From c46ba14c5f5f52ac2232da32542d226acea85be9 Mon Sep 17 00:00:00 2001 From: Tom Ward Date: Fri, 3 Nov 2023 14:19:40 +0000 Subject: [PATCH] feat: add grafana deployment details --- .github/dependabot.yml | 5 +++ docker-compose.yaml | 4 +- grafana/Dockerfile | 3 ++ grafana/README.md | 83 ++++++++++++++++++++++++++++++++++++++ grafana/docker-compose.yml | 12 ++++++ grafana/justfile | 22 ++++++++++ 6 files changed, 128 insertions(+), 1 deletion(-) create mode 100644 grafana/Dockerfile create mode 100644 grafana/README.md create mode 100644 grafana/docker-compose.yml create mode 100644 grafana/justfile diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 5a60f87a..e64fcbb5 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -11,3 +11,8 @@ updates: directory: "/" schedule: interval: "monthly" + + - package-ecosystem: "docker" + directory: "grafana/" + schedule: + interval: "weekly" diff --git a/docker-compose.yaml b/docker-compose.yaml index 12d97e92..073c831c 100644 --- a/docker-compose.yaml +++ b/docker-compose.yaml @@ -11,7 +11,9 @@ services: - postgres:/var/lib/postgresql/data/ grafana: - image: "grafana/grafana:latest" + # use Dockerfile so that version matches production + build: + dockerfile: grafana/Dockerfile environment: GF_DATABASE_TYPE: postgres GF_DATABASE_HOST: db:5432 diff --git a/grafana/Dockerfile b/grafana/Dockerfile new file mode 100644 index 00000000..5d59ea36 --- /dev/null +++ b/grafana/Dockerfile @@ -0,0 +1,3 @@ +FROM grafana/grafana-enterprise:latest@sha256:0d33bf1b2c3d508c5345ca652a96676c119420c4474e90299e4703ee834ade70 + +USER grafana diff --git a/grafana/README.md b/grafana/README.md new file mode 100644 index 00000000..50a01925 --- /dev/null +++ b/grafana/README.md @@ -0,0 +1,83 @@ +# Grafana deployment instructions +## Create app + +```bash +dokku$ dokku apps:create grafana +dokku$ dokku domains:add grafana dashboards.opensafely.org +``` + +## Create postgresql db for grafana + +* on DO db cluster + * postgresql version to match target server - currently 14 on dokku3 + +## create persistent storage + +```bash +# the grafana container runs as uid 472 (grafana) +# the other dokku containers on dokku3 run as uid 1013 (dokku) +# let's tell the container to run as 1013, then we can use the same file permissions +dokku$ dokku docker-options:add grafana deploy "--user 1013" +dokku$ dokku docker-options:add grafana run "--user 1013" +dokku$ dokku storage:ensure-directory grafana + +myuser$ sudo chown -R dokku:dokku /var/lib/dokku/data/storage/grafana + +dokku$ dokku storage:mount grafana /var/lib/dokku/data/storage/grafana:/var/lib/grafana +``` + +## Configure app + +```bash +dokku config:set grafana GF_DATABASE_TYPE="postgres" +dokku config:set grafana GF_DATABASE_HOST="xxx:5432" +dokku config:set grafana GF_DATABASE_NAME="grafana" +dokku config:set grafana GF_DATABASE_USER="grafana" +dokku config:set grafana GF_DATABASE_PASSWORD="xxx" +dokku config:set grafana GF_DATABASE_SSL_MODE="require" +dokku config:set grafana GF_SERVER_ROOT_URL="https://dashboards.opensafely.org/" +dokku config:set grafana GF_INSTALL_PLUGINS="grafana-github-datasource" +``` + +## Letsencrypt + +```bash +dokku$ dokku ports:add grafana http:80:3000 +# TODO: block access to port 3000? +dokku$ dokku letsencrypt:enable grafana +``` + +## Create postgresql connection in Grafana + +### Configure user on postgresql db cluster + +* create `grafanareader` user on cluster in DigitalOcean control panel for primary node +* by default `grafanareader` cannot connect to `jobserver` database +* connect to primary node with psql & allow connections: + +```sql +GRANT CONNECT ON database jobserver TO grafanareader; +``` + +* `grafanareader` will still fail with e.g. "db query error: pq: permission denied for table applications_application" +* configure access as required: + +```sql +GRANT SELECT ON applications_application, applications_cmoprioritylistpage, applications_commercialinvolvementpage, applications_datasetspage, applications_legalbasispage, applications_previousehrexperiencepage, applications_recordleveldatapage, applications_referencespage, applications_researcherregistration, applications_sharingcodepage, applications_sponsordetailspage, applications_studydatapage, applications_studyfundingpage, applications_studyinformationpage, applications_studypurposepage, applications_teamdetailspage, applications_typeofstudypage, interactive_analysisrequest, jobserver_backend, jobserver_backendmembership, jobserver_job, jobserver_jobrequest, jobserver_org, jobserver_orgmembership, jobserver_project, jobserver_projectmembership, jobserver_publishrequest, jobserver_release, jobserver_releasefile, jobserver_releasefilereview, jobserver_repo, jobserver_report, jobserver_snapshot, jobserver_snapshot_files, jobserver_stats, jobserver_workspace, redirects_redirect TO grafanareader; +CREATE VIEW jobserver_user_grafana AS SELECT id,last_login,is_superuser,username,is_staff,is_active,date_joined,fullname,created_by_id,login_token_expires_at,pat_expires_at,roles FROM jobserver_user; +GRANT SELECT ON jobserver_user_grafana TO grafanareader; +``` + +### Connect from Grafana + +In the Grafana UI: + +* Adminstration +* Plugins +* PostgreSQL +* Add new data source +* Enter `Host`, `Database`, `User`, `Password` from DigitalOcean db cluster read-only node `Connection Details` + +### Missing datasource + +If you import a Dashboard from a JSON file, the visualisations may error with "Could not find datasource $UUID". It is sometimes possible to fix this by some combination of hitting "Run query" & "Refresh", otherwise you could recreate the visulation by copy-pasting SQL etc. diff --git a/grafana/docker-compose.yml b/grafana/docker-compose.yml new file mode 100644 index 00000000..d178f1d5 --- /dev/null +++ b/grafana/docker-compose.yml @@ -0,0 +1,12 @@ +services: + grafana: + # use Dockerfile so that version matches production + build: + dockerfile: Dockerfile + ports: + - 3000:3000 + volumes: + - grafana:/var/lib/grafana + +volumes: + grafana: diff --git a/grafana/justfile b/grafana/justfile new file mode 100644 index 00000000..11dbf967 --- /dev/null +++ b/grafana/justfile @@ -0,0 +1,22 @@ + +build: + #!/usr/bin/env bash + set -euo pipefail + + test -z "${SKIP_BUILD:-}" || { echo "SKIP_BUILD set"; exit 0; } + + # set build args for prod builds + export BUILD_DATE=$(date -u +'%y-%m-%dT%H:%M:%SZ') + export GITREF=$(git rev-parse --short HEAD) + + docker compose build grafana + +serve: + docker compose up grafana -d + +# run a basic functional smoke test against a running server +smoke-test host="http://127.0.0.1:3000/login": + #!/bin/bash + set -eu + curl -I {{ host }} -s --compressed --fail --retry 20 --retry-delay 1 --retry-all-errors +