Ori.livneh has uploaded a new change for review.
https://gerrit.wikimedia.org/r/247925
Change subject: grafana: automate the creation of the Anonymous user
......................................................................
grafana: automate the creation of the Anonymous user
Add a simple Python exec that creates the Anonymous user by directly inserting
it into Grafana's sqlite database. Add an explanatory comment to go with it.
Change-Id: Ifdefd64ec517bea02fd7c22efa21ff6cdf345650
---
A files/grafana/grafana_create_anon_user
M manifests/role/grafana.pp
2 files changed, 87 insertions(+), 0 deletions(-)
git pull ssh://gerrit.wikimedia.org:29418/operations/puppet
refs/changes/25/247925/1
diff --git a/files/grafana/grafana_create_anon_user
b/files/grafana/grafana_create_anon_user
new file mode 100755
index 0000000..997fc6e
--- /dev/null
+++ b/files/grafana/grafana_create_anon_user
@@ -0,0 +1,53 @@
+#!/usr/bin/env python
+# -*- coding: utf8 -*-
+"""
+ Create an anonymous user in Grafana
+
+ This script will check if a user named 'Anonymous' exists in Grafana.
+ If the user does not exist, this script will create it.
+
+"""
+from __future__ import print_function
+
+import sys
+
+from sqlalchemy import create_engine
+from sqlalchemy.ext.automap import automap_base
+from sqlalchemy.orm import Session
+from sqlalchemy.sql import exists, func
+
+
+if len(sys.argv) != 2 or sys.argv[1] not in ('--check', '--create'):
+ print('Usage: %s [--check / --create]' % __file__, file=sys.stderr)
+ sys.exit(1)
+
+engine = create_engine('sqlite:////home/ori/grafana.db')
+Base = automap_base()
+Base.prepare(engine, reflect=True)
+User = Base.classes.user
+session = Session(engine)
+
+anon_exists = session.query(exists().where(User.name == 'Anonymous')).scalar()
+
+if sys.argv[1] == '--check':
+ sys.exit(0 if anon_exists else 1)
+
+if anon_exists:
+ print('Nothing to do -- user already exists.', file=sys.stderr)
+ sys.exit(0)
+
+print('Creating anonymous user... ', end='', file=sys.stderr)
+session.add(User(
+ version=0,
+ login='Anonymous',
+ email='[email protected]',
+ name='Anonymous',
+ org_id=1,
+ is_admin=0,
+ email_verified=0,
+ created=func.now(),
+ updated=func.now(),
+))
+session.commit()
+print('done!', file=sys.stderr)
+sys.exit(0)
diff --git a/manifests/role/grafana.pp b/manifests/role/grafana.pp
index fb5c041..b9e7bcf 100644
--- a/manifests/role/grafana.pp
+++ b/manifests/role/grafana.pp
@@ -113,6 +113,40 @@
notify => Service['grafana-server'],
}
+
+ # We disable account creation, because accounts are created
+ # automagically based on the X-WEBAUTH-USER, which is either set
+ # to the LDAP user (if accessing the site via the grafana-admin vhost)
+ # or 'Anonymous'. But we need to have an 'Anonymous' user in the first
+ # place. To accomplish that, we use a small Python script that directly
+ # directly inserts the user into Grafana's sqlite database.
+ #
+ # If you are reading this comment because something broke and you are
+ # trying to figure out why, it is probably because Grafana's database
+ # schema changed. You can nuke this script and achieve the same result
+ # by temporarily commenting out the allow_signups line in
+ # /etc/grafana/grafana.ini and removing the restriction on POST and
+ # PUT in /etc/apache2/sites-enabled/50-grafana.wikimedia.org.conf,
+ # and then creating the user manually via the web interface.
+
+ require_package('python-sqlalchemy')
+
+ file { '/usr/local/sbin/grafana_create_anon_user':
+ source => 'puppet:///files/grafana/grafana_create_anon_user',
+ owner => 'root',
+ group => 'root',
+ mode => '0555',
+ require => [
+ Service['grafana-server'],
+ Package['python-sqlalchemy'],
+ ],
+ }
+
+ exec { '/usr/local/sbin/grafana_create_anon_user --create':
+ unless => '/usr/local/sbin/grafana_create_anon_user --check',
+ require => File['/usr/local/sbin/grafana_create_anon_user'],
+ }
+
# Serve Grafana via two different vhosts:
#
# - grafana.wikimedia.org (read-only, but accessible to all)
--
To view, visit https://gerrit.wikimedia.org/r/247925
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: Ifdefd64ec517bea02fd7c22efa21ff6cdf345650
Gerrit-PatchSet: 1
Gerrit-Project: operations/puppet
Gerrit-Branch: production
Gerrit-Owner: Ori.livneh <[email protected]>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
