feat: add external grafana access (#366)

- enable access to grafana through haproxy
- ensure grafana cert created from letsencrypt
- enable user access to grafana

Reviewed-on: #366

hieradata/country/au/region/syd1/infra/halb/haproxy2.yaml

@@ -9,6 +9,7 @@ profiles::haproxy::dns::vrrp_cnames:
   - nzbget.main.unkin.net
   - git.unkin.net
   - fafflix.unkin.net
+  - grafana.unkin.net
 
 profiles::haproxy::mappings:
   fe_http:
@@ -25,6 +26,7 @@ profiles::haproxy::mappings:
       - 'jellyfin.main.unkin.net be_jellyfin'
       - 'fafflix.unkin.net be_jellyfin'
       - 'git.unkin.net be_gitea'
+      - 'grafana.unkin.net be_grafana'
   fe_https:
     ensure: present
     mappings:
@@ -39,6 +41,7 @@ profiles::haproxy::mappings:
       - 'jellyfin.main.unkin.net be_jellyfin'
       - 'fafflix.unkin.net be_jellyfin'
       - 'git.unkin.net be_gitea'
+      - 'grafana.unkin.net be_grafana'
 
 profiles::haproxy::frontends:
   fe_http:
@@ -58,6 +61,7 @@ profiles::haproxy::frontends:
         - 'acl_jellyfin req.hdr(host) -i jellyfin.main.unkin.net'
         - 'acl_fafflix req.hdr(host) -i fafflix.unkin.net'
         - 'acl_gitea req.hdr(host) -i git.unkin.net'
+        - 'acl_grafana req.hdr(host) -i grafana.unkin.net'
         - 'acl_internalsubnets src 198.18.0.0/16 10.10.12.0/24'
       use_backend:
         - "%[req.hdr(host),lower,map(/etc/haproxy/fe_https.map,be_default)]"
@@ -74,6 +78,7 @@ profiles::haproxy::frontends:
         - 'set-header X-Frame-Options DENY if acl_jellyfin'
         - 'set-header X-Frame-Options DENY if acl_fafflix'
         - 'set-header X-Frame-Options DENY if acl_gitea'
+        - 'set-header X-Frame-Options DENY if acl_grafana'
         - 'set-header X-Content-Type-Options nosniff'
         - 'set-header X-XSS-Protection 1;mode=block'
 
@@ -239,6 +244,24 @@ profiles::haproxy::backends:
       redirect: 'scheme https if !{ ssl_fc }'
       stick-table: 'type ip size 200k expire 30m'
       stick: 'on src'
+  be_grafana:
+    description: Backend for grafana nodes
+    collect_exported: false # handled in custom function
+    options:
+      balance: roundrobin
+      option:
+        - httpchk GET /
+        - forwardfor
+        - http-keep-alive
+        - prefer-last-server
+      cookie: SRVNAME insert indirect nocache
+      http-reuse: always
+      http-request:
+        - set-header X-Forwarded-Port %[dst_port]
+        - add-header X-Forwarded-Proto https if { dst_port 443 }
+      redirect: 'scheme https if !{ ssl_fc }'
+      stick-table: 'type ip size 200k expire 30m'
+      stick: 'on src'
 
 profiles::haproxy::certlist::enabled: true
 profiles::haproxy::certlist::certificates:
@@ -252,6 +275,7 @@ profiles::haproxy::certlist::certificates:
   - /etc/pki/tls/letsencrypt/nzbget.main.unkin.net/fullchain_combined.pem
   - /etc/pki/tls/letsencrypt/fafflix.unkin.net/fullchain_combined.pem
   - /etc/pki/tls/letsencrypt/git.unkin.net/fullchain_combined.pem
+  - /etc/pki/tls/letsencrypt/grafana.unkin.net/fullchain_combined.pem
   - /etc/pki/tls/vault/certificate.pem
 
 # additional altnames
@@ -278,3 +302,4 @@ certbot::client::domains:
   - nzbget.main.unkin.net
   - fafflix.unkin.net
   - git.unkin.net
+  - grafana.unkin.net