grafana & prometheus

13 files changed, 291 insertions, 2 deletions

diff --git a/ansible/prometheus/deploy-config.yml b/ansible/prometheus/deploy-config.yml
new file mode 100644
index 0000000..472d05c
--- /dev/null
+++ b/ansible/prometheus/deploy-config.yml
@@ -0,0 +1,19 @@
+- hosts:
+    - conflatorio
+  tasks:
+    - become: yes
+      file:
+        path: /etc/docker-service/prometheus
+        state: directory
+        owner: root
+        group: root
+
+    - become: yes
+      notify: reload prometheus
+      copy:
+        dest: /etc/docker-service/prometheus/prometheus.yml
+        src: "{{ inventory_hostname }}/prometheus.yml"
+
+  handlers:
+    - name: reload prometheus
+      shell: docker kill --signal HUP prometheus 
diff --git a/ansible/prometheus/files/conflatorio/prometheus.yml b/ansible/prometheus/files/conflatorio/prometheus.yml
new file mode 100644
index 0000000..9fc1316
--- /dev/null
+++ b/ansible/prometheus/files/conflatorio/prometheus.yml
@@ -0,0 +1,25 @@
+global:
+  scrape_interval:     15s
+  evaluation_interval: 15s
+
+rule_files:
+  # - "first.rules"
+  # - "second.rules"
+
+scrape_configs:
+  - job_name: prometheus
+    static_configs:
+      - targets: ['localhost:9090']
+
+  - job_name: node
+    static_configs:
+      - targets: 
+        - "knot.vpn.trygvis.io:9100"
+        - "hash.vpn.trygvis.io:9323"
+        - "conflatorio.vpn.trygvis.io:9100"
+
+  - job_name: bird
+    static_configs:
+      - targets:
+        - "knot.vpn.trygvis.io:9324"
+        - "conflatorio.vpn.trygvis.io:9324"
diff --git a/terraform/conflatorio-docker/main.tf b/terraform/conflatorio-docker/main.tf
index 5d52b4e..e7b11ad 100644
--- a/terraform/conflatorio-docker/main.tf
+++ b/terraform/conflatorio-docker/main.tf
@@ -26,6 +26,8 @@ locals {
   public_ip = "fdb1:4242:3538:2001::ffff"
   network_addr = "fdb1:4242:3538:2001:1001::"
   network_range = 112
+  private_network_addr = "fdb1:4242:3538:2001:1002::"
+  private_network_range = 112
 }
 
 output "foo" {
diff --git a/terraform/conflatorio-docker/network.tf b/terraform/conflatorio-docker/network.tf
index b548fef..8a839f5 100644
--- a/terraform/conflatorio-docker/network.tf
+++ b/terraform/conflatorio-docker/network.tf
@@ -6,4 +6,20 @@ resource "docker_network" "public" {
   ipam_config {
     subnet  = "${local.network_addr}/${local.network_range}"
   }
+
+  ipam_config {
+    gateway     = "172.22.0.1"
+    subnet      = "172.22.0.0/16"
+  }
+}
+
+# Internal shared network
+resource "docker_network" "private" {
+  name = "private"
+
+  ipv6 = true
+
+  ipam_config {
+    subnet  = "${local.private_network_addr}/${local.private_network_range}"
+  }
 }
diff --git a/terraform/conflatorio-docker/traefik.tf b/terraform/conflatorio-docker/traefik.tf
index 98f7e7e..cb5f2a0 100644
--- a/terraform/conflatorio-docker/traefik.tf
+++ b/terraform/conflatorio-docker/traefik.tf
@@ -12,6 +12,8 @@ resource "docker_container" "traefik" {
   privileged = false
   must_run   = false
 
