grafana + arreglar permisos + romper cosas
This commit is contained in:
parent
f6e35c356b
commit
7b6a7b1cdc
10 changed files with 684 additions and 116 deletions
52
alpine.ts
52
alpine.ts
|
|
@ -11,7 +11,15 @@ import { cwd } from "node:process";
|
|||
import { Fstab } from "./fstab.js";
|
||||
import { execFile } from "./helpers/better-api.js";
|
||||
import { PasswdEntry, sudoReadPasswd } from "./helpers/passwd.js";
|
||||
import { sudoWriteExecutable } from "./helpers/sudo.js";
|
||||
import {
|
||||
sudoChmod,
|
||||
sudoChown,
|
||||
sudoCopy,
|
||||
sudoMkdirP,
|
||||
sudoSymlink,
|
||||
sudoWriteExecutable,
|
||||
sudoWriteFile,
|
||||
} from "./helpers/sudo.js";
|
||||
import { logDebug } from "./helpers/logger.js";
|
||||
|
||||
export class Alpine {
|
||||
|
|
@ -21,16 +29,25 @@ export class Alpine {
|
|||
}
|
||||
fstab: Fstab = new Fstab(this);
|
||||
|
||||
async mkdir(dir: string, opts?: { recursive: boolean }): Promise<void> {
|
||||
await mkdir(path.join(this.dir, dir), opts);
|
||||
async mkdirP(dir: string): Promise<void> {
|
||||
await sudoMkdirP(path.join(this.dir, dir));
|
||||
}
|
||||
async writeFile(filePath: string, content: string): Promise<void> {
|
||||
await this.mkdir(path.dirname(filePath), { recursive: true });
|
||||
await writeFile(path.join(this.dir, filePath), content);
|
||||
async writeFile(
|
||||
filePath: string,
|
||||
content: string,
|
||||
permissions?: { uid: number; gid: number }
|
||||
): Promise<void> {
|
||||
await this.mkdirP(path.dirname(filePath));
|
||||
await sudoWriteFile(path.join(this.dir, filePath), content);
|
||||
if (permissions)
|
||||
await sudoChown(
|
||||
path.join(this.dir, filePath),
|
||||
`${permissions.uid}:${permissions.gid}`
|
||||
);
|
||||
}
|
||||
async writeExecutable(filePath: string, content: string): Promise<void> {
|
||||
await this.writeFile(filePath, content);
|
||||
await chmod(path.join(this.dir, filePath), 700);
|
||||
await sudoChmod(path.join(this.dir, filePath), "700");
|
||||
}
|
||||
path(p: string): string {
|
||||
return path.join(this.dir, p);
|
||||
|
|
@ -53,13 +70,12 @@ export class Alpine {
|
|||
}
|
||||
async symlink(_target: string, _filePath: string): Promise<void> {
|
||||
const { target, filePath } = this.getRelativeSymlink(_target, _filePath);
|
||||
await symlink(target, filePath);
|
||||
}
|
||||
async sudoSymlink(_target: string, _filePath: string): Promise<void> {
|
||||
const { target, filePath } = this.getRelativeSymlink(_target, _filePath);
|
||||
await execFile("sudo", ["ln", "-s", target, filePath]);
|
||||
await sudoSymlink(target, filePath);
|
||||
}
|
||||
|
||||
readPasswd(): Promise<PasswdEntry[]> {
|
||||
return sudoReadPasswd(this.path("/etc/passwd"));
|
||||
}
|
||||
async userAdd(user: string): Promise<PasswdEntry> {
|
||||
await execFile("sudo", [
|
||||
"useradd",
|
||||
|
|
@ -68,7 +84,7 @@ export class Alpine {
|
|||
this.dir,
|
||||
user,
|
||||
]);
|
||||
const passwd = await sudoReadPasswd(this.path("/etc/passwd"));
|
||||
const passwd = await this.readPasswd();
|
||||
const entry = passwd.find((e) => e.name === user);
|
||||
if (!entry) {
|
||||
throw new Error("fatal(userAdd): no encontré el usuario " + user);
|
||||
|
|
@ -98,27 +114,27 @@ export class Alpine {
|
|||
packages?: string[];
|
||||
}): Promise<Alpine> {
|
||||
const apkDir = path.join(dir, "/etc/apk");
|
||||
await mkdir(apkDir, { recursive: true });
|
||||
await sudoMkdirP(apkDir);
|
||||
|
||||
// hack
|
||||
{
|
||||
const cacheDir = path.join(cwd(), "cache");
|
||||
await mkdir("cache", { recursive: true });
|
||||
await symlink(cacheDir, path.join(apkDir, "cache"));
|
||||
await sudoSymlink(cacheDir, path.join(apkDir, "cache"));
|
||||
}
|
||||
|
||||
{
|
||||
const apkKeysDir = path.join(apkDir, "keys");
|
||||
const keysSrcDir = "alpine/keys";
|
||||
await mkdir(apkKeysDir);
|
||||
await sudoMkdirP(apkKeysDir);
|
||||
for await (const { name } of await opendir(keysSrcDir))
|
||||
await copyFile(
|
||||
await sudoCopy(
|
||||
path.join(keysSrcDir, name),
|
||||
path.join(apkKeysDir, name)
|
||||
);
|
||||
}
|
||||
|
||||
await writeFile(
|
||||
await sudoWriteFile(
|
||||
path.join(apkDir, "repositories"),
|
||||
[
|
||||
"https://dl-cdn.alpinelinux.org/alpine/v3.17/main",
|
||||
|
|
|
|||
|
|
@ -15,6 +15,9 @@ export async function sudoChownToRunningUser(path: string): Promise<void> {
