Add grafana role

grafana/defaults/main.yml

+---
+
+grafana_serve_from_sub_path: "false"
+grafana_ldap: false
+grafana_ldap_allow_sign_up: "false"
+grafana_basic_auth: true
+grafana_cookie_secure: "false"
+grafana_allow_sign_up: "false"
+grafana_allow_org_create: "false"
+grafana_auto_assign_org: "true"
+grafana_auto_assign_org_id: 1
+grafana_auto_assign_org_role: "Viewer"
+grafana_smtp_enabled: false
+grafana_smtp_host: mailrelay.example.org
+grafana_smtp_from_address: grafana@example.org
+grafana_smtp_from_name: Grafana
+grafana_metrics_enabled: "false"
+grafana_extra_config: ""

grafana/files/grafana-server-override.service

+[Service]
+RuntimeDirectoryMode=0751
+ExecStartPost=sh -c "while test ! -S ${RUNTIME_DIRECTORY}/sock; do sleep 1; done; chmod 0666 ${RUNTIME_DIRECTORY}/sock"

grafana/handlers/main.yml

+---
+
+- name: Restart Grafana
+  systemd:
+    name: grafana-server.service
+    state: restarted
+
+- name: Reload systemd
+  systemd:
+    daemon_reload: true

grafana/tasks/main.yml

+---
+
+- name: Install Grafana repository keys
+  apt_key:
+    url: https://packages.grafana.com/gpg.key
+    state: present
+  tags:
+    - packages
+    - repo
+    - grafana
+    - config
+
+- name: Install Grafana repo
+  apt_repository:
+    repo: "deb https://packages.grafana.com/enterprise/deb stable main"
+  tags:
+    - packages
+    - repo
+    - grafana
+    - config
+
+- name: Install Grafana
+  apt:
+    name:
+      - grafana-enterprise
+    state: present
+  tags:
+    - packages
+    - grafana
+
+- name: Create systemd unit override directory
+  file:
+    path: /etc/systemd/system/grafana-server.service.d
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  tags:
+    - grafana
+    - config
+
+- name: Configure Grafana systemd service
+  copy:
+    src: grafana-server-override.service
+    dest: /etc/systemd/system/grafana-server.service.d/ansible-override.conf
+    owner: root
+    group: root
+    mode: "0644"
+  notify:
+    - Reload systemd
+    - Restart Grafana
+  tags:
+    - grafana
+    - config
+
+- name: Configure Grafana
+  template:
+    src: grafana.ini.j2
+    dest: /etc/grafana/grafana.ini
+    owner: root
+    group: grafana
+    mode: "0640"
+  notify:
+    - Restart Grafana
+  tags:
+    - config
+    - grafana
+
+- name: Configure Grafana LDAP auth
+  template:
+    src: ldap.toml.j2
+    dest: /etc/grafana/ldap.toml
+    owner: root
+    group: grafana
+    mode: "0640"
+  when:
+    - grafana_ldap
+  notify:
+    - Restart Grafana
+  tags:
+    - config
+    - grafana
+
+- meta: flush_handlers
+
+- name: Enable and start Grafana
+  systemd:
+    name: grafana-server.service
+    state: started
+    enabled: true
+  tags:
+    - grafana

