Clément Désiles
5efc0b0d6e
certbot cannot issue for internal hostnames (*.nas.local), which made nginx-enabled services with internal names fail on deploy. Add a <service>_nginx_letsencrypt flag (default false) and computed <service>_nginx_ssl_certificate/_key paths: when off the vhost uses the shared self-signed cert (nginx_default_ssl_cert), when on it uses the Let's Encrypt lineage. Gate the certbot include on the flag and apply the pattern to all service roles (deluge, fdroid, gitea, grafana, immich, metabase, ntfy, prowlarr, radarr, seerr, static_web, uptime_kuma).
58 lines
2.4 KiB
YAML
58 lines
2.4 KiB
YAML
---
|
|
# Grafana version
|
|
grafana_version: "stable"
|
|
|
|
# Network configuration
|
|
grafana_http_port: 3200
|
|
grafana_domain: grafana.nas.local
|
|
grafana_root_url: "https://{{ grafana_domain }}"
|
|
|
|
# PostgreSQL Database configuration
|
|
# The user and database will be created by this role.
|
|
# REQUIRED: The password must be set in your inventory (e.g., in inventory/host_vars/your_host.yml).
|
|
grafana_postgres_type: postgres
|
|
grafana_postgres_host: 127.0.0.1
|
|
grafana_postgres_port: 5432
|
|
grafana_postgres_db_name: grafana
|
|
grafana_postgres_user: grafana
|
|
# grafana_postgres_password: "" # Intentionally undefined - role will fail if not set
|
|
grafana_postgres_ssl_mode: "prefer" # 'disable', 'allow', 'prefer', 'require', 'verify-ca', 'verify-full'
|
|
|
|
# Security
|
|
# REQUIRED: These values must be set in your inventory.
|
|
grafana_admin_user: admin
|
|
# grafana_admin_password: "" # Intentionally undefined - role will fail if not set
|
|
# grafana_secret_key: "" # Intentionally undefined - role will fail if not set
|
|
|
|
# Analytics
|
|
grafana_reporting_enabled: false
|
|
grafana_check_for_updates: false
|
|
|
|
# Nginx reverse proxy
|
|
grafana_nginx_enabled: true
|
|
grafana_nginx_hostname: "{{ grafana_domain }}"
|
|
# Let's Encrypt (certbot) requires a publicly-resolvable hostname. Internal
|
|
# names (e.g. *.nas.local) cannot get a public cert: leave this false to use
|
|
# the shared self-signed cert (nginx_default_ssl_cert). Set true once a public
|
|
# DNS record points at the host.
|
|
grafana_nginx_letsencrypt: false
|
|
grafana_nginx_ssl_certificate: >-
|
|
{{ grafana_nginx_letsencrypt | ternary(
|
|
'/etc/letsencrypt/live/' ~ grafana_nginx_hostname ~ '/fullchain.pem',
|
|
nginx_default_ssl_cert) }}
|
|
grafana_nginx_ssl_certificate_key: >-
|
|
{{ grafana_nginx_letsencrypt | ternary(
|
|
'/etc/letsencrypt/live/' ~ grafana_nginx_hostname ~ '/privkey.pem',
|
|
nginx_default_ssl_key) }}
|
|
|
|
# Alerting (Grafana Unified Alerting → ntfy webhook)
|
|
# When enabled, provisions disk alert rules (HDD temperature + ZFS/filesystem
|
|
# capacity), notification policies and an ntfy contact point using ntfy's
|
|
# built-in "grafana" webhook template.
|
|
grafana_alerting_enabled: false
|
|
# Webhook URL of the target ntfy topic. Keep ?template=grafana so ntfy parses
|
|
# Grafana's webhook payload into a readable title/message.
|
|
# grafana_ntfy_webhook_url: "https://ntfy.example.com/sys-alerts?template=grafana"
|
|
# ntfy access token with write access to the topic (set in inventory/vault).
|
|
# grafana_ntfy_token: ""
|