|
|||
export async function sudoChmod(path: string, mod: string): Promise<void> {
|
||||
await execFile("sudo", ["chmod", mod, path]);
|
||||
}
|
||||
export async function sudoSymlink(target: string, path: string): Promise<void> {
|
||||
await execFile("sudo", ["ln", "-s", target, path]);
|
||||
}
|
||||
export async function sudoRm(path: string): Promise<void> {
|
||||
await execFile("sudo", ["rm", path]);
|
||||
}
|
||||
|
|
|
|||
11
index.ts
11
index.ts
|
|
@ -3,18 +3,21 @@ import { tmpdir } from "node:os";
|
|||
import path from "node:path";
|
||||
import { cwd, exit } from "node:process";
|
||||
import { Alpine } from "./alpine.js";
|
||||
import { setupForgejo } from "./services/forgejo/index.js";
|
||||
import { generateForgejoSecretsFile } from "./services/forgejo/secrets.js";
|
||||
import { generateGrafanaSecretsFile } from "./services/grafana/secrets.js";
|
||||
import { execFile } from "./helpers/better-api.js";
|
||||
import { sudoChownToRunningUser } from "./helpers/sudo.js";
|
||||
import { sudoChown, sudoChownToRunningUser } from "./helpers/sudo.js";
|
||||
import { setupKernel } from "./kernel.js";
|
||||
import { runQemu } from "./qemu.js";
|
||||
import { Runit } from "./runit/index.js";
|
||||
import { setupForgejo } from "./services/forgejo/index.js";
|
||||
import { setupDhcpcd } from "./services/dhcpcd.js";
|
||||
import { setupNtpsec } from "./services/ntpsec.js";
|
||||
import { setupGrafana } from "./services/grafana/index.js";
|
||||
|
||||
if (process.argv[2] === "generate-secrets") {
|
||||
await generateForgejoSecretsFile();
|
||||
await generateGrafanaSecretsFile();
|
||||
exit(0);
|
||||
}
|
||||
|
||||
|
|
@ -27,6 +30,7 @@ if (process.argv[2] === "generate-secrets") {
|
|||
await mkdir(kernelDir, { recursive: true });
|
||||
|
||||
const rootfsDir = await mkdtemp(path.join(tmpdir(), "define-alpine-"));
|
||||
await sudoChown(rootfsDir, "root:root");
|
||||
console.debug(rootfsDir);
|
||||
const alpine = await Alpine.makeWorld({ dir: rootfsDir });
|
||||
|
||||
|
|
@ -35,6 +39,7 @@ if (process.argv[2] === "generate-secrets") {
|
|||
await setupDhcpcd(alpine, runit);
|
||||
await setupNtpsec(alpine, runit);
|
||||
await setupForgejo(alpine, runit);
|
||||
await setupGrafana(alpine, runit);
|
||||
const kernel = await setupKernel(alpine, kernelDir);
|
||||
|
||||
const squashfs = path.join(artifactsDir, "image.squashfs");
|
||||
|
|
@ -42,6 +47,8 @@ if (process.argv[2] === "generate-secrets") {
|
|||
"mksquashfs",
|
||||
alpine.dir,
|
||||
squashfs,
|
||||
"-root-mode",
|
||||
"755",
|
||||
"-comp",
|
||||
"zstd",
|
||||
"-Xcompression-level",
|
||||
|
|
|
|||
15
kernel.ts
15
kernel.ts
|
|
@ -3,7 +3,7 @@ import { copyFile } from "node:fs/promises";
|
|||
import path from "node:path";
|
||||
import { Alpine } from "./alpine.js";
|
||||
import { canAccess } from "./helpers/better-api.js";
|
||||
import { sudoChownToRunningUser, sudoRm } from "./helpers/sudo.js";
|
||||
import { sudoChownToRunningUser, sudoCopy, sudoRm } from "./helpers/sudo.js";
|
||||
|
||||
export type Kind = "lts" | "virt";
|
||||
export type Kernel = {
|
||||
|
|
@ -71,21 +71,16 @@ default=lts
|
|||
const initramfs = path.join(alpine.dir, `/boot/initramfs-${kind}`);
|
||||
const vmlinuz = path.join(alpine.dir, `/boot/vmlinuz-${kind}`);
|
||||
|
||||
if (!(await canAccess(initramfs)))
|
||||
throw new Error("Didn't generate initramfs");
|
||||
else if (!(await canAccess(vmlinuz)))
|
||||
throw new Error("Didn't generate vmlinuz");
|
||||
|
||||
const kernel: Kernel = {
|
||||
kind,
|
||||
initramfs: path.join(output, "initramfs"),
|
||||
vmlinuz: path.join(output, "vmlinuz"),
|
||||
};
|
||||
|
||||
await sudoChownToRunningUser(initramfs);
|
||||
await sudoChownToRunningUser(vmlinuz);
|
||||
await copyFile(initramfs, kernel.initramfs, constants.COPYFILE_FICLONE);
|
||||
await copyFile(vmlinuz, kernel.vmlinuz, constants.COPYFILE_FICLONE);
|
||||
await sudoCopy(initramfs, kernel.initramfs);
|
||||
await sudoCopy(vmlinuz, kernel.vmlinuz);
|
||||
await sudoChownToRunningUser(kernel.initramfs);
|
||||
await sudoChownToRunningUser(kernel.vmlinuz);
|
||||
await sudoRm(initramfs);
|
||||
await sudoRm(vmlinuz);
|
||||
return kernel;
|
||||
|
|
|
|||
|
|
@ -5,9 +5,9 @@
|
|||
"description": "",
|
||||
"main": "index.js",