+  network_mode = "bridge"
+
   networks_advanced {
     name = docker_network.traefik.name
   }
diff --git a/terraform/conflatorio-prometheus/.terraform.lock.hcl b/terraform/conflatorio-prometheus/.terraform.lock.hcl
new file mode 100644
index 0000000..9e1ccff
--- /dev/null
+++ b/terraform/conflatorio-prometheus/.terraform.lock.hcl
@@ -0,0 +1,104 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/cyrilgdn/postgresql" {
+  version     = "1.21.0"
+  constraints = "1.21.0"
+  hashes = [
+    "h1:v7X6z6j8Uo07+QJPuO3EVM8N1uy6t2k+1GiRGioOPGc=",
+    "zh:17e3d204dabc116276c763bb0cd159aa315789d3b0bcd3b8aede935509960ab6",
+    "zh:1a7e5ac1921afdb3b12a49714c5f446a7604bfa1eb7bd9c123d607f8cbda45e4",
+    "zh:24a880623e30928ee866c84016b1db4e0458764c7a547b808e2d398e90456d42",
+    "zh:255c6162d35ace6a313a50c4ceb5452bd5582d7bb097a44e75ac4901e635ca13",
+    "zh:281ab48b69d0852b5138fe5ea2301ff7fdff30748f1f7878ac837c71622d3f7b",
+    "zh:3d4e0ae2809e743272e5d2640b64354c48140e225c2ba6f1a211700ea70e0754",
+    "zh:4f4df290e3ff626d8b274c624852d21d194a397a7f580ebe0cbf0ff64dd8fa31",
+    "zh:5997ce8f7cbcd7ff5a443d037b83857b17b64be928e9d9338dd494466733df60",
+    "zh:a05f0b65b0abf4488cdaf7b239206940940be77fd51f458f2a0986c6a17436aa",
+    "zh:aeb6c6da639abb6126f38be90a7bc428f925461bf599388ff092e059e0bb1a94",
+    "zh:d30bb053b6000c32cc8d03da231c30eaecddd926200adf2e9ad9c0186c2ad1ad",
+    "zh:d978827683b324c75141fa80ebc28dcaf181acd0be0a47b1e5f9579a72a08151",
+    "zh:f51fae9206361cbe865e30b06d106270d6acf7ece0550953b0d6b55afe6be9ba",
+    "zh:fa49a2702c529865c20f57185d6dd41072fdd9a13ac1a49e30eb88605c31af7a",
+  ]
+}
+
+provider "registry.terraform.io/hashicorp/null" {
+  version = "3.2.2"
+  hashes = [
+    "h1:zT1ZbegaAYHwQa+QwIFugArWikRJI9dqohj8xb0GY88=",
+    "zh:3248aae6a2198f3ec8394218d05bd5e42be59f43a3a7c0b71c66ec0df08b69e7",
+    "zh:32b1aaa1c3013d33c245493f4a65465eab9436b454d250102729321a44c8ab9a",
+    "zh:38eff7e470acb48f66380a73a5c7cdd76cc9b9c9ba9a7249c7991488abe22fe3",
+    "zh:4c2f1faee67af104f5f9e711c4574ff4d298afaa8a420680b0cb55d7bbc65606",
+    "zh:544b33b757c0b954dbb87db83a5ad921edd61f02f1dc86c6186a5ea86465b546",
+    "zh:696cf785090e1e8cf1587499516b0494f47413b43cb99877ad97f5d0de3dc539",
+    "zh:6e301f34757b5d265ae44467d95306d61bef5e41930be1365f5a8dcf80f59452",
+    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
+    "zh:913a929070c819e59e94bb37a2a253c228f83921136ff4a7aa1a178c7cce5422",
+    "zh:aa9015926cd152425dbf86d1abdbc74bfe0e1ba3d26b3db35051d7b9ca9f72ae",
+    "zh:bb04798b016e1e1d49bcc76d62c53b56c88c63d6f2dfe38821afef17c416a0e1",
+    "zh:c23084e1b23577de22603cff752e59128d83cfecc2e6819edadd8cf7a10af11e",
+  ]
+}
+
+provider "registry.terraform.io/hashicorp/random" {
+  version     = "3.5.1"
+  constraints = "3.5.1"
+  hashes = [
+    "h1:VSnd9ZIPyfKHOObuQCaKfnjIHRtR7qTw19Rz8tJxm+k=",
+    "zh:04e3fbd610cb52c1017d282531364b9c53ef72b6bc533acb2a90671957324a64",
+    "zh:119197103301ebaf7efb91df8f0b6e0dd31e6ff943d231af35ee1831c599188d",
+    "zh:4d2b219d09abf3b1bb4df93d399ed156cadd61f44ad3baf5cf2954df2fba0831",
+    "zh:6130bdde527587bbe2dcaa7150363e96dbc5250ea20154176d82bc69df5d4ce3",
+    "zh:6cc326cd4000f724d3086ee05587e7710f032f94fc9af35e96a386a1c6f2214f",
+    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
+    "zh:b6d88e1d28cf2dfa24e9fdcc3efc77adcdc1c3c3b5c7ce503a423efbdd6de57b",
+    "zh:ba74c592622ecbcef9dc2a4d81ed321c4e44cddf7da799faa324da9bf52a22b2",
+    "zh:c7c5cde98fe4ef1143bd1b3ec5dc04baf0d4cc3ca2c5c7d40d17c0e9b2076865",
+    "zh:dac4bad52c940cd0dfc27893507c1e92393846b024c5a9db159a93c534a3da03",
+    "zh:de8febe2a2acd9ac454b844a4106ed295ae9520ef54dc8ed2faf29f12716b602",
