Separate traefik and grafana prometheus

roles/traefik/files/config/.gitignore

@@ -1,2 +0,0 @@
-acme.json
-acme.json*

roles/traefik/files/grafana.env

@@ -1,6 +0,0 @@
-GF_AUTH_ANONYMOUS_ENABLED=true
-GF_AUTH_BASIC_ENABLED=false
-GF_AUTH_PROXY_ENABLED=false
-GF_USERS_ALLOW_SIGN_UP=false
-GF_INSTALL_PLUGINS=grafana-piechart-panel
-GF_SERVER_ROOT_URL=%(protocol)s://%(domain)s:%(http_port)s/grafana

roles/traefik/files/grafana/provisioning/dashboards/dashboard.yml

@@ -1,21 +0,0 @@
-apiVersion: 1
-
-providers:
-  # <string> provider name
-- name: 'default'
-  # <int> org id. will default to orgId 1 if not specified
-  orgId: 1
-  # <string, required> name of the dashboard folder. Required
-  folder: ''
-  # <string> folder UID. will be automatically generated if not specified
-  folderUid: ''
-  # <string, required> provider type. Required
-  type: file
-  # <bool> disable dashboard deletion
-  disableDeletion: false
-  # <bool> enable dashboard editing
-  editable: true
-  # <int> how often Grafana will scan for changed dashboards
-  updateIntervalSeconds: 10
-  options:
-    path: /etc/grafana/provisioning/dashboards

roles/traefik/files/grafana/provisioning/datasources/datasource.yml

@@ -1,50 +0,0 @@
-# config file version
-apiVersion: 1
-
-# list of datasources that should be deleted from the database
-deleteDatasources:
-  - name: Prometheus
-    orgId: 1
-
-# list of datasources to insert/update depending
-# whats available in the database
-datasources:
-  # <string, required> name of the datasource. Required
-- name: Prometheus
-  # <string, required> datasource type. Required
-  type: prometheus
-  # <string, required> access mode. direct or proxy. Required
-  access: proxy
-  # <int> org id. will default to orgId 1 if not specified
-  orgId: 1
-  # <string> url
-  url: http://prometheus:9090
-  # <string> database password, if used
-  password:
-  # <string> database user, if used
-  user:
-  # <string> database name, if used
-  database:
-  # <bool> enable/disable basic auth
-  basicAuth: false
-  # <string> basic auth username
-  basicAuthUser:
-  # <string> basic auth password
-  basicAuthPassword:
-  # <bool> enable/disable with credentials headers
-  withCredentials:
-  # <bool> mark as default datasource. Max one per org
-  isDefault: true
-  # <map> fields that will be converted to json and stored in json_data
-  jsonData:
-     graphiteVersion: "1.1"
-     tlsAuth: false
-     tlsAuthWithCACert: false
-  # <string> json object of data that will be encrypted.
-  secureJsonData:
-    tlsCACert: "..."
-    tlsClientCert: "..."
-    tlsClientKey: "..."
-  version: 1
-  # <bool> allow users to edit datasources from the UI.
-  editable: true

roles/traefik/files/prometheus/alert.rules

@@ -1,11 +0,0 @@
-groups:
-- name: traefik
-  rules:
-  - alert: service_down
-    expr: up == 0
-    for: 2m
-    labels:
-      severity: page
-    annotations:
-      summary: "Instance {{ $labels.instance }} down"
-      description: "{{ $labels.instance }} of job {{ $labels.job }} has been down for more than 2 minutes"

roles/traefik/files/prometheus/prometheus.yml

@@ -1,12 +0,0 @@
-global:
-  scrape_interval:     15s
-  evaluation_interval: 15s
-
-rule_files:
-  - 'alert.rules'
-
-scrape_configs:
-  - job_name: 'traefik'
-    scrape_interval: 5s
-    static_configs:
-      - targets: ['traefik:8080']

roles/traefik/tasks/base.yml

@@ -5,12 +5,6 @@
     path: traefik
     state: directory
 
-- name: Copy traefik conf
-  ansible.builtin.copy:
-    src: .
-    dest: traefik/
-  register: traefik_copy_files_results
-
 - name: Copy template conf
   ansible.builtin.template:
     src: "{{ item.src }}"
@@ -21,16 +15,10 @@
     - { src: 'config/dynamic_conf.yml', dest: 'config/dynamic_conf.yml' }
   register: traefik_copy_templates_results
 
