118 lines
2.4 KiB
HCL
118 lines
2.4 KiB
HCL
resource "nomad_job" "grafana" {
|
|
jobspec = templatefile("${path.module}/grafana.nomad", {
|
|
module_path = path.module
|
|
use_wesher = var.use_wesher
|
|
})
|
|
|
|
depends_on = [nomad_job.prometheus]
|
|
}
|
|
|
|
resource "nomad_acl_policy" "grafana_smtp_secrets" {
|
|
name = "grafana-secrets-smtp"
|
|
description = "Give access to MySQL secrets"
|
|
rules_hcl = <<EOH
|
|
namespace "default" {
|
|
variables {
|
|
path "secrets/smtp" {
|
|
capabilities = ["read"]
|
|
}
|
|
}
|
|
}
|
|
EOH
|
|
|
|
job_acl {
|
|
job_id = "grafana"
|
|
group = "grafana"
|
|
task = "grafana"
|
|
}
|
|
}
|
|
|
|
# Generate secrets and policies for access to MySQL
|
|
resource "nomad_acl_policy" "grafana_mysql_bootstrap_secrets" {
|
|
name = "grafana-secrets-mysql"
|
|
description = "Give access to MySQL secrets"
|
|
rules_hcl = <<EOH
|
|
namespace "default" {
|
|
variables {
|
|
path "secrets/mysql" {
|
|
capabilities = ["read"]
|
|
}
|
|
}
|
|
}
|
|
EOH
|
|
|
|
job_acl {
|
|
job_id = "grafana"
|
|
group = "grafana"
|
|
task = "mysql-bootstrap"
|
|
}
|
|
}
|
|
|
|
resource "random_password" "grafana_mysql_psk" {
|
|
length = 32
|
|
override_special = "!@#%&*-_="
|
|
}
|
|
|
|
resource "nomad_variable" "grafana_mysql_psk" {
|
|
path = "secrets/mysql/allowed_psks/grafana"
|
|
items = {
|
|
psk = "grafana:${resource.random_password.grafana_mysql_psk.result}"
|
|
}
|
|
}
|
|
|
|
resource "nomad_acl_policy" "grafana_mysql_psk" {
|
|
name = "grafana-secrets-mysql-psk"
|
|
description = "Give access to MySQL PSK secrets"
|
|
rules_hcl = <<EOH
|
|
namespace "default" {
|
|
variables {
|
|
path "secrets/mysql/allowed_psks/grafana" {
|
|
capabilities = ["read"]
|
|
}
|
|
}
|
|
}
|
|
EOH
|
|
|
|
job_acl {
|
|
job_id = "grafana"
|
|
group = "grafana"
|
|
task = "stunnel"
|
|
}
|
|
}
|
|
|
|
module "grafana_oidc" {
|
|
source = "./oidc_client"
|
|
|
|
name = "grafana"
|
|
oidc_client_config = {
|
|
description = "Grafana"
|
|
scopes = [
|
|
"openid",
|
|
"groups",
|
|
"email",
|
|
"profile",
|
|
]
|
|
redirect_uris = [
|
|
"https://grafana.thefij.rocks/login/generic_oauth",
|
|
]
|
|
}
|
|
|
|
job_acl = {
|
|
job_id = "grafana"
|
|
group = "grafana"
|
|
task = "grafana"
|
|
}
|
|
}
|
|
|
|
# resource "nomad_variable" "grafana_config" {
|
|
# for_each = fileset("${path.module}/grafana", "**")
|
|
#
|
|
# path = "nomad/jobs/grafana/${replace(each.key, ".", "_")}"
|
|
# items = {
|
|
# path = "${each.key}"
|
|
# value = file("${path.module}/grafana/${each.key}")
|
|
# left_delimiter = endswith(each.key, ".json") ? "<<<<" : "{{"
|
|
# right_delimiter = endswith(each.key, ".json") ? ">>>>" : "}}"
|
|
# }
|
|
# }
|