grafana: request an apache frontend

software/grafana/buildout.hash.cfg

@@ -16,7 +16,7 @@
 
 [instance-profile]
 filename = instance.cfg.in
-md5sum = e056fb1146c1e741e99a4a713cb65767
+md5sum = 3991cc23a43da437a12c5af0edb1de9f
 
 [influxdb-config-file]
 filename = influxdb-config-file.cfg.in
@@ -28,4 +28,4 @@ md5sum = a1a9c22c2a7829c66a49fc2504604d21
 
 [grafana-config-file]
 filename = grafana-config-file.cfg.in
-md5sum = 121233d1f376913141aecc44e17f0c5c
+md5sum = 8244d430905b968795c7946049bed9e3

software/grafana/grafana-config-file.cfg.in

@@ -41,14 +41,14 @@ http_addr = [{{ grafana['ipv6'] }}]
 http_port = {{ grafana['port'] }}
 
 # The public facing domain name used to access grafana from a browser
-domain = localhost
+domain = {{ apache_frontend['connection-domain'] }}
 
 # Redirect to correct domain if host header does not match domain
 # Prevents DNS rebinding attacks
 enforce_domain = false
 
 # The full public facing url
-root_url = %(protocol)s://%(domain)s:%(http_port)s/
+root_url = {{ apache_frontend['connection-secure_access'] }}
 
 # Log web requests
 router_logging = false

software/grafana/instance-output-schema.json

@@ -4,7 +4,7 @@
   "additionalProperties": false,
   "properties": {
     "url": {
-      "description": "IPv6 URL to access grafana",
+      "description": "Shared frontend for this Grafana instance",
       "pattern": "^https://",
       "type": "string"
     },
@@ -16,6 +16,11 @@
       "description": "Password for grafana's admin user",
       "type": "string"
     },
+    "grafana-url": {
+      "description": "IPv6 URL to access grafana",
+      "pattern": "^https://",
+      "type": "string"
+    },
     "influxdb-url": {
       "description": "IPv6 URL of influxdb HTTP endpoint",
       "pattern": "^https://",

software/grafana/instance.cfg.in

@@ -8,13 +8,23 @@ develop-eggs-directory = {{ buildout['develop-eggs-directory'] }}
 offline = true
 
 
+
 [instance-parameter]
 recipe = slapos.cookbook:slapconfiguration
-computer = ${slap_connection:computer_id}
-partition = ${slap_connection:partition_id}
-url = ${slap_connection:server_url}
-key = ${slap_connection:key_file}
-cert = ${slap_connection:cert_file}
+computer = ${slap-connection:computer-id}
+partition = ${slap-connection:partition-id}
+url = ${slap-connection:server-url}
+key = ${slap-connection:key-file}
+cert = ${slap-connection:cert-file}
+
+[slap-configuration]
+# apache-frontend reads from from a part named [slap-configuration]
+recipe = slapos.cookbook:slapconfiguration.serialised
+computer = ${slap-connection:computer-id}
+partition = ${slap-connection:partition-id}
+url = ${slap-connection:server-url}
+key = ${slap-connection:key-file}
+cert = ${slap-connection:cert-file}
 
 [directory]
 recipe = slapos.cookbook:mkdirectory
@@ -143,6 +153,7 @@ recipe = slapos.cookbook:generate.password
 <= config-file
 context =
   section grafana grafana
+  section apache_frontend apache-frontend
   key slapparameter_dict slap-configuration:configuration
 
 [grafana-listen-promise]
@@ -167,6 +178,17 @@ context =
   section telegraf telegraf
 
 
+[apache-frontend]
+<= slap-connection
+recipe = slapos.cookbook:requestoptional
+name = Grafana Frontend
+# XXX We have hardcoded SR URL here.
+software-url = http://git.erp5.org/gitweb/slapos.git/blob_plain/HEAD:/software/apache-frontend/software.cfg
+slave = true
+config-url = ${grafana:url}
+config-https-only = true
+return = domain secure_access
+
 
 [promises]
 recipe =
@@ -178,13 +200,12 @@ instance-promises =
 
 [publish-connection-parameter]
 recipe = slapos.cookbook:publish
-
 influxdb-url = ${influxdb:url}
 influxdb-database = ${influxdb:database}
 influxdb-username = ${influxdb:auth-username}
 influxdb-password = ${influxdb:auth-password}
 telegraf-extra-config-dir = ${telegraf:extra-config-dir}
-url = ${grafana:url}
+grafana-url = ${grafana:url}
 grafana-username = ${grafana:admin-user}
 grafana-password = ${grafana:admin-password}
-
+url = ${apache-frontend:connection-secure_access}