txt
-    line: "{{ grafana.domain }}"
-  notify: get certificate
-
-- name: "webserver | Aktiviere Apache-Modul"
-  ansible.builtin.apache2_module:
     name: "{{ item }}"
     state: present
   notify: restart apache2
@@ -14,14 +8,14 @@
     - proxy
     - proxy_http
 
-- name: "webserver | Kopiere Grafana-Seitenkonfiguration"
+- name: "Webserver | Kopiere Grafana-Seitenkonfiguration"
   ansible.builtin.template:
     src: apache2-site.conf
-    dest: "/etc/apache2/sites-available/{{ grafana.domain }}.conf"
+    dest: "/etc/apache2/sites-available/{{ grafana_domain }}.conf"
-    mode: 0644
+    mode: "0644"
 
-- name: "webserver | Aktiviere Grafana-Seitenkonfiguration"
+- name: "Webserver | Aktiviere Grafana-Seitenkonfiguration"
   ansible.builtin.command:
-    cmd: "a2ensite {{ grafana.domain }}"
+    cmd: "a2ensite {{ grafana_domain }}"
-    creates: "/etc/apache2/site-enabled/{{ grafana.domain }}.conf"
+    creates: "/etc/apache2/site-enabled/{{ grafana_domain }}.conf"
   notify: reload apache2

templates/apache2-site.conf

@@ -1,11 +1,11 @@
 <VirtualHost *:80>
-    ServerName {{ grafana.domain }}
+    ServerName {{ grafana_domain }}
-    Redirect permanent / https://{{ grafana.domain }}/
+    Redirect permanent / https://{{ grafana_domain }}/
 </VirtualHost>
 
 <IfModule mod_ssl.c>
     <VirtualHost *:443>
-        ServerName {{ grafana.domain }}
+        ServerName {{ grafana_domain }}
         Protocols h2 http/1.1
         DocumentRoot /var/www/html
         IncludeOptional /etc/apache2/conf-available/add-headers.conf
@@ -15,8 +15,8 @@
         LogLevel Error
 
         SSLEngine On
-        SSLCertificateFile /var/lib/dehydrated/certs/{{ grafana.domain }}/fullchain.pem
+        SSLCertificateFile /var/lib/dehydrated/certs/{{ grafana_domain }}/fullchain.pem
-        SSLCertificateKeyFile /var/lib/dehydrated/certs/{{ grafana.domain }}/privkey.pem
+        SSLCertificateKeyFile /var/lib/dehydrated/certs/{{ grafana_domain }}/privkey.pem
 
         ProxyPreserveHost On
         ProxyPass /.well-known !

templates/grafana.ini

@@ -2,13 +2,13 @@
 
 [server]
 protocoll = https
-domain = {{ grafana.domain }}
+domain = {{ grafana_domain }}
 enforce_domain = true
-root_url = https://{{ grafana.domain }}
+root_url = https://{{ grafana_domain }}
 
 [database]
 type = mysql
-host = 127.0.0.1:3306
+host = {{ database_host }}:3306
 name = {{ grafana_db }}
 user = {{ grafana_db_user }}
 password = {{ grafana_db_password }}
@@ -48,11 +48,10 @@ rendering_language = de-DE
 signout_redirect_url = {{ grafana_auth_signout_redirect_url }}
 oauth_auto_login = false
 
+{% if grafana_auth_generic_oauth_enabled is defined and grafana_auth_generic_oauth_enabled %}
 [auth.generic_oauth]
 name = {{ grafana_auth_generic_oauth_name }}
-{% if grafana_auth_generic_oauth_enabled is defined and grafana_auth_generic_oauth_enabled %}
 enabled = true
-{% endif %}
 client_id = {{ grafana_auth_generic_oauth_client_id }}
 client_secret = {{ grafana_auth_generic_oauth_client_secret }}
 scopes = openid email profile
@@ -60,3 +59,4 @@ auth_url = {{ grafana_auth_generic_oauth_auth_url }}
 token_url = {{ grafana_auth_generic_oauth_token_url }}
 api_url = {{ grafana_auth_generic_oauth_api_url }}
 role_attribute_path = {{ grafana_auth_generic_oauth_role_attribute_path }}
+{% endif %}