|
||||
"scripts": {
|
||||
"build": "esbuild --log-level=warning --target=node18 --sourcemap --outdir=build-javascript --outbase=. *.ts **/*.ts **/**/*.ts",
|
||||
"build": "esbuild --log-level=warning --target=node18 --platform=node --sourcemap --outdir=build-javascript --format=esm --bundle index.ts",
|
||||
"run": "pnpm build && node --enable-source-maps build-javascript/index.js",
|
||||
"test": "pnpm build && node --enable-source-maps build-javascript/**/*.test.js",
|
||||
"//test": "pnpm build && node --enable-source-maps build-javascript/**/*.test.js",
|
||||
"tsc:check": "tsc --noEmit"
|
||||
},
|
||||
"keywords": [],
|
||||
|
|
|
|||
166
pnpm-lock.yaml
166
pnpm-lock.yaml
|
|
@ -1,19 +1,23 @@
|
|||
lockfileVersion: 5.4
|
||||
|
||||
specifiers:
|
||||
'@types/node': ^18.11.18
|
||||
esbuild: ^0.17.0
|
||||
typescript: ^4.9.4
|
||||
'@types/node': ^18.13.0
|
||||
esbuild: ^0.17.7
|
||||
nanoid: ^4.0.1
|
||||
typescript: ^4.9.5
|
||||
|
||||
dependencies:
|
||||
nanoid: 4.0.1
|
||||
|
||||
devDependencies:
|
||||
'@types/node': 18.11.18
|
||||
esbuild: 0.17.0
|
||||
typescript: 4.9.4
|
||||
'@types/node': 18.13.0
|
||||
esbuild: 0.17.7
|
||||
typescript: 4.9.5
|
||||
|
||||
packages:
|
||||
|
||||
/@esbuild/android-arm/0.17.0:
|
||||
resolution: {integrity: sha512-hlbX5ym1V5kIKvnwFhm6rhar7MNqfJrZyYTNfk6+WS1uQfQmszFgXeyPH2beP3lSCumZyqX0zMBfOqftOpZ7GA==}
|
||||
/@esbuild/android-arm/0.17.7:
|
||||
resolution: {integrity: sha512-Np6Lg8VUiuzHP5XvHU7zfSVPN4ILdiOhxA1GQ1uvCK2T2l3nI8igQV0c9FJx4hTkq8WGqhGEvn5UuRH8jMkExg==}
|
||||
engines: {node: '>=12'}
|
||||
cpu: [arm]
|
||||
os: [android]
|
||||
|
|
@ -21,8 +25,8 @@ packages:
|
|||
dev: true
|
||||
optional: true
|
||||
|
||||
/@esbuild/android-arm64/0.17.0:
|
||||
resolution: {integrity: sha512-77GVyD7ToESy/7+9eI8z62GGBdS/hsqsrpM+JA4kascky86wHbN29EEFpkVvxajPL7k6mbLJ5VBQABdj7n9FhQ==}
|
||||
/@esbuild/android-arm64/0.17.7:
|
||||
resolution: {integrity: sha512-fOUBZvcbtbQJIj2K/LMKcjULGfXLV9R4qjXFsi3UuqFhIRJHz0Fp6kFjsMFI6vLuPrfC5G9Dmh+3RZOrSKY2Lg==}
|
||||
engines: {node: '>=12'}
|
||||
cpu: [arm64]
|
||||
os: [android]
|
||||
|
|
@ -30,8 +34,8 @@ packages:
|
|||
dev: true
|
||||
optional: true
|
||||
|
||||
/@esbuild/android-x64/0.17.0:
|
||||
resolution: {integrity: sha512-TroxZdZhtAz0JyD0yahtjcbKuIXrBEAoAazaYSeR2e2tUtp9uXrcbpwFJF6oxxOiOOne6y7l4hx4YVnMW/tdFw==}
|
||||
/@esbuild/android-x64/0.17.7:
|
||||
resolution: {integrity: sha512-6YILpPvop1rPAvaO/n2iWQL45RyTVTR/1SK7P6Xi2fyu+hpEeX22fE2U2oJd1sfpovUJOWTRdugjddX6QCup3A==}
|
||||
engines: {node: '>=12'}
|
||||
cpu: [x64]
|
||||
os: [android]
|
||||
|
|
@ -39,8 +43,8 @@ packages:
|
|||
dev: true
|
||||
optional: true
|
||||
|
||||
/@esbuild/darwin-arm64/0.17.0:
|
||||
resolution: {integrity: sha512-wP/v4cgdWt1m8TS/WmbaBc3NZON10eCbm6XepdVc3zJuqruHCzCKcC9dTSTEk50zX04REcRcbIbdhTMciQoFIg==}
|
||||
/@esbuild/darwin-arm64/0.17.7:
|
||||
resolution: {integrity: sha512-7i0gfFsDt1BBiurZz5oZIpzfxqy5QkJmhXdtrf2Hma/gI9vL2AqxHhRBoI1NeWc9IhN1qOzWZrslhiXZweMSFg==}
|
||||
engines: {node: '>=12'}
|
||||
cpu: [arm64]
|
||||
os: [darwin]
|
||||
|
|
@ -48,8 +52,8 @@ packages:
|
|||
dev: true
|
||||
optional: true
|
||||
|
||||
/@esbuild/darwin-x64/0.17.0:
|
||||
resolution: {integrity: sha512-R4WB6D6V9KGO/3LVTT8UlwRJO26IBFatOdo/bRXksfJR0vyOi2/lgmAAMBSpgcnnwvts9QsWiyM++mTTlwRseA==}
|
||||
/@esbuild/darwin-x64/0.17.7:
|
||||
resolution: {integrity: sha512-hRvIu3vuVIcv4SJXEKOHVsNssM5tLE2xWdb9ZyJqsgYp+onRa5El3VJ4+WjTbkf/A2FD5wuMIbO2FCTV39LE0w==}
|
||||
engines: {node: '>=12'}
|
||||
cpu: [x64]
|
||||
os: [darwin]
|
||||
|
|
@ -57,8 +61,8 @@ packages:
|
|||
dev: true
|
||||
optional: true
|
||||
|
||||
/@esbuild/freebsd-arm64/0.17.0:
|
||||
resolution: {integrity: sha512-FO7+UEZv79gen2df8StFYFHZPI9ADozpFepLZCxY+O8sYLDa1rirvenmLwJiOHmeQRJ5orYedFeLk1PFlZ6t8Q==}
|
||||
/@esbuild/freebsd-arm64/0.17.7:
|
||||
resolution: {integrity: sha512-2NJjeQ9kiabJkVXLM3sHkySqkL1KY8BeyLams3ITyiLW10IwDL0msU5Lq1cULCn9zNxt1Seh1I6QrqyHUvOtQw==}
|
||||
engines: {node: '>=12'}
|
||||
cpu: [arm64]
|
||||
os: [freebsd]
|
||||
|
|
@ -66,8 +70,8 @@ packages:
|
|||
dev: true
|
||||
optional: true
|
||||
|
||||
/@esbuild/freebsd-x64/0.17.0:
|
||||
resolution: {integrity: sha512-qCsNRsVTaC3ekwZcb2sa7l1gwCtJK3EqCWyDgpoQocYf3lRpbAzaCvqZSF2+NOO64cV+JbedXPsFiXU1aaVcIg==}
|
||||
/@esbuild/freebsd-x64/0.17.7:
