grafana.yml

---
- name: Grafana
  hosts: grafana
  become: true
  vars:
    hostname: stats.galaxyproject.eu
  vars_files:
    - group_vars/grafana-gitter-bridge.yml
    - secret_group_vars/all.yml
  # This shouldn't be necessary? but if certs fail, then do this. This is
  # *supposed* to be properly handled by the nginx role, but the permission
  # change is likely only applied if a change is detected since it can't figure
  # out if the rule is there or not.
  # TODO: make the nginx task check if the rule is in place, rather than a change in path.
  # pre_tasks:
  #   - name: Put SELinux in permissive mode, logging actions that would be blocked.
  #     selinux:
  #       policy: targeted
  #       state: permissive
  pre_tasks:
    - name: Set default version of Python
      alternatives:
        name: python
        path: /usr/bin/python3
    - name: Install Dependencies
      package:
        name: ['python3-virtualenv']
      become: true
    - name: Disable firewalld service
      ansible.builtin.service:
        name: firewalld
        enabled: false
        state: stopped
  collections:
    - devsec.hardening
  roles:
    ## Starting configuration of the operating system
    - role: usegalaxy_eu.handy.os_setup
      vars:
        enable_hostname: true
        enable_powertools: true        # geerlingguy.repo-epel role doesn't enable PowerTools repository
    - geerlingguy.repo-epel     # Install EPEL repository
    - usegalaxy-eu.autoupdates  # keep all of our packages up to date
    - influxdata.chrony         # Keep our time in sync.
    ## Monitoring
    - hxr.monitor-ssl
    - hxr.monitor-email

    - galaxyproject.nginx
    - cloudalchemy.grafana
    - pgs
    - hxr.grafana-gitter-bridge
    - usegalaxy_eu.grafana_matrix_forwarder
    - dj-wasabi.telegraf