Ori.livneh has uploaded a new change for review. https://gerrit.wikimedia.org/r/245504
Change subject: Provision Grafana 2 on grafana-test.wikimedia.org ...................................................................... Provision Grafana 2 on grafana-test.wikimedia.org Provision Grafana 2 on krypton. Grafana 2 is configured to run behind Apache, which is using mod_proxy to proxy requests, and mod_authnz_ldap to authenticate users, as usual. Apache on Krypton is behind misc-varnish in eqiad. krypton is currently hosting grafana.wikimedia.org, which is based on grafana 1.x. Grafana 1.x can conexist with Grafana 2.x on the same host without conflict. Migrating from Grafana 1 to 2.x is easiest to do when both versions are online. Once the migration is complete, we can remove Grafana 1 from krypton, promote grafana-test.wm.o to grafana.wm.o, and get rid of the -test vhost and DNS entry. * Ife115e0c902: VCL: misc varnish: proxy grafana-testing.wm.o to krypton as well * Id44f150f89f: DNS: Add grafana-test.wikimedia.org, behind misc-web-lb * I77d483d3113: APT: reprepro: import from grafana apt Change-Id: Idd37460aa82ddfc206921576280fe972cb257317 --- A manifests/role/grafana2.pp A modules/grafana2/manifests/init.pp A templates/apache/sites/grafana-test.wikimedia.org.erb 3 files changed, 153 insertions(+), 0 deletions(-) git pull ssh://gerrit.wikimedia.org:29418/operations/puppet refs/changes/04/245504/1 diff --git a/manifests/role/grafana2.pp b/manifests/role/grafana2.pp new file mode 100644 index 0000000..f81a452 --- /dev/null +++ b/manifests/role/grafana2.pp @@ -0,0 +1,87 @@ +# == Class: role::grafana2 +# +# grafana2 is a dashboarding webapp for Graphite. +# It powers <https://grafana2-test.wikimedia.org>. +# +class role::grafana2 { + include ::apache::mod::authnz_ldap + include ::apache::mod::headers + include ::apache::mod::proxy + include ::apache::mod::proxy_http + include ::apache::mod::rewrite + + include ::passwords::grafana + include ::passwords::ldap::production + + class { '::grafana2': + config => { + # Configuration settings for /etc/grafana/grafana.ini. + # See <http://docs.grafana.org/installation/configuration/>. + + # Only listen on loopback, because we'll have a local Apache + # instance acting as a reverse-proxy. + 'server' => { + http_addr => '127.0.0.1', + domain => 'grafana-test.wikimedia.org', + protocol => 'http', + }, + + # Grafana needs a database to store users and dashboards. + # sqlite3 is the default, and it's perfectly adequate. + 'database' => { + type => 'sqlite3', + path => 'grafana.db', + }, + + 'security' => { + secret_key => $passwords::grafana::secret_key, + admin_password => $passwords::grafana::admin_password, + }, + + # Automatically create an account for users and authenticate + # them based on the REMOTE_USER env var set by mod_authnz_ldap. + 'auth.proxy' => { + enabled => true, + header_name => 'REMOTE_USER', + auto_sign_up => true, + }, + + # Because we enable `auth.proxy` (see above), if session data + # is lost, Grafana will simply create a new session on the next + # request, so it's OK for session storage to be volatile. + 'session' => { + provider => 'memory', + }, + + # Don't send anonymous usage stats to stats.grafana.org. + # We don't like it when software phones home. + 'analytics' => { + reporting_enabled => false, + }, + }, + } + + # LDAP configuration. Interpolated into the Apache site template + # to provide mod_authnz_ldap-based user authentication. + $auth_ldap = { + name => 'nda/ops/wmf', + bind_dn => 'cn=proxyagent,ou=profile,dc=wikimedia,dc=org', + bind_password => $passwords::ldap::production::proxypass, + url => 'ldaps://ldap-eqiad.wikimedia.org ldap-codfw.wikimedia.org/ou=people,dc=wikimedia,dc=org?cn', + groups => [ + 'cn=ops,ou=groups,dc=wikimedia,dc=org', + 'cn=nda,ou=groups,dc=wikimedia,dc=org', + 'cn=wmf,ou=groups,dc=wikimedia,dc=org', + ], + } + + apache::site { 'grafana-test.wikimedia.org': + content => template('apache/sites/grafana-test.wikimedia.org.erb'), + require => Class['::grafana'], + } + + monitoring::service { 'grafana-test': + description => 'grafana-test.wikimedia.org', + check_command => 'check_http_url!grafana-test.wikimedia.org!/', + } +} diff --git a/modules/grafana2/manifests/init.pp b/modules/grafana2/manifests/init.pp new file mode 100644 index 0000000..bc2b568 --- /dev/null +++ b/modules/grafana2/manifests/init.pp @@ -0,0 +1,38 @@ +# == Class: grafana2 +# +# Grafana is an open-source, feature-rich dashboard and graph editor +# for Graphite and InfluxDB. See <http://grafana.org/> for details. +# +# === Parameters +# +# [*config*] +# A hash of Grafana configuration options. +# For a list of available configuration options and their purpose, +# see <http://docs.grafana.org/installation/configuration/>. +# +# === Examples +# +# class { '::grafana2': +# config => { +# server => { +# http_addr => '127.0.0.1', +# domain => 'grafana.wikimedia.org', +# }, +# }, +# } +# +class grafana2( $config ) { + require_package('grafana') + + file { '/etc/grafana/grafana.ini': + content => php_ini($config), + owner => 'root', + group => 'root', + mode => '0444', + } + + base::service_unit { 'grafana-server': + systemd => true, + subscribe => File['/etc/grafana/grafana.ini'], + } +} diff --git a/templates/apache/sites/grafana-test.wikimedia.org.erb b/templates/apache/sites/grafana-test.wikimedia.org.erb new file mode 100644 index 0000000..9c0e58e --- /dev/null +++ b/templates/apache/sites/grafana-test.wikimedia.org.erb @@ -0,0 +1,28 @@ +# Apache configuration for Grafana 2. +# This file is managed by Puppet. +<VirtualHost *:80> + ServerName grafana-test.wikimedia.org + DocumentRoot /usr/share/grafana/public + + ProxyPreserveHost On + ProxyPass / http://localhost:3000/ + ProxyPassReverse / http://localhost:3000/ + + RewriteEngine On + RewriteCond %{HTTP:X-Forwarded-Proto} !https + RewriteRule ^/(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,E=ProtoRedirect] + Header always merge Vary X-Forwarded-Proto env=ProtoRedirect + Header always set Strict-Transport-Security "max-age=31536000" + + <Proxy *> + AuthName "<%= @auth_ldap['name'] %>" + AuthType Basic + AuthBasicProvider ldap + AuthLDAPBindDN <%= @auth_ldap['bind_dn'] %> + AuthLDAPBindPassword <%= @auth_ldap['bind_password'] %> + AuthLDAPURL "<%= @auth_ldap['url'] %>" + <% @auth_ldap['groups'].each do |group| -%> + Require ldap-group <%= group %> + <% end -%> + </Proxy> +</VirtualHost> -- To view, visit https://gerrit.wikimedia.org/r/245504 To unsubscribe, visit https://gerrit.wikimedia.org/r/settings Gerrit-MessageType: newchange Gerrit-Change-Id: Idd37460aa82ddfc206921576280fe972cb257317 Gerrit-PatchSet: 1 Gerrit-Project: operations/puppet Gerrit-Branch: production Gerrit-Owner: Ori.livneh <[email protected]> _______________________________________________ MediaWiki-commits mailing list [email protected] https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