|
||||
resolution: {integrity: sha512-8kSxlbjuLYMoIgvRxPybirHJeW45dflyIgHVs+jzMYJf87QOay1ZUTzKjNL3vqHQjmkSn8p6KDfHVrztn7Rprw==}
|
||||
engines: {node: '>=12'}
|
||||
cpu: [x64]
|
||||
os: [freebsd]
|
||||
|
|
@ -75,8 +79,8 @@ packages:
|
|||
dev: true
|
||||
optional: true
|
||||
|
||||
/@esbuild/linux-arm/0.17.0:
|
||||
resolution: {integrity: sha512-Y2G2NU6155gcfNKvrakVmZV5xUAEhXjsN/uKtbKKRnvee0mHUuaT3OdQJDJKjHVGr6B0898pc3slRpI1PqspoQ==}
|
||||
/@esbuild/linux-arm/0.17.7:
|
||||
resolution: {integrity: sha512-07RsAAzznWqdfJC+h3L2UVWwnUHepsFw5GmzySnUspHHb7glJ1+47rvlcH0SeUtoVOs8hF4/THgZbtJRyALaJA==}
|
||||
engines: {node: '>=12'}
|
||||
cpu: [arm]
|
||||
os: [linux]
|
||||
|
|
@ -84,8 +88,8 @@ packages:
|
|||
dev: true
|
||||
optional: true
|
||||
|
||||
/@esbuild/linux-arm64/0.17.0:
|
||||
resolution: {integrity: sha512-js4Vlch5XJQYISbDVJd2hsI/MsfVUz6d/FrclCE73WkQmniH37vFpuQI42ntWAeBghDIfaPZ6f9GilhwGzVFUg==}
|
||||
/@esbuild/linux-arm64/0.17.7:
|
||||
resolution: {integrity: sha512-43Bbhq3Ia/mGFTCRA4NlY8VRH3dLQltJ4cqzhSfq+cdvdm9nKJXVh4NUkJvdZgEZIkf/ufeMmJ0/22v9btXTcw==}
|
||||
engines: {node: '>=12'}
|
||||
cpu: [arm64]
|
||||
os: [linux]
|
||||
|
|
@ -93,8 +97,8 @@ packages:
|
|||
dev: true
|
||||
optional: true
|
||||
|
||||
/@esbuild/linux-ia32/0.17.0:
|
||||
resolution: {integrity: sha512-7tl/jSPkF59R3zeFDB2/09zLGhcM7DM+tCoOqjJbQjuL6qbMWomGT2RglCqRFpCSdzBx0hukmPPgUAMlmdj0sQ==}
|
||||
/@esbuild/linux-ia32/0.17.7:
|
||||
resolution: {integrity: sha512-ViYkfcfnbwOoTS7xE4DvYFv7QOlW8kPBuccc4erJ0jx2mXDPR7e0lYOH9JelotS9qe8uJ0s2i3UjUvjunEp53A==}
|
||||
engines: {node: '>=12'}
|
||||
cpu: [ia32]
|
||||
os: [linux]
|
||||
|
|
@ -102,8 +106,8 @@ packages:
|
|||
dev: true
|
||||
optional: true
|
||||
|
||||
/@esbuild/linux-loong64/0.17.0:
|
||||
resolution: {integrity: sha512-OG356F7dIVVF+EXJx5UfzFr1I5l6ES53GlMNSr3U1MhlaVyrP9um5PnrSJ+7TSDAzUC7YGjxb2GQWqHLd5XFoA==}
|
||||
/@esbuild/linux-loong64/0.17.7:
|
||||
resolution: {integrity: sha512-H1g+AwwcqYQ/Hl/sMcopRcNLY/fysIb/ksDfCa3/kOaHQNhBrLeDYw+88VAFV5U6oJL9GqnmUj72m9Nv3th3hA==}
|
||||
engines: {node: '>=12'}
|
||||
cpu: [loong64]
|
||||
os: [linux]
|
||||
|
|
@ -111,8 +115,8 @@ packages:
|
|||
dev: true
|
||||
optional: true
|
||||
|
||||
/@esbuild/linux-mips64el/0.17.0:
|
||||
resolution: {integrity: sha512-LWQJgGpxrjh2x08UYf6G5R+Km7zhkpCvKXtFQ6SX0fimDvy1C8kslgFHGxLS0wjGV8C4BNnENW/HNy57+RB7iA==}
|
||||
/@esbuild/linux-mips64el/0.17.7:
|
||||
resolution: {integrity: sha512-MDLGrVbTGYtmldlbcxfeDPdhxttUmWoX3ovk9u6jc8iM+ueBAFlaXKuUMCoyP/zfOJb+KElB61eSdBPSvNcCEg==}
|
||||
engines: {node: '>=12'}
|
||||
cpu: [mips64el]
|
||||
os: [linux]
|
||||
|
|
@ -120,8 +124,8 @@ packages:
|
|||
dev: true
|
||||
optional: true
|
||||
|
||||
/@esbuild/linux-ppc64/0.17.0:
|
||||
resolution: {integrity: sha512-f40N8fKiTQslUcUuhof2/syOQ+DC9Mqdnm9d063pew+Ptv9r6dBNLQCz4300MOfCLAbb0SdnrcMSzHbMehXWLw==}
|
||||
/@esbuild/linux-ppc64/0.17.7:
|
||||
resolution: {integrity: sha512-UWtLhRPKzI+v2bKk4j9rBpGyXbLAXLCOeqt1tLVAt1mfagHpFjUzzIHCpPiUfY3x1xY5e45/+BWzGpqqvSglNw==}
|
||||
engines: {node: '>=12'}
|
||||
cpu: [ppc64]
|
||||
os: [linux]
|
||||
|
|
@ -129,8 +133,8 @@ packages:
|
|||
dev: true
|
||||
optional: true
|
||||
|
||||
/@esbuild/linux-riscv64/0.17.0:
|
||||
resolution: {integrity: sha512-sc/pvLexRvxgEbmeq7LfLGnzUBFi/E2MGbnQj3CG8tnQ90tWPTi+9CbZEgIADhj6CAlCCmqxpUclIV1CRVUOTw==}
|
||||
/@esbuild/linux-riscv64/0.17.7:
|
||||
resolution: {integrity: sha512-3C/RTKqZauUwBYtIQAv7ELTJd+H2dNKPyzwE2ZTbz2RNrNhNHRoeKnG5C++eM6nSZWUCLyyaWfq1v1YRwBS/+A==}
|
||||
engines: {node: '>=12'}
|
||||
cpu: [riscv64]
|
||||
os: [linux]
|
||||
|
|
@ -138,8 +142,8 @@ packages:
|
|||
dev: true
|
||||
optional: true
|
||||
|
||||
/@esbuild/linux-s390x/0.17.0:
|
||||
resolution: {integrity: sha512-7xq9/kY0vunCL2vjHKdHGI+660pCdeEC6K6TWBVvbTGXvT8s/qacfxMgr8PCeQRbNUZLOA13G6/G1+c0lYXO1A==}
|
||||
/@esbuild/linux-s390x/0.17.7:
|
||||
resolution: {integrity: sha512-x7cuRSCm998KFZqGEtSo8rI5hXLxWji4znZkBhg2FPF8A8lxLLCsSXe2P5utf0RBQflb3K97dkEH/BJwTqrbDw==}
|
||||
engines: {node: '>=12'}
|
||||
cpu: [s390x]
|
||||
os: [linux]
|
||||
|
|
@ -147,8 +151,8 @@ packages:
|
|||
dev: true
|
||||
optional: true
|
||||
|
||||
/@esbuild/linux-x64/0.17.0:
|
||||
resolution: {integrity: sha512-o7FhBLONk1mLT2ytlj/j/WuJcPdhWcVpysSJn1s9+zRdLwLKveipbPi5SIasJIqMq0T4CkQW76pxJYMqz9HrQA==}
