homelab-nomad/core/grafana.tf

resource "nomad_job" "grafana" {
  jobspec = templatefile("${path.module}/grafana.nomad", {
    module_path = path.module
    use_wesher  = var.use_wesher
  })

  depends_on = [nomad_job.prometheus]
}

resource "nomad_acl_policy" "grafana_smtp_secrets" {
  name        = "grafana-secrets-smtp"
  description = "Give access to MySQL secrets"
  rules_hcl   = <<EOH
namespace "default" {
  variables {
    path "secrets/smtp" {
      capabilities = ["read"]
    }
  }
}
EOH

  job_acl {
    job_id = "grafana"
    group  = "grafana"
    task   = "grafana"
  }
}

# Generate secrets and policies for access to MySQL
resource "nomad_acl_policy" "grafana_mysql_bootstrap_secrets" {
  name        = "grafana-secrets-mysql"
  description = "Give access to MySQL secrets"
  rules_hcl   = <<EOH
namespace "default" {
  variables {
    path "secrets/mysql" {
      capabilities = ["read"]
    }
  }
}
EOH

  job_acl {
    job_id = "grafana"
    group  = "grafana"
    task   = "mysql-bootstrap"
  }
}

resource "random_password" "grafana_mysql_psk" {
  length           = 32
  override_special = "!@#%&*-_="
}

resource "nomad_variable" "grafana_mysql_psk" {
  path = "secrets/mysql/allowed_psks/grafana"
  items = {
    psk = "grafana:${resource.random_password.grafana_mysql_psk.result}"
  }
}

resource "nomad_acl_policy" "grafana_mysql_psk" {
  name        = "grafana-secrets-mysql-psk"
  description = "Give access to MySQL PSK secrets"
  rules_hcl   = <<EOH
namespace "default" {
  variables {
    path "secrets/mysql/allowed_psks/grafana" {
      capabilities = ["read"]
    }
  }
}
EOH

  job_acl {
    job_id = "grafana"
    group  = "grafana"
    task   = "stunnel"
  }
}

module "grafana_oidc" {
  source = "./oidc_client"

  name = "grafana"
  oidc_client_config = {
    description = "Grafana"
    scopes = [
      "openid",
      "groups",
      "email",
      "profile",
    ]
    redirect_uris = [
      "https://grafana.thefij.rocks/login/generic_oauth",
    ]
  }

  job_acl = {
    job_id = "grafana"
    group  = "grafana"
    task   = "grafana"
  }
}

# resource "nomad_variable" "grafana_config" {
#   for_each = fileset("${path.module}/grafana", "**")
#
#   path = "nomad/jobs/grafana/${replace(each.key, ".", "_")}"
#   items = {
#     path = "${each.key}"
#     value = file("${path.module}/grafana/${each.key}")
#     left_delimiter = endswith(each.key, ".json") ? "<<<<" : "{{"
#     right_delimiter = endswith(each.key, ".json") ? ">>>>" : "}}"
#   }
# }