authelia and grafana to shared smtp secrets

This commit is contained in:
IamTheFij 2023-08-29 15:11:40 -07:00
parent edeb6cf444
commit 8dd00c1249
7 changed files with 58 additions and 13 deletions

View File

@ -3,11 +3,6 @@ nomad/jobs:
db_user_ro: VALUE db_user_ro: VALUE
ldap_base_dn: VALUE ldap_base_dn: VALUE
notify_email: VALUE notify_email: VALUE
smtp_password: VALUE
smtp_port: VALUE
smtp_server: VALUE
smtp_tls: VALUE
smtp_user: VALUE
nomad/jobs/authelia: nomad/jobs/authelia:
db_name: VALUE db_name: VALUE
db_pass: VALUE db_pass: VALUE

View File

@ -27,6 +27,7 @@ module "authelia" {
use_mysql = true use_mysql = true
use_ldap = true use_ldap = true
use_redis = true use_redis = true
use_smtp = true
mysql_bootstrap = { mysql_bootstrap = {
enabled = true enabled = true
} }
@ -96,7 +97,7 @@ module "authelia" {
mount = false mount = false
}, },
{ {
data = "{{ with nomadVar \"nomad/jobs\" }}{{ .smtp_password }}{{ end }}" data = "{{ with nomadVar \"secrets/smtp\" }}{{ .password }}{{ end }}"
dest_prefix = "$${NOMAD_SECRETS_DIR}" dest_prefix = "$${NOMAD_SECRETS_DIR}"
dest = "smtp_password.txt" dest = "smtp_password.txt"
mount = false mount = false

View File

@ -221,11 +221,11 @@ notifier:
## You can disable the notifier startup check by setting this to true. ## You can disable the notifier startup check by setting this to true.
disable_startup_check: false disable_startup_check: false
{{ with nomadVar "nomad/jobs" }} {{ with nomadVar "secrets/smtp" }}
smtp: smtp:
host: {{ .smtp_server }} host: {{ .server }}
port: {{ .smtp_port }} port: {{ .port }}
username: {{ .smtp_user }} username: {{ .user }}
# password: <in file> # password: <in file>
{{- end }} {{- end }}

View File

@ -155,10 +155,12 @@ SELECT 'NOOP';
template { template {
data = <<EOF data = <<EOF
{{ with nomadVar "secrets/smtp" -}}
GF_SMTP_USER={{ .user }}
GF_SMTP_PASSWORD={{ .password }}
{{ end -}}
{{ with nomadVar "nomad/jobs/grafana" -}} {{ with nomadVar "nomad/jobs/grafana" -}}
GF_SECURITY_ADMIN_PASSWORD={{ .admin_pw }} GF_SECURITY_ADMIN_PASSWORD={{ .admin_pw }}
GF_SMTP_USER={{ .smtp_user }}
GF_SMTP_PASSWORD={{ .smtp_password }}
GF_EXTERNAL_IMAGE_STORAGE_S3_ACCESS_KEY={{ .minio_access_key }} GF_EXTERNAL_IMAGE_STORAGE_S3_ACCESS_KEY={{ .minio_access_key }}
GF_EXTERNAL_IMAGE_STORAGE_S3_SECRET_KEY={{ .minio_secret_key }} GF_EXTERNAL_IMAGE_STORAGE_S3_SECRET_KEY={{ .minio_secret_key }}
GRAFANA_ALERT_EMAIL_ADDRESSES={{ .alert_email_addresses }} GRAFANA_ALERT_EMAIL_ADDRESSES={{ .alert_email_addresses }}
@ -170,7 +172,7 @@ GF_DATABASE_HOST=127.0.0.1:3306
GF_DATABASE_NAME={{ .db_name }} GF_DATABASE_NAME={{ .db_name }}
GF_DATABASE_USER={{ .db_user }} GF_DATABASE_USER={{ .db_user }}
GF_DATABASE_PASSWORD={{ .db_pass }} GF_DATABASE_PASSWORD={{ .db_pass }}
{{- end }} {{ end -}}
SLACK_BOT_URL={{ .slack_bot_url }} SLACK_BOT_URL={{ .slack_bot_url }}
SLACK_BOT_TOKEN={{ .slack_bot_token }} SLACK_BOT_TOKEN={{ .slack_bot_token }}
SLACK_HOOK_URL={{ .slack_hook_url }} SLACK_HOOK_URL={{ .slack_hook_url }}

View File

@ -19,6 +19,26 @@ resource "nomad_job" "grafana" {
depends_on = [nomad_job.prometheus] depends_on = [nomad_job.prometheus]
} }
resource "nomad_acl_policy" "grafana_smtp_secrets" {
name = "grafana-secrets-smtp"
description = "Give access to MySQL secrets"
rules_hcl = <<EOH
namespace "default" {
variables {
path "secrets/smtp" {
capabilities = ["read"]
}
}
}
EOH
job_acl {
job_id = "grafana"
group = "grafana"
task = "grafana"
}
}
# Generate secrets and policies for access to MySQL # Generate secrets and policies for access to MySQL
resource "nomad_acl_policy" "grafana_mysql_bootstrap_secrets" { resource "nomad_acl_policy" "grafana_mysql_bootstrap_secrets" {
name = "grafana-secrets-mysql" name = "grafana-secrets-mysql"

View File

@ -198,3 +198,25 @@ EOH
task = "stunnel" task = "stunnel"
} }
} }
resource "nomad_acl_policy" "secrets_smtp" {
count = var.use_smtp ? 1 : 0
name = "${var.name}-secrets-smtp"
description = "Give access to SMTP secrets"
rules_hcl = <<EOH
namespace "default" {
variables {
path "secrets/smtp" {
capabilities = ["read"]
}
}
}
EOH
job_acl {
job_id = var.name
group = var.name
task = var.name
}
}

View File

@ -192,6 +192,11 @@ variable "use_postgres" {
default = false default = false
} }
variable "use_smtp" {
type = bool
default = false
}
variable "mysql_bootstrap" { variable "mysql_bootstrap" {
type = object({ type = object({
enabled = optional(bool, true) enabled = optional(bool, true)