|
||||
/@esbuild/linux-x64/0.17.7:
|
||||
resolution: {integrity: sha512-1Z2BtWgM0Wc92WWiZR5kZ5eC+IetI++X+nf9NMbUvVymt74fnQqwgM5btlTW7P5uCHfq03u5MWHjIZa4o+TnXQ==}
|
||||
engines: {node: '>=12'}
|
||||
cpu: [x64]
|
||||
os: [linux]
|
||||
|
|
@ -156,8 +160,8 @@ packages:
|
|||
dev: true
|
||||
optional: true
|
||||
|
||||
/@esbuild/netbsd-x64/0.17.0:
|
||||
resolution: {integrity: sha512-V6xXsv71b8vwFCW/ky82Rs//SbyA+ORty6A7Mzkg33/4NbYZ/1Vcbk7qAN5oi0i/gS4Q0+7dYT7NqaiVZ7+Xjw==}
|
||||
/@esbuild/netbsd-x64/0.17.7:
|
||||
resolution: {integrity: sha512-//VShPN4hgbmkDjYNCZermIhj8ORqoPNmAnwSPqPtBB0xOpHrXMlJhsqLNsgoBm0zi/5tmy//WyL6g81Uq2c6Q==}
|
||||
engines: {node: '>=12'}
|
||||
cpu: [x64]
|
||||
os: [netbsd]
|
||||
|
|
@ -165,8 +169,8 @@ packages:
|
|||
dev: true
|
||||
optional: true
|
||||
|
||||
/@esbuild/openbsd-x64/0.17.0:
|
||||
resolution: {integrity: sha512-StlQor6A0Y9SSDxraytr46Qbz25zsSDmsG3MCaNkBnABKHP3QsngOCfdBikqHVVrXeK0KOTmtX92/ncTGULYgQ==}
|
||||
/@esbuild/openbsd-x64/0.17.7:
|
||||
resolution: {integrity: sha512-IQ8BliXHiOsbQEOHzc7mVLIw2UYPpbOXJQ9cK1nClNYQjZthvfiA6rWZMz4BZpVzHZJ+/H2H23cZwRJ1NPYOGg==}
|
||||
engines: {node: '>=12'}
|
||||
cpu: [x64]
|
||||
os: [openbsd]
|
||||
|
|
@ -174,8 +178,8 @@ packages:
|
|||
dev: true
|
||||
optional: true
|
||||
|
||||
/@esbuild/sunos-x64/0.17.0:
|
||||
resolution: {integrity: sha512-K64Wqw57j8KrwjR3QjsuzN/qDGK6Cno6QYtIlWAmGab5iYPBZCWz7HFtF2a86/130LmUsdXqOID7J0SmjjRFIQ==}
|
||||
/@esbuild/sunos-x64/0.17.7:
|
||||
resolution: {integrity: sha512-phO5HvU3SyURmcW6dfQXX4UEkFREUwaoiTgi1xH+CAFKPGsrcG6oDp1U70yQf5lxRKujoSCEIoBr0uFykJzN2g==}
|
||||
engines: {node: '>=12'}
|
||||
cpu: [x64]
|
||||
os: [sunos]
|
||||
|
|
@ -183,8 +187,8 @@ packages:
|
|||
dev: true
|
||||
optional: true
|
||||
|
||||
/@esbuild/win32-arm64/0.17.0:
|
||||
resolution: {integrity: sha512-hly6iSWAf0hf3aHD18/qW7iFQbg9KAQ0RFGG9plcxkhL4uGw43O+lETGcSO/PylNleFowP/UztpF6U4oCYgpPw==}
|
||||
/@esbuild/win32-arm64/0.17.7:
|
||||
resolution: {integrity: sha512-G/cRKlYrwp1B0uvzEdnFPJ3A6zSWjnsRrWivsEW0IEHZk+czv0Bmiwa51RncruHLjQ4fGsvlYPmCmwzmutPzHA==}
|
||||
engines: {node: '>=12'}
|
||||
cpu: [arm64]
|
||||
os: [win32]
|
||||
|
|
@ -192,8 +196,8 @@ packages:
|
|||
dev: true
|
||||
optional: true
|
||||
|
||||
/@esbuild/win32-ia32/0.17.0:
|
||||
resolution: {integrity: sha512-aL4EWPh0nyC5uYRfn+CHkTgawd4DjtmwquthNDmGf6Ht6+mUc+bQXyZNH1QIw8x20hSqFc4Tf36aLLWP/TPR3g==}
|
||||
/@esbuild/win32-ia32/0.17.7:
|
||||
resolution: {integrity: sha512-/yMNVlMew07NrOflJdRAZcMdUoYTOCPbCHx0eHtg55l87wXeuhvYOPBQy5HLX31Ku+W2XsBD5HnjUjEUsTXJug==}
|
||||
engines: {node: '>=12'}
|
||||
cpu: [ia32]
|
||||
os: [win32]
|
||||
|
|
@ -201,8 +205,8 @@ packages:
|
|||
dev: true
|
||||
optional: true
|
||||
|
||||
/@esbuild/win32-x64/0.17.0:
|
||||
resolution: {integrity: sha512-W6IIQ9Rt43I/GqfXeBFLk0TvowKBoirs9sw2LPfhHax6ayMlW5PhFzSJ76I1ac9Pk/aRcSMrHWvVyZs8ZPK2wA==}
|
||||
/@esbuild/win32-x64/0.17.7:
|
||||
resolution: {integrity: sha512-K9/YybM6WZO71x73Iyab6mwieHtHjm9hrPR/a9FBPZmFO3w+fJaM2uu2rt3JYf/rZR24MFwTliI8VSoKKOtYtg==}
|
||||
engines: {node: '>=12'}
|
||||
cpu: [x64]
|
||||
os: [win32]
|
||||
|
|
@ -210,42 +214,48 @@ packages:
|
|||
dev: true
|
||||
optional: true
|
||||
|
||||
/@types/node/18.11.18:
|
||||
resolution: {integrity: sha512-DHQpWGjyQKSHj3ebjFI/wRKcqQcdR+MoFBygntYOZytCqNfkd2ZC4ARDJ2DQqhjH5p85Nnd3jhUJIXrszFX/JA==}
|
||||
/@types/node/18.13.0:
|
||||
resolution: {integrity: sha512-gC3TazRzGoOnoKAhUx+Q0t8S9Tzs74z7m0ipwGpSqQrleP14hKxP4/JUeEQcD3W1/aIpnWl8pHowI7WokuZpXg==}
|
||||
dev: true
|
||||
|
||||
/esbuild/0.17.0:
|
||||
resolution: {integrity: sha512-4yGk3rD95iS/wGzrx0Ji5czZcx1j2wvfF1iAJaX2FIYLB6sU6wYkDeplpZHzfwQw2yXGXsAoxmO6LnMQkl04Kg==}
|
||||
/esbuild/0.17.7:
|
||||
resolution: {integrity: sha512-+5hHlrK108fT6C6/40juy0w4DYKtyZ5NjfBlTccBdsFutR7WBxpIY633JzZJewdsCy8xWA/u2z0MSniIJwufYg==}
|
||||
engines: {node: '>=12'}
|
||||
hasBin: true
|
||||
requiresBuild: true
|
||||
optionalDependencies:
|
||||
'@esbuild/android-arm': 0.17.0
|
||||
'@esbuild/android-arm64': 0.17.0
|
||||
'@esbuild/android-x64': 0.17.0
|
||||
'@esbuild/darwin-arm64': 0.17.0
|
||||
'@esbuild/darwin-x64': 0.17.0
|
||||
'@esbuild/freebsd-arm64': 0.17.0
|
||||
'@esbuild/freebsd-x64': 0.17.0
|
||||
'@esbuild/linux-arm': 0.17.0
|
||||
'@esbuild/linux-arm64': 0.17.0
|
||||
