add grafana role

roles/grafana/tasks/dashboards.yml

@@ -0,0 +1,40 @@
+---
+- name: "Create dashboard directory"
+  ansible.builtin.file:
+    path: "{{ dashboard_dir }}"
+    state: directory
+    owner: "{{ grafana_user }}"
+    group: "{{ grafana_group }}"
+    mode: "0755"
+
+- name: "Copy dashboard files from source to target"
+  ansible.builtin.copy:
+    src: "{{ item }}"
+    dest: "{{ dashboard_dir }}/{{ item | basename }}"
+    mode: "0644"
+    owner: "{{ grafana_user }}"
+    group: "{{ grafana_group }}"
+  with_fileglob:
+    - "{{ dashboard_source_path }}/*.json"
+
+- name: "Import Grafana dashboards to Grafana"
+  community.grafana.grafana_dashboard:
+    grafana_url: "http://127.0.0.1:{{ grafana_port }}"
+    url_username: "{{ admin_api_username }}"
+    url_password: "{{ admin_api_password }}"
+    state: present
+    commit_message: Updated by ansible
+    overwrite: false
+    path: "{{ dashboard_dir }}/{{ item | basename }}"
+  with_fileglob:
+    - "{{ dashboard_source_path }}/*.json"
+
+- name: "Run | reload Grafana provisioned dashboard configurations"
+  ansible.builtin.uri:
+  # kics-scan ignore-line
+    url: "http://127.0.0.1:{{ grafana_port }}/api/admin/provisioning/dashboards/reload"
+    method: POST
+    force_basic_auth: true
+    user: "{{ admin_api_username }}"
+    password: "{{ admin_api_password }}"
+    status_code: 200

roles/grafana/tasks/datasources.yml

@@ -0,0 +1,28 @@
+---
+- name: "Create datasource directory"
+  ansible.builtin.file:
+    path: "{{ datasource_dir }}"
+    state: directory
+    owner: "{{ grafana_user }}"
+    group: "{{ grafana_group }}"
+    mode: "0755"
+
+- name: "Configure | provision datasources for Grafana"
+  ansible.builtin.copy:
+    src: "{{ datasource_source_path }}/{{ item | basename }}"
+    dest: "{{ datasource_dir }}/{{ item | basename }}"
+    owner: "{{ grafana_user }}"
+    group: "{{ grafana_group }}"
+    mode: "0660"
+  with_fileglob:
+    "{{ datasource_source_path }}/*.y*ml"
+
+- name: "Run | reload Grafana datasource provisioned configurations"
+  ansible.builtin.uri:
+  # kics-scan ignore-line
+    url: "http://127.0.0.1:{{ grafana_port }}/api/admin/provisioning/datasources/reload"
+    method: POST
+    force_basic_auth: true
+    user: "{{ admin_api_username }}"
+    password: "{{ admin_api_password }}"
+    status_code: 200

roles/grafana/tasks/import_pub_dashboard.yml

@@ -0,0 +1,11 @@
+---
+- name: "Import public dashboard - '{{ public_dashboard.name }}''"
+  community.grafana.grafana_dashboard:
+    grafana_url: "http://127.0.0.1:{{ grafana_port }}"
+    state: "{{ public_dashboard.state | default('present') }}"
+    overwrite: false
+    dashboard_id: "{{ public_dashboard.id }}"
+    dashboard_revision: "{{ public_dashboard.revision }}"
+    commit_message: "Add public dashboard '{{ public_dashboard.name }}''"
+    url_username: "{{ admin_api_username }}"
+    url_password: "{{ admin_api_password }}"