+    "zh:eab0d0495e7e711cca367f7d4df6e322e6c562fc52151ec931176115b83ed014",
+  ]
+}
+
+provider "registry.terraform.io/kreuzwerker/docker" {
+  version     = "2.24.0"
+  constraints = "2.24.0"
+  hashes = [
+    "h1:1z0/qA77T3PS/1m4vRO8UgWjHjk5/v+f3JfGbMyzX18=",
+    "zh:181fefd55c8eb75efe9815c43fdd76422b57951ef53b5d5f19273a00fdf0e2e2",
+    "zh:2ec84e029d169f188be2addf7f45c2555f226f67d4b6fb66c1749ed5b2c4a76a",
+    "zh:6f5cf945148485f57b919d31a30f1a5a93d45f4e8edfdb0b80b22258d51795d8",
+    "zh:8d00c2c459a48453f52a00a8d1ffdb7bcf72fe4b3b09ffcfd52218c4646fa7fa",
+    "zh:9bd6e06601e0a972b9ce01150e32e76b76b4caf1d9798daf4cf16d06e2a8d4a3",
+    "zh:af72591132dc8cd338f293e458403851e6b8a6ac4c4d25a3268940f9763df7aa",
+    "zh:c4a47c5c7ad2ff1fc5212e69c5ef837a127346264e46ce7b5d13362545e4aa70",
+    "zh:c6d68f33efcd3372331ed0d58ec49e8b01ddc132934b14d2d45977076950e4b3",
+    "zh:db228855ae7235095d367f3597719747e5be0dd9ce2206ea02062560b518c08a",
+    "zh:e8d6ce89642925f2e813d0b829bd5562582de37eaa39351e231ab474383e703a",
+    "zh:ec83d8c86a918d25eb824cc99f98924ef8949eb69aa40cb5ff2db24369e52d9c",
+    "zh:ee0032d3d86adeeca7fdd4922bb8db87dbb5cd0093c054ff8efe2260de0b624c",
+    "zh:f033b70f342f32eeb98c213e6fc7098d7afd22b3146a5cb6173c128b0e86d732",
+    "zh:f1bc3a2c4f152f8adc9a1f9c852496232ef31073b149945756c13bc9688cf08b",
+  ]
+}
+
+provider "registry.terraform.io/lokkersp/sops" {
+  version     = "0.6.10"
+  constraints = "0.6.10"
+  hashes = [
+    "h1:atU8NIBxpNTWY+qBubvEOfjOn4K1aCDoq1iUFocgIHQ=",
+    "zh:0f053a26392a581b1f1ce6316cb7ed8ec4cc75e7f5f1cf7cfd45050b6b3c87ea",
+    "zh:207bb96c4471fce9aeb1b3c217d772692c3d865d294cf4d2501dad41de36a15e",
+    "zh:28506e8f1f3b9eaa95d99043440328044ee6340143535e5751538328a529d001",
+    "zh:3cae3bcea9e35fdc5b3f2af1b4580cd625c996448ad0c676c772260e46b25289",
+    "zh:3e44daaf82986c2b0028aeb17b867f3c68ed5dd8ac8625ba0406cf2a5fd3d92e",
+    "zh:457fb8ca2e677af24f9a4bdd8b613b1d7b604ad7133541657e5757c19268da71",
+    "zh:473d727c228f021a3df8cc8dcc6231ad7f90ed63f9e47c36b597d591e76228da",
+    "zh:48c4c1df39fd76ec8bd5fe9ac70cdc0927ac8be95582dbe46458b3442ce0fcd9",
+    "zh:728b19cb5c07e5e9d8b78fd94cc57d4c13582ecd24b7eb7c4cc2bf73b12fe4d1",
+    "zh:c51ed9af591779bb0910b82addeebb10f53428b994f8db653dd1dedcec60916c",
+    "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c",
+  ]
+}
diff --git a/terraform/conflatorio-prometheus/backend.tf b/terraform/conflatorio-prometheus/backend.tf
new file mode 100644
index 0000000..9f2eed0
--- /dev/null
+++ b/terraform/conflatorio-prometheus/backend.tf
@@ -0,0 +1,12 @@
+# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
+terraform {
+  backend "s3" {
+    bucket                      = "terraform-a6726272-73ff-11ed-8bdd-c79eb8376e05"
+    key                         = "conflatorio-prometheus/terraform.tfstate"
+    skip_region_validation      = true
+    skip_credentials_validation = true
+    skip_metadata_api_check     = true
+    region                      = "eu-central-1"
+    endpoint                    = "eu-central-1.linodeobjects.com"
+  }
+}
diff --git a/terraform/conflatorio-prometheus/main.tf b/terraform/conflatorio-prometheus/main.tf
new file mode 100644
index 0000000..f5c5a7f
--- /dev/null
+++ b/terraform/conflatorio-prometheus/main.tf
@@ -0,0 +1,34 @@
+terraform {
+  required_version = "~> 1.3.5"
+
+  required_providers {
+    docker = {
+      source  = "kreuzwerker/docker"
+      version = "2.24.0"
+    }
+    postgresql = {
+      source  = "cyrilgdn/postgresql"
+      version = "1.21.0"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = "3.5.1"
+    }
+    sops = {
+      source  = "lokkersp/sops"