'@esbuild/linux-ia32': 0.17.0
|
||||
'@esbuild/linux-loong64': 0.17.0
|
||||
'@esbuild/linux-mips64el': 0.17.0
|
||||
'@esbuild/linux-ppc64': 0.17.0
|
||||
'@esbuild/linux-riscv64': 0.17.0
|
||||
'@esbuild/linux-s390x': 0.17.0
|
||||
'@esbuild/linux-x64': 0.17.0
|
||||
'@esbuild/netbsd-x64': 0.17.0
|
||||
'@esbuild/openbsd-x64': 0.17.0
|
||||
'@esbuild/sunos-x64': 0.17.0
|
||||
'@esbuild/win32-arm64': 0.17.0
|
||||
'@esbuild/win32-ia32': 0.17.0
|
||||
'@esbuild/win32-x64': 0.17.0
|
||||
'@esbuild/android-arm': 0.17.7
|
||||
'@esbuild/android-arm64': 0.17.7
|
||||
'@esbuild/android-x64': 0.17.7
|
||||
'@esbuild/darwin-arm64': 0.17.7
|
||||
'@esbuild/darwin-x64': 0.17.7
|
||||
'@esbuild/freebsd-arm64': 0.17.7
|
||||
'@esbuild/freebsd-x64': 0.17.7
|
||||
'@esbuild/linux-arm': 0.17.7
|
||||
'@esbuild/linux-arm64': 0.17.7
|
||||
'@esbuild/linux-ia32': 0.17.7
|
||||
'@esbuild/linux-loong64': 0.17.7
|
||||
'@esbuild/linux-mips64el': 0.17.7
|
||||
'@esbuild/linux-ppc64': 0.17.7
|
||||
'@esbuild/linux-riscv64': 0.17.7
|
||||
'@esbuild/linux-s390x': 0.17.7
|
||||
'@esbuild/linux-x64': 0.17.7
|
||||
'@esbuild/netbsd-x64': 0.17.7
|
||||
'@esbuild/openbsd-x64': 0.17.7
|
||||
'@esbuild/sunos-x64': 0.17.7
|
||||
'@esbuild/win32-arm64': 0.17.7
|
||||
'@esbuild/win32-ia32': 0.17.7
|
||||
'@esbuild/win32-x64': 0.17.7
|
||||
dev: true
|
||||
|
||||
/typescript/4.9.4:
|
||||
resolution: {integrity: sha512-Uz+dTXYzxXXbsFpM86Wh3dKCxrQqUcVMxwU54orwlJjOpO3ao8L7j5lH+dWfTwgCwIuM9GQ2kvVotzYJMXTBZg==}
|
||||
/nanoid/4.0.1:
|
||||
resolution: {integrity: sha512-udKGtCCUafD3nQtJg9wBhRP3KMbPglUsgV5JVsXhvyBs/oefqb4sqMEhKBBgqZncYowu58p1prsZQBYvAj/Gww==}
|
||||
engines: {node: ^14 || ^16 || >=18}
|
||||
hasBin: true
|
||||
dev: false
|
||||
|
||||
/typescript/4.9.5:
|
||||
resolution: {integrity: sha512-1FXk9E2Hm+QzZQ7z+McJiHL4NW1F2EzMu9Nq9i3zAaGqibafqYwCVU6WyWAuyQRRzOlxou8xZSyXLEN8oKj24g==}
|
||||
engines: {node: '>=4.2.0'}
|
||||
hasBin: true
|
||||
dev: true
|
||||
|
|
|
|||
|
|
@ -13,7 +13,7 @@ export class Runit {
|
|||
}
|
||||
|
||||
static async setup(alpine: Alpine): Promise<Runit> {
|
||||
await alpine.mkdir("/etc/runit/runsvdir/default", { recursive: true });
|
||||
await alpine.mkdirP("/etc/runit/runsvdir/default");
|
||||
await alpine.symlink(
|
||||
"/etc/runit/runsvdir/default",
|
||||
"/etc/runit/runsvdir/current"
|
||||
|
|
@ -111,17 +111,17 @@ exec chpst -P getty 38400 ttyS0 linux`,
|
|||
`#!/bin/sh
|
||||
exec logger -p daemon.info -t '${name}'`
|
||||
);
|
||||
await this.alpine.sudoSymlink(
|
||||
await this.alpine.symlink(
|
||||
`/run/runit/supervise.${name}.log`,
|
||||
path.join("/etc/sv/", name, "/log/supervise")
|
||||
);
|
||||
}
|
||||
// Activar servicio
|
||||
await this.alpine.sudoSymlink(
|
||||
await this.alpine.symlink(
|
||||
path.join("/etc/sv/", name),
|
||||
path.join("/etc/runit/runsvdir/default/", name)
|
||||
);
|
||||
await this.alpine.sudoSymlink(
|
||||
await this.alpine.symlink(
|
||||
`/run/runit/supervise.${name}`,
|
||||
path.join("/etc/sv/", name, "/supervise")
|
||||
);
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@ import { Runit } from "../../runit/index.js";
|
|||
import { writeFile } from "node:fs/promises";
|
||||
import { join } from "node:path";
|
||||
import { loadForgejoSecretsFile } from "./secrets.js";
|
||||
import { sudoChown, sudoCopy } from "../../helpers/sudo.js";
|
||||
import { sudoChown, sudoCopy, sudoWriteFile } from "../../helpers/sudo.js";
|
||||
|
||||
export async function setupForgejo(alpine: Alpine, runit: Runit) {
|
||||
const bin = await buildForgejo();
|
||||
|
|
@ -21,7 +21,7 @@ export async function setupForgejo(alpine: Alpine, runit: Runit) {
|
|||
|
||||
const secrets = await loadForgejoSecretsFile();
|
||||
const configPath = join(alpine.dir, "/etc/forgejo.conf");
|
||||
await writeFile(
|
||||
await sudoWriteFile(
|
||||
configPath,
|
||||
`
|
||||
; see https://docs.gitea.io/en-us/config-cheat-sheet/ for additional documentation.
|
||||
|
|
|
|||
516
services/grafana/index.ts
Normal file
516
services/grafana/index.ts
Normal file
|
|
@ -0,0 +1,516 @@
|
|||
import assert from "node:assert";
|
||||
import { Alpine } from "../../alpine.js";
|
||||
import { Runit } from "../../runit/index.js";
|
||||
import { loadGrafanaSecretsFile } from "./secrets.js";
|
||||
|
||||
// TODO: grafana-image-renderer?
