feat: add external grafana access (#366)

- enable access to grafana through haproxy
- ensure grafana cert created from letsencrypt
- enable user access to grafana

Reviewed-on: #366

hieradata/roles/infra/metrics/grafana.yaml

@@ -14,13 +14,13 @@ profiles::metrics::grafana::pgsql_backend: true
 
 # additional altnames
 profiles::pki::vault::alt_names:
-  - grafana.main.unkin.net
+  - grafana.unkin.net
   - grafana.service.consul
   - grafana.query.consul
   - "grafana.service.%{facts.country}-%{facts.region}.consul"
 
 profiles::ssh::sign::principals:
-  - grafana.main.unkin.net
+  - grafana.unkin.net
   - grafana.service.consul
   - grafana.query.consul
 
@@ -47,7 +47,7 @@ profiles::consul::client::node_rules:
 # manage a simple nginx reverse proxy
 profiles::nginx::simpleproxy::nginx_vhost: 'grafana.query.consul'
 profiles::nginx::simpleproxy::nginx_aliases:
-  - grafana.main.unkin.net
+  - grafana.unkin.net
   - grafana.service.consul
   - grafana.query.consul
   - "grafana.service.%{facts.country}-%{facts.region}.consul"