feat: add external grafana access (#366)

- enable access to grafana through haproxy
- ensure grafana cert created from letsencrypt
- enable user access to grafana

Reviewed-on: #366

hieradata/roles/infra/auth/glauth.yaml

@@ -104,6 +104,7 @@ glauth::users:
       - 20013 # lidarr
       - 20014 # readarr
       - 20016 # nzbget
+      - 20027 # grafana user
     loginshell: '/bin/bash'
     homedir: '/home/seablo'
     passsha256: '2db12484b2b5fdae7f3a1f9f870143c363af14bf2c31a415a9a7afcb02520df2'
@@ -121,6 +122,7 @@ glauth::users:
       - 20013 # lidarr
       - 20014 # readarr
       - 20016 # nzbget
+      - 20027 # grafana user
     loginshell: '/bin/bash'
     homedir: '/home/marbal'
     passsha256: 'cc20cee6269b9970a76549c66b51d0c543352796180d4122260a47f0f7a442a9'
@@ -138,6 +140,7 @@ glauth::users:
       - 20013 # lidarr
       - 20014 # readarr
       - 20016 # nzbget
+      - 20027 # grafana user
     loginshell: '/bin/bash'
     homedir: '/home/kelren'
     passsha256: '5b01659bca1ecb27847d2f746fab03eb169879ebcc86547024753dac7cb184c4'
@@ -155,6 +158,7 @@ glauth::users:
       - 20013 # lidarr
       - 20014 # readarr
       - 20016 # nzbget
+      - 20027 # grafana user
     loginshell: '/bin/bash'
     homedir: '/home/ryadun'
     passsha256: 'ee17174d49545f6f7257ae79eb173de4acf2b2edf55e181de90decd0e4b4e617'
@@ -172,6 +176,7 @@ glauth::users:
       - 20013 # lidarr
       - 20014 # readarr
       - 20016 # nzbget
+      - 20027 # grafana user
     loginshell: '/bin/bash'
     homedir: '/home/margol'
     passsha256: '31a66085fb7eaeb059e51d1376233db72b54f96a6c45947aafbb350c83e618ef'
@@ -190,6 +195,7 @@ glauth::users:
       - 20014 # readarr
       - 20016 # nzbget
       - 20026 # jupyterhub_user
+      - 20027 # grafana user
     loginshell: '/bin/bash'
     homedir: '/home/sudobo'
     passsha256: 'a326e049c2a615226877946220a978a0a8247c569be1adcd73539b09b14136d0'

hieradata/roles/infra/metrics/grafana.yaml

@@ -14,13 +14,13 @@ profiles::metrics::grafana::pgsql_backend: true
 
 # additional altnames
 profiles::pki::vault::alt_names:
-  - grafana.main.unkin.net
+  - grafana.unkin.net
   - grafana.service.consul
   - grafana.query.consul
   - "grafana.service.%{facts.country}-%{facts.region}.consul"
 
 profiles::ssh::sign::principals:
-  - grafana.main.unkin.net
+  - grafana.unkin.net
   - grafana.service.consul
   - grafana.query.consul
 
@@ -47,7 +47,7 @@ profiles::consul::client::node_rules:
 # manage a simple nginx reverse proxy
 profiles::nginx::simpleproxy::nginx_vhost: 'grafana.query.consul'
 profiles::nginx::simpleproxy::nginx_aliases:
-  - grafana.main.unkin.net
+  - grafana.unkin.net
   - grafana.service.consul
   - grafana.query.consul
   - "grafana.service.%{facts.country}-%{facts.region}.consul"

hieradata/roles/infra/pki/certbot.yaml

@@ -14,3 +14,4 @@ certbot::domains:
   - nzbget.main.unkin.net
   - fafflix.unkin.net
   - git.unkin.net
+  - grafana.unkin.net