|
||||
// /etc/conf.d/grafana
|
||||
// # To enable image rendering run
|
||||
// # $ apk add grafana-image-renderer
|
||||
// # $ /etc/init.d/grafana-image-renderer start
|
||||
// # and configure /etc/grafana.ini to use it
|
||||
// #[rendering]
|
||||
// #server_url = http://127.0.0.1:3001/render
|
||||
// #callback_url = http://127.0.0.1:3000/
|
||||
|
||||
export async function setupGrafana(
|
||||
alpine: Alpine,
|
||||
runit: Runit
|
||||
): Promise<void> {
|
||||
await alpine.addPackages(["grafana"]);
|
||||
|
||||
const passwd = await alpine.readPasswd();
|
||||
const user = passwd.find((e) => e.name === "grafana");
|
||||
assert(!!user, "no existe el usuario grafana");
|
||||
|
||||
// TODO: data
|
||||
await alpine.fstab.addTmpfs("/var/lib/grafana", {
|
||||
uid: user.uid,
|
||||
gid: user.gid,
|
||||
mode: "700",
|
||||
});
|
||||
await alpine.writeFile("/etc/grafana.ini", await genConfig(), user);
|
||||
|
||||
await alpine.sudoWriteExecutable(
|
||||
"/usr/local/sbin/nulo-grafana-cli",
|
||||
`#!/bin/sh
|
||||
cd /
|
||||
exec chpst -u grafana:grafana grafana-cli --homepath /usr/share/grafana --config /etc/grafana.ini "$@"`
|
||||
);
|
||||
|
||||
await runit.addService(
|
||||
"grafana",
|
||||
`#!/bin/sh
|
||||
export GRAFANA_HOME=/var/lib/grafana
|
||||
|
||||
cd "$GRAFANA_HOME"
|
||||
|
||||
install -o grafana -m755 -d \
|
||||
$GRAFANA_HOME/provisioning \
|
||||
$GRAFANA_HOME/provisioning/dashboards \
|
||||
$GRAFANA_HOME/provisioning/datasources \
|
||||
$GRAFANA_HOME/provisioning/notifiers \
|
||||
$GRAFANA_HOME/provisioning/alerting \
|
||||
$GRAFANA_HOME/provisioning/plugins
|
||||
|
||||
exec chpst -u grafana:grafana grafana-server -config /etc/grafana.ini -homepath /usr/share/grafana \
|
||||
cfg:paths.provisioning="$GRAFANA_HOME"/provisioning
|
||||
`
|
||||
);
|
||||
}
|
||||
|
||||
async function genConfig(): Promise<string> {
|
||||
const secrets = await loadGrafanaSecretsFile();
|
||||
return `
|
||||
;app_mode = production
|
||||
;instance_name = \${HOSTNAME}
|
||||
|
||||
# force migration will run migrations that might cause dataloss
|
||||
;force_migration = false
|
||||
|
||||
#################################### Paths ####################################
|
||||
[paths]
|
||||
data = /var/lib/grafana
|
||||
|
||||
# Temporary files in \`data\` directory older than given duration will be removed
|
||||
;temp_data_lifetime = 24h
|
||||
|
||||
# Directory where grafana can store logs
|
||||
;logs = /var/log/grafana
|
||||
|
||||
plugins = /var/lib/grafana/plugins
|
||||
|
||||
# folder that contains provisioning config files that grafana will apply on startup and while running.
|
||||
;provisioning = conf/provisioning
|
||||
|
||||
#################################### Server ####################################
|
||||
[server]
|
||||
# Protocol (http, https, h2, socket)
|
||||
;protocol = http
|
||||
http_addr = 127.0.0.1
|
||||
http_port = 3050
|
||||
|
||||
# The public facing domain name used to access grafana from a browser
|
||||
;domain = localhost
|
||||
|
||||
# Redirect to correct domain if host header does not match domain
|
||||
# Prevents DNS rebinding attacks
|
||||
;enforce_domain = false
|
||||
|
||||
# The full public facing url you use in browser, used for redirects and emails
|
||||
# If you use reverse proxy and sub path specify full url (with sub path)
|
||||
;root_url = %(protocol)s://%(domain)s:%(http_port)s/
|
||||
|
||||
# the path relative working path
|
||||
;static_root_path = public
|
||||
|
||||
;socket =
|
||||
|
||||
# Sets the maximum time using a duration format (5s/5m/5ms) before timing out read of an incoming request and closing idle connections.
|
||||
# 0 means there is no timeout for reading the request.
|
||||
;read_timeout = 0
|
||||
|
||||
#################################### Database ####################################
|
||||
[database]
|
||||
;type = sqlite3
|
||||
;name = grafana
|
||||
;path = grafana.db
|
||||
|
||||
# For "sqlite3" only. cache mode setting used for connecting to the database. (private, shared)
|
||||
;cache_mode = private
|
||||
|
||||
#################################### Data proxy ###########################
|
||||
[dataproxy]
|
||||
|
||||
# This enables data proxy logging, default is false
|
||||
;logging = false
|
||||
|
||||
# How long the data proxy waits to read the headers of the response before timing out, default is 30 seconds.
|
||||
# This setting also applies to core backend HTTP data sources where query requests use an HTTP client with timeout set.
|
||||
;timeout = 30
|
||||
|
||||
# How long the data proxy waits to establish a TCP connection before timing out, default is 10 seconds.
|
||||
;dialTimeout = 10
|
||||
|
||||
# How many seconds the data proxy waits before sending a keepalive probe request.
|
||||
;keep_alive_seconds = 30
|
||||
|
||||
# How many seconds the data proxy waits for a successful TLS Handshake before timing out.
|
||||
;tls_handshake_timeout_seconds = 10
|
||||
|
||||
# How many seconds the data proxy will wait for a server's first response headers after
|
||||
# fully writing the request headers if the request has an "Expect: 100-continue"
|
||||
# header. A value of 0 will result in the body being sent immediately, without
|
||||
# waiting for the server to approve.
|
||||
;expect_continue_timeout_seconds = 1
|
||||
|
||||
# Optionally limits the total number of connections per host, including connections in the dialing,
|
||||
# active, and idle states. On limit violation, dials will block.
|
||||
# A value of zero (0) means no limit.
|
||||
;max_conns_per_host = 0
|
||||
|
||||
# The maximum number of idle connections that Grafana will keep alive.
|
||||
;max_idle_connections = 100
|
||||
|
||||
# How many seconds the data proxy keeps an idle connection open before timing out.
|
||||
;idle_conn_timeout_seconds = 90
|
||||
|
||||
# If enabled and user is not anonymous, data proxy will add X-Grafana-User header with username into the request, default is false.
|
||||
;send_user_header = false
|
||||
|
||||
# Limit the amount of bytes that will be read/accepted from responses of outgoing HTTP requests.
|
||||
;response_limit = 0
|
||||
|
||||
# Limits the number of rows that Grafana will process from SQL data sources.
|
||||
;row_limit = 1000000
|
||||
|
||||
#################################### Analytics ####################################
|
||||
[analytics]
|
||||
;reporting_enabled = true
|
||||
;reporting_distributor = grafana-labs
|
||||
;check_for_updates = true
|
||||
;check_for_plugin_updates = true
|
||||
# Controls if the UI contains any links to user feedback forms
|
||||
;feedback_links_enabled = true
|
||||
|
||||
#################################### Security ####################################
|
||||
[security]