roles/grafana/tasks/install.yml

@@ -0,0 +1,78 @@
+---
+- name: "Create Grafana system group"
+  ansible.builtin.group:
+    name: grafana
+    system: true
+    state: present
+
+- name: "Create Grafana system user"
+  ansible.builtin.user:
+    name: grafana
+    group: grafana
+    system: true
+    shell: "/sbin/nologin"
+    create_home: false
+    state: present
+
+- name: "Install Grafana deb package"
+  block:
+    - name: "Check Grafana version"
+      changed_when: false
+      ansible.builtin.command:
+        cmd: "grafana-server --version"
+      register: grafana_ver
+
+    - name: "Assert version correctness"
+      ansible.builtin.assert:
+        that: "grafana_ver.stdout is regex('{{ grafana_version }}')"
+        success_msg: "grafana version {{ grafana_version }} is installed and working"
+        fail_msg: "grafana version {{ grafana_version }} is not installed or not working correctly"
+
+  rescue:
+    - name: "Ensure that directories exist"
+      ansible.builtin.file:
+        path: "{{ item }}"
+        state: directory
+        owner: "{{ grafana_user }}"
+        group: "{{ grafana_group }}"
+        mode: '0775'
+      with_items:
+        - "{{ log_dir }}"
+        - "{{ data_dir }}"
+        - "{{ plugins_dir }}"
+
+    - name: "Download Grafana DEB package"
+      ansible.builtin.get_url:
+        url: "https://dl.grafana.com/oss/release/grafana_{{ grafana_version }}_amd64.deb"
+        dest: "/tmp/grafana-{{ grafana_version }}_amd64.deb"
+        owner: "{{ grafana_user }}"
+        group: "{{ grafana_group }}"
+        mode: "0644"
+      register: package_tmp
+
+    - name: "Install DEB package"
+      notify: "(Re)start and enable Grafana"
+      ansible.builtin.apt:
+        deb: "{{ package_tmp.dest }}"
+        state: present
+        update_cache: true
+
+    - name: "Cleanup downloaded file"
+      ansible.builtin.file:
+        path: "/tmp/grafana-{{ grafana_version }}_amd64.deb"
+        state: absent
+
+    - name: "Create env file for systemd service unit"
+      notify: "(Re)start and enable Grafana"
+      ansible.builtin.template:
+        src: grafana-server.env.j2
+        dest: "{{ item }}"
+        owner: "{{ grafana_user }}"
+        group: "{{ grafana_group }}"
+        mode: "0660"
+      with_items:
+        - "/etc/default/grafana-server"
+        - "/etc/default/grafana"
+
+- name: "Flush handlers"
+  ansible.builtin.meta: "flush_handlers"

roles/grafana/tasks/main.yml

@@ -0,0 +1,39 @@
+---
+- name: "Include grafana installation tasks"
+  ansible.builtin.include_tasks: install.yml
+
+- name: "Wait for the Grafana server to become available"
+  ansible.builtin.wait_for:
+    host: "127.0.0.1"
+    port: "{{ grafana_port }}"
+    state: started
+    delay: 10
+
+- name: "Include user creation tasks"
+  when: users is defined
+  loop: "{{ users }}"
+  loop_control:
+    loop_var: user
+  ansible.builtin.include_tasks: user.yml
+
+- name: "Configure custom dashboards"
+  when: dashboard_source_path is defined
+  ansible.builtin.include_tasks: dashboards.yml
+
+- name: "Configure public dashboards"
+  when: public_dashboards is defined
+  loop: "{{ public_dashboards }}"
+  loop_control:
+    loop_var: public_dashboard
+  ansible.builtin.include_tasks: import_pub_dashboard.yml
+
+- name: "Configure plugins"
+  when: plugins is defined
+  loop: "{{ plugins }}"
+  loop_control:
+    loop_var: plugin
+  ansible.builtin.include_tasks: plugins.yml
+
+- name: "Configure datasources"
+  when: datasource_source_path is defined
+  ansible.builtin.include_tasks: datasources.yml

roles/grafana/tasks/plugins.yml

@@ -0,0 +1,16 @@
+---
+- name: "Create plugin directory"
+  ansible.builtin.file:
+    path: "{{ plugins_dir }}"
+    state: directory
+    owner: "{{ grafana_user }}"
+    group: "{{ grafana_group }}"
+    mode: "0755"
+
+- name: "Install Grafana plugins"
+  community.grafana.grafana_plugin:
+    name: "{{ plugin.name }}"
+    version: "{{ plugin.version }}"
+    grafana_plugins_dir: "{{ plugins_dir }}"
+    state: "{{ plugin.state | default('present') }}"
+  notify: "(Re)start and enable Grafana"

roles/grafana/tasks/user.yml

@@ -0,0 +1,19 @@
+---
+
+- name: "Reset default admin password"
+  ansible.builtin.command: >
+    grafana-cli admin reset-admin-password "{{ admin_api_password }}"
+  no_log: true
+  changed_when: false
+
+- name: "Create | update a Grafana user"
+  community.grafana.grafana_user:
+    url: "http://127.0.0.1:{{ grafana_port }}"
+    url_username: "{{ admin_api_username }}"
+    url_password: "{{ admin_api_password }}"
+    name: "{{ user.name }}"
+    email: "{{ user.user_email }}"
+    login: "{{ user.user_login }}"
+    password: "{{ user.user_password }}"
+    is_admin: "{{ user.is_admin | default(false) }}"
+    state: present