grafana/templates/grafana.ini.j2

+# -*- conf-unix -*-
+
+[server]
+# Protocol (http, https, h2, socket)
+protocol = socket
+
+# The public facing domain name used to access grafana from a browser
+domain = {{ grafana_domain }}
+
+# The full public facing url you use in browser, used for redirects and emails
+# If you use reverse proxy and sub path specify full url (with sub path)
+root_url = {{ grafana_root_url }}
+
+# Serve Grafana from subpath specified in `root_url` setting. By default it is set to `false` for compatibility reasons.
+serve_from_sub_path = {{ grafana_serve_from_sub_path }}
+
+# Unix socket path
+socket = /run/grafana/sock
+
+[database]
+{% if grafana_database_url is defined %}
+url = {{ grafana_database_url }}
+{% endif %}
+
+[analytics]
+# Server reporting, sends usage counters to stats.grafana.org every 24 hours.
+# No ip addresses are being tracked, only simple counters to track
+# running instances, dashboard and error counts. It is very helpful to us.
+# Change this option to false to disable reporting.
+reporting_enabled = false
+
+[security]
+# disable creation of admin user on first start of grafana
+disable_initial_admin_creation = true
+
+# disable gravatar profile images
+disable_gravatar = true
+
+{% if grafana_data_source_proxy_whitelist is defined %}
+# data source proxy whitelist (ip_or_domain:port separated by spaces)
+data_source_proxy_whitelist = {{ grafana_data_source_proxy_whitelist }}
+{% endif %}
+
+# set to true if you host Grafana behind HTTPS. default is false.
+cookie_secure = {{ grafana_cookie_secure }}
+
+[users]
+# disable user signup / registration
+allow_sign_up = {{ grafana_allow_sign_up }}
+
+# Allow non admin users to create organizations
+allow_org_create = {{ grafana_allow_org_create }}
+
+# Set to true to automatically assign new users to the default organization (id 1)
+auto_assign_org = {{ grafana_auto_assign_org }}
+
+# Set this value to automatically add new users to the provided organization (if auto_assign_org above is set to true)
+auto_assign_org_id = {{ grafana_auto_assign_org_id }}
+
+# Default role new users will be automatically assigned (if disabled above is set to true)
+auto_assign_org_role = {{ grafana_auto_assign_org_role }}
+
+# Require email validation before sign up completes
+verify_email_enabled = true
+
+[auth.basic]
+enabled = {{ grafana_basic_auth }}
+
+[auth.ldap]
+enabled = {{ grafana_ldap }}
+allow_sign_up = {{ grafana_ldap_allow_sign_up }}
+
+[smtp]
+enabled = {{ grafana_smtp_enabled }}
+host = {{ grafana_smtp_host }}
+from_address = {{ grafana_smtp_from_address }}
+from_name = {{ grafana_smtp_from_name }}
+
+[metrics]
+# Disable / Enable internal metrics
+enabled           = {{ grafana_metrics_enabled }}
+
+{% if grafana_metrics_auth is defined %}
+#If both are set, basic auth will be required for the metrics endpoint.
+basic_auth_username = {{ grafana_metrics_auth.user }}
+basic_auth_password = {{ grafana_metrics_auth.password }}
+{% endif %}
+
+
+{{ grafana_extra_config }}

grafana/templates/ldap.toml.j2

+# -*- toml -*-
+
+{% for s in grafana_ldap_servers %}
+[[servers]]
+
+# Ldap server host (specify multiple hosts space separated)
+host = "{{ s.host }}"
+
+# Default port is 389 or 636 if use_ssl = true
+port = {{ s.port|default(389) }}
+
+# Set to true if ldap server supports TLS
+use_ssl = {{ s.use_ssl|default("false") }}
+
+# Set to true if connect ldap server with STARTTLS pattern (create connection in insecure, then upgrade to secure connection with TLS)
+start_tls = {{ s.start_tls|default("true") }}
+
+{% if s.root_ca_cert is defined %}
+# set to the path to your root CA certificate or leave unset to use system defaults
+root_ca_cert = "{{ s.root_ca_cert }}"
+{% endif %}
+
+# Search user bind dn
+bind_dn = "{{ s.bind_dn }}"
+
+{% if s.bind_password is defined %}
+# Search user bind password
+# If the password contains # or ; you have to wrap it with triple quotes. Ex """#password;"""
+bind_password = """{{ s.bind_password }}"""
+{% endif %}
+
+# User search filter, for example "(cn=%s)" or "(sAMAccountName=%s)" or "(uid=%s)"
+search_filter = "{{ s.search_filter }}"
+
+# An array of base dns to search through
+search_base_dns = ["{{ s.search_base_dns|join('", "') }}"]
+
+# Specify names of the ldap attributes your ldap uses
+[servers.attributes]
+{% for k, v in s.attributes.items() %}
+{{ k }} = "{{ v }}"
+{% endfor %}
+
+# Map ldap groups to grafana org roles
+{% for m in s.group_mappings %}
+[[servers.group_mappings]]
+group_dn = "{{ m.group_dn }}"
+org_role = "{{ m.org_role }}"
+grafana_admin = {{ m.grafana_admin|default("false") }}
+{% if m.org_id is defined %}
+# The Grafana organization database id, optional, if left out the default org (id 1) will be used
+org_id = {{ m.org_id }}
+{% endif %}
+{% endfor %} {# m in s.group_mappings #}
+
+{% endfor %} {# s in grafana_ldap_servers #}