|
||||
disable_initial_admin_creation = false
|
||||
admin_user = admin
|
||||
admin_password = ${secrets.defaultAdminPassword}
|
||||
|
||||
disable_gravatar = true
|
||||
|
||||
# set to true if you host Grafana behind HTTPS. default is false.
|
||||
;cookie_secure = false
|
||||
|
||||
# Enable adding the Content-Security-Policy header to your requests.
|
||||
# CSP allows to control resources the user agent is allowed to load and helps prevent XSS attacks.
|
||||
content_security_policy = true
|
||||
|
||||
# Set Content Security Policy template used when adding the Content-Security-Policy header to your requests.
|
||||
# $NONCE in the template includes a random nonce.
|
||||
# $ROOT_PATH is server.root_url without the protocol.
|
||||
;content_security_policy_template = """script-src 'self' 'unsafe-eval' 'unsafe-inline' 'strict-dynamic' $NONCE;object-src 'none';font-src 'self';style-src 'self' 'unsafe-inline' blob:;img-src * data:;base-uri 'self';connect-src 'self' grafana.com ws://$ROOT_PATH wss://$ROOT_PATH;manifest-src 'self';media-src 'none';form-action 'self';"""
|
||||
|
||||
#################################### Snapshots ###########################
|
||||
[snapshots]
|
||||
# snapshot sharing options
|
||||
;external_enabled = true
|
||||
;external_snapshot_url = https://snapshots.raintank.io
|
||||
;external_snapshot_name = Publish to snapshots.raintank.io
|
||||
|
||||
# Set to true to enable this Grafana instance act as an external snapshot server and allow unauthenticated requests for
|
||||
# creating and deleting snapshots.
|
||||
;public_mode = false
|
||||
|
||||
# remove expired snapshot
|
||||
;snapshot_remove_expired = true
|
||||
|
||||
#################################### Users ###############################
|
||||
[users]
|
||||
allow_sign_up = false
|
||||
|
||||
default_locale = es-AR
|
||||
|
||||
# Path to a custom home page. Users are only redirected to this if the default home dashboard is used. It should match a frontend route and contain a leading slash.
|
||||
;home_page =
|
||||
|
||||
# External user management, these options affect the organization users view
|
||||
;external_manage_link_url =
|
||||
;external_manage_link_name =
|
||||
;external_manage_info =
|
||||
|
||||
# Viewers can edit/inspect dashboard settings in the browser. But not save the dashboard.
|
||||
;viewers_can_edit = false
|
||||
|
||||
# Editors can administrate dashboard, folders and teams they create
|
||||
;editors_can_admin = false
|
||||
|
||||
# The duration in time a user invitation remains valid before expiring. This setting should be expressed as a duration. Examples: 6h (hours), 2d (days), 1w (week). Default is 24h (24 hours). The minimum supported duration is 15m (15 minutes).
|
||||
;user_invite_max_lifetime_duration = 24h
|
||||
|
||||
# Enter a comma-separated list of users login to hide them in the Grafana UI. These users are shown to Grafana admins and themselves.
|
||||
; hidden_users =
|
||||
|
||||
#################################### Basic Auth ##########################
|
||||
[auth.basic]
|
||||
;enabled = true
|
||||
|
||||
#################################### SMTP / Emailing ##########################
|
||||
# TODO: smtp
|
||||
[smtp]
|
||||
;enabled = false
|
||||
;host = localhost:25
|
||||
;user =
|
||||
# If the password contains # or ; you have to wrap it with triple quotes. Ex """#password;"""
|
||||
;password =
|
||||
;cert_file =
|
||||
;key_file =
|
||||
;skip_verify = false
|
||||
;from_address = admin@grafana.localhost
|
||||
;from_name = Grafana
|
||||
# EHLO identity in SMTP dialog (defaults to instance_name)
|
||||
;ehlo_identity = dashboard.example.com
|
||||
# SMTP startTLS policy (defaults to 'OpportunisticStartTLS')
|
||||
;startTLS_policy = NoStartTLS
|
||||
|
||||
[emails]
|
||||
;welcome_email_on_sign_up = false
|
||||
;templates_pattern = emails/*.html, emails/*.txt
|
||||
;content_types = text/html
|
||||
|
||||
#################################### Logging ##########################
|
||||
[log]
|
||||
# TODO: syslog
|
||||
# Either "console", "file", "syslog". Default is console and file
|
||||
# Use space to separate multiple modes, e.g. "console file"
|
||||
mode = console file
|
||||
|
||||
# Either "debug", "info", "warn", "error", "critical", default is "info"
|
||||
;level = info
|
||||
|
||||
#################################### Unified Alerting ####################
|
||||
[unified_alerting]
|
||||
#Enable the Unified Alerting sub-system and interface. When enabled we'll migrate all of your alert rules and notification channels to the new system. New alert rules will be created and your notification channels will be converted into an Alertmanager configuration. Previous data is preserved to enable backwards compatibility but new data is removed.
|
||||
;enabled = true
|
||||
|
||||
# Specify the frequency of polling for admin config changes.
|
||||
# The interval string is a possibly signed sequence of decimal numbers, followed by a unit suffix (ms, s, m, h, d), e.g. 30s or 1m.
|
||||
;admin_config_poll_interval = 60s
|
||||
|
||||
# Specify the frequency of polling for Alertmanager config changes.
|
||||
# The interval string is a possibly signed sequence of decimal numbers, followed by a unit suffix (ms, s, m, h, d), e.g. 30s or 1m.
|
||||
;alertmanager_config_poll_interval = 60s
|
||||
|
||||
# Time to wait for an instance to send a notification via the Alertmanager. In HA, each Grafana instance will
|
||||
# be assigned a position (e.g. 0, 1). We then multiply this position with the timeout to indicate how long should
|
||||
# each instance wait before sending the notification to take into account replication lag.
|
||||
# The interval string is a possibly signed sequence of decimal numbers, followed by a unit suffix (ms, s, m, h, d), e.g. 30s or 1m.
|
||||
;ha_peer_timeout = "15s"
|
||||
|
||||
# The interval between sending gossip messages. By lowering this value (more frequent) gossip messages are propagated
|
||||
# across cluster more quickly at the expense of increased bandwidth usage.
|
||||
# The interval string is a possibly signed sequence of decimal numbers, followed by a unit suffix (ms, s, m, h, d), e.g. 30s or 1m.
|
||||
;ha_gossip_interval = "200ms"
|
||||
|
||||
# The interval between gossip full state syncs. Setting this interval lower (more frequent) will increase convergence speeds
|
||||
# across larger clusters at the expense of increased bandwidth usage.
|
||||
# The interval string is a possibly signed sequence of decimal numbers, followed by a unit suffix (ms, s, m, h, d), e.g. 30s or 1m.
|
||||
;ha_push_pull_interval = "60s"
|
||||
|
||||
# Enable or disable alerting rule execution. The alerting UI remains visible. This option has a legacy version in the [alerting] section that takes precedence.
|
||||
;execute_alerts = true
|
||||
|
||||
# Alert evaluation timeout when fetching data from the datasource. This option has a legacy version in the [alerting] section that takes precedence.
|
||||
# The timeout string is a possibly signed sequence of decimal numbers, followed by a unit suffix (ms, s, m, h, d), e.g. 30s or 1m.
|
||||
;evaluation_timeout = 30s
|
||||
|
||||
# Number of times we'll attempt to evaluate an alert rule before giving up on that evaluation. This option has a legacy version in the [alerting] section that takes precedence.
|
||||
;max_attempts = 3
|
||||
|
||||
# Minimum interval to enforce between rule evaluations. Rules will be adjusted if they are less than this value or if they are not multiple of the scheduler interval (10s). Higher values can help with resource management as we'll schedule fewer evaluations over time. This option has a legacy version in the [alerting] section that takes precedence.
|
||||
# The interval string is a possibly signed sequence of decimal numbers, followed by a unit suffix (ms, s, m, h, d), e.g. 30s or 1m.