-- name: Create proxy network
-  community.docker.docker_network:
-    name: proxy
-    state: present
-  become: true
-
 - name: Update and restart container
   community.docker.docker_compose:
     project_src: traefik
     state: present
     pull: true
-    restarted: "{{ traefik_copy_files_results.changed or traefik_copy_templates_results.changed }}"
+    restarted: "{{ traefik_copy_templates_results.changed }}"
   become: true

roles/traefik/templates/docker-compose.yml

@@ -9,6 +9,7 @@ services:
       - no-new-privileges:true
     networks:
       proxy: {}
+      metrics: {}
       vpn:
         ipv4_address: {{ server.vpn.reverse_proxy_ip }}
     ports:
@@ -24,91 +25,32 @@ services:
       - /etc/timezone:/etc/timezone:ro
       - /etc/localtime:/etc/localtime:ro
     extra_hosts:
-      - "host.docker.internal:host-gateway"
+      - host.docker.internal:host-gateway
     labels:
-      - "traefik.enable=true"
-      - "traefik.http.middlewares.traefik-stripprefix.stripprefix.prefixes=/traefik"
-      - "traefik.http.routers.traefik-secure.entrypoints=https"
-      - "traefik.http.routers.traefik-secure.rule=Host(`dash.{{ server.domain }}`) && (PathPrefix(`/traefik`) || PathPrefix(`/api`))"
-      - "traefik.http.middlewares.tls-rep.redirectregex.permanent=true"
-      - "traefik.http.middlewares.tls-header.headers.SSLRedirect=true"
-      - "traefik.http.middlewares.tls-header.headers.forceSTSHeader=true"
-      - "traefik.http.middlewares.tls-header.headers.STSSeconds=315360000"
-      - "traefik.http.middlewares.tls-header.headers.STSIncludeSubdomains=true"
-      - "traefik.http.middlewares.tls-header.headers.STSPreload=true"
-      - "traefik.http.middlewares.tls-header.headers.browserXSSFilter=true"
-      - "traefik.http.middlewares.tls-header.headers.contentTypeNosniff=true"
-      - "traefik.http.middlewares.tls-header.headers.frameDeny=true"
-      - "traefik.http.middlewares.tls-header.headers.customFrameOptionsValue=SAMEORIGIN"
-      - "traefik.http.middlewares.tls-header.headers.featurePolicy=accelerometer 'none'; ambient-light-sensor 'none'; camera 'none'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; usb 'none'; midi 'none'; sync-xhr 'none'; vr 'none'"
-      - "traefik.http.middlewares.tls-header.headers.referrerPolicy=strict-origin-when-cross-origin"
-      - "traefik.http.middlewares.tls-chain.chain.middlewares=tls-rep,tls-header"
-      - "traefik.http.routers.traefik-secure.middlewares=traefik-stripprefix,tls-chain,private-network@file"
-      - "traefik.http.routers.traefik-secure.tls=true"
-      - "traefik.http.routers.traefik-secure.tls.certresolver=sslResolver"
-      - "traefik.http.routers.traefik-secure.service=api@internal"
-
-  prometheus:
-    image: prom/prometheus:latest
-    restart: unless-stopped
-    container_name: prometheus
-    volumes:
-      - ./prometheus/:/etc/prometheus/
-      - {{ server.work_dir }}/traefik/prometheus:/prometheus
-      - /etc/timezone:/etc/timezone:ro
-      - /etc/localtime:/etc/localtime:ro
-    command:
-      - "--web.route-prefix=/"
-      - "--web.external-url=https://dash.{{ server.domain }}/prometheus"
-      - "--config.file=/etc/prometheus/prometheus.yml"
-      - "--storage.tsdb.path=/prometheus"
-      - "--web.console.libraries=/usr/share/prometheus/console_libraries"
-      - "--web.console.templates=/usr/share/prometheus/consoles"
-    networks:
-      - proxy
-      - internal
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.middlewares.prometheus-stripprefix.stripprefix.prefixes=/prometheus"
