Ansible Role: Grafana

Install and configure Grafana together with Prometheus, both as Docker containers on the host network.

Requirements

A Docker host with writable /mnt/grafana and /mnt/prometheus paths (for example mounted volumes). The role itself does not install Docker.

Dependencies

The playbook (playbook.yaml) runs these roles, in order, before grafana:

• docker
• traefik

Note that roles/requirements.yml only lists the grafana role itself.

Variables

Variable	Required	Default	Description
grafana_admin_password	Yes	development	Grafana admin password (GF_SECURITY_ADMIN_PASSWORD)

The role also uses timezone (passed as TZ to both containers). It has no default and must be set in the inventory.

Example

Keep real passwords in sops-encrypted inventory variables.

timezone: "Europe/Amsterdam"
grafana_admin_password: "change-me"

What the role does

• Prometheus:
  • creates /mnt/prometheus and /mnt/prometheus/data (owner nobody, group nogroup, mode 0775);
  • writes /mnt/prometheus/prometheus.yml with a 15s scrape interval and one job, unbound, scraping dns01.siempie.internal:9167 and dns02.siempie.internal:9167 (hardcoded in the task);
  • restarts the container when the config changes (restart prometheus handler);
  • runs cr.simoncor.net/dockerhub/prom/prometheus:v3.14.0 as container prometheus on the host network.
• Grafana:
  • creates /mnt/grafana (mode 0775);
  • runs cr.simoncor.net/dockerhub/grafana/grafana-oss:13.0.2 as container grafana on the host network with /mnt/grafana mounted on /var/lib/grafana.
• Both containers are always pulled, use restart policy unless-stopped and json-file logs (max 5m x 3).
• Cleans up Docker afterwards (tasks/cleanup.yaml): docker_prune and docker system prune --all --force --volumes, which removes all unused images, networks and volumes on the host.

Because the host network is used, Grafana listens on its default port 3000 and Prometheus on 9090.

Usage

Run playbook.yaml through Semaphore. It first runs ansible-galaxy install -f -r roles/requirements.yml on the controller (works around a Semaphore bug), then the docker, traefik and grafana roles on all hosts.