+      version = "0.6.10"
+    }
+  }
+}
+
+provider "docker" {
+  host = "ssh://conflatorio.vpn.trygvis.io"
+}
+
+data "docker_network" "traefik" {
+  name = "traefik"
+}
+
+data "docker_network" "private" {
+  name = "private"
+}
diff --git a/terraform/conflatorio-prometheus/prometheus.tf b/terraform/conflatorio-prometheus/prometheus.tf
new file mode 100644
index 0000000..04dd406
--- /dev/null
+++ b/terraform/conflatorio-prometheus/prometheus.tf
@@ -0,0 +1,66 @@
+resource "docker_image" "prometheus" {
+  name = "prom/prometheus:v2.53.2"
+}
+
+resource "docker_volume" "prometheus" {
+  name = "prometheus"
+}
+
+resource "docker_container" "prometheus" {
+  image    = docker_image.prometheus.image_id
+  name     = "prometheus"
+  must_run = true
+
+  env = [
+  ]
+
+  networks_advanced {
+    name = data.docker_network.private.name
+  }
+
+  #  networks_advanced {
+  #    name = data.docker_network.traefik.name
+  #  }
+
+  #  dynamic "labels" {
+  #    for_each = [
+  #      { label = "traefik.enable", value = "true" },
+  #      { label = "traefik.docker.network", value = data.docker_network.traefik.name },
+  #      { label = "traefik.http.routers.prometheus.rule", value = "Host(`prometheus.trygvis.io`)" },
+  #      { label = "traefik.http.routers.prometheus.entrypoints", value = "websecure" },
+  #      { label = "traefik.http.routers.prometheus.tls.certresolver", value = "linode" },
+  #    ]
+  #    content {
+  #      label = labels.value["label"]
+  #      value = labels.value["value"]
+  #    }
+  #  }
+
+  mounts {
+    source = "${local.path}"
+    target = "/etc/prometheus"
+    type   = "bind"
+  }
+
+  volumes {
+    volume_name    = docker_volume.prometheus.name
+    read_only      = false
+    container_path = "/prometheus"
+  }
+
+  depends_on = [ null_resource.mkdir ]
+}
+
+locals {
+  path = "/etc/docker-service/prometheus"
+}
+
+resource "null_resource" "mkdir" {
+  triggers = {
+    path = local.path
+  }
+
+  provisioner "local-exec" {
+    command = "ssh conflatorio.vpn.trygvis.io sudo mkdir -p ${local.path}"
+  }
+}
diff --git a/terraform/conflatorio-prometheus/terragrunt.hcl b/terraform/conflatorio-prometheus/terragrunt.hcl
new file mode 100644
index 0000000..e147285
--- /dev/null
+++ b/terraform/conflatorio-prometheus/terragrunt.hcl
@@ -0,0 +1,3 @@
+include "root" {
+  path = find_in_parent_folders()
+}
diff --git a/terraform/grafana/grafana.tf b/terraform/grafana/grafana.tf
index 6d75da3..7cda977 100644
--- a/terraform/grafana/grafana.tf
+++ b/terraform/grafana/grafana.tf
@@ -12,12 +12,14 @@ resource "docker_container" "grafana" {
   privileged = false
   must_run   = true
 
+  network_mode = "bridge"
+
   networks_advanced {
     name = data.docker_network.traefik.name
   }
 
   networks_advanced {
-    name = data.docker_network.public.name
+    name = data.docker_network.private.name
   }
 
   dynamic "labels" {
diff --git a/terraform/grafana/main.tf b/terraform/grafana/main.tf
index fa225ab..cb9b920 100644
--- a/terraform/grafana/main.tf
+++ b/terraform/grafana/main.tf
@@ -45,3 +45,7 @@ data "docker_network" "traefik" {
 data "docker_network" "public" {
   name = "public"
 }
+
+data "docker_network" "private" {
+  name = "private"
+}
diff --git a/terraform/terragrunt.hcl b/terraform/terragrunt.hcl
index e7e5f6a..382cf17 100644
--- a/terraform/terragrunt.hcl
+++ b/terraform/terragrunt.hcl
@@ -1,7 +1,7 @@
 generate "backend" {
   path      = "backend.tf"
   if_exists = "overwrite_terragrunt"
-  contents = <<EOF
+  contents  = <<EOF
 terraform {
   backend "s3" {
     bucket                      = "terraform-a6726272-73ff-11ed-8bdd-c79eb8376e05"