-      - "traefik.http.routers.prometheus-secure.entrypoints=https"
-      - "traefik.http.routers.prometheus-secure.rule=Host(`dash.{{ server.domain }}`) && PathPrefix(`/prometheus`)"
-      - "traefik.http.routers.prometheus-secure.middlewares=tls-chain,prometheus-stripprefix,private-network@file"
-      - "traefik.http.routers.prometheus-secure.tls=true"
-      - "traefik.http.routers.prometheus-secure.tls.certresolver=sslResolver"
-      - "traefik.http.routers.prometheus-secure.service=prometheus"
-      - "traefik.http.services.prometheus.loadbalancer.server.port=9090"
-      - "traefik.docker.network=proxy"
-
-  grafana:
-    image: grafana/grafana:latest
-    restart: unless-stopped
-    container_name: grafana
-    volumes:
-      - {{ server.work_dir }}/traefik/grafana:/var/lib/grafana
-      - ./grafana/provisioning:/etc/grafana/provisioning
-      - /etc/timezone:/etc/timezone:ro
-      - /etc/localtime:/etc/localtime:ro
-    env_file:
-      - grafana.env
-    depends_on:
-      - prometheus
-    networks:
-      - proxy
-      - internal
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.middlewares.grafana-stripprefix.stripprefix.prefixes=/grafana"
-      - "traefik.http.routers.grafana-secure.entrypoints=https"
-      - "traefik.http.routers.grafana-secure.rule=Host(`dash.{{ server.domain }}`) && PathPrefix(`/grafana`)"
-      - "traefik.http.routers.grafana-secure.middlewares=tls-chain,grafana-stripprefix,private-network@file"
-      - "traefik.http.routers.grafana-secure.tls=true"
-      - "traefik.http.routers.grafana-secure.tls.certresolver=http"
-      - "traefik.http.routers.grafana-secure.service=grafana"
-      - "traefik.http.services.grafana.loadbalancer.server.port=3000"
-      - "traefik.docker.network=proxy"
+      - traefik.enable=true
+      - traefik.http.routers.traefik-secure.entrypoints=https
+      - traefik.http.routers.traefik-secure.rule=Host(`traefik.{{ server.domain }}`)
+      - traefik.http.middlewares.tls-rep.redirectregex.permanent=true
+      - traefik.http.middlewares.tls-header.headers.SSLRedirect=true
+      - traefik.http.middlewares.tls-header.headers.forceSTSHeader=true
+      - traefik.http.middlewares.tls-header.headers.STSSeconds=315360000
+      - traefik.http.middlewares.tls-header.headers.STSIncludeSubdomains=true
+      - traefik.http.middlewares.tls-header.headers.STSPreload=true
+      - traefik.http.middlewares.tls-header.headers.browserXSSFilter=true
+      - traefik.http.middlewares.tls-header.headers.contentTypeNosniff=true
+      - traefik.http.middlewares.tls-header.headers.frameDeny=true
+      - traefik.http.middlewares.tls-header.headers.customFrameOptionsValue=SAMEORIGIN
+      - traefik.http.middlewares.tls-header.headers.featurePolicy=accelerometer 'none'; ambient-light-sensor 'none'; camera 'none'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; usb 'none'; midi 'none'; sync-xhr 'none'; vr 'none'
+      - traefik.http.middlewares.tls-header.headers.referrerPolicy=strict-origin-when-cross-origin
+      - traefik.http.middlewares.tls-chain.chain.middlewares=tls-rep,tls-header
+      - traefik.http.routers.traefik-secure.middlewares=tls-chain,private-network@file
+      - traefik.http.routers.traefik-secure.tls=true
+      - traefik.http.routers.traefik-secure.tls.certresolver=sslResolver
+      - traefik.http.routers.traefik-secure.service=api@internal
 
 networks:
-  internal:
+  metrics:
+    external: true
   proxy:
     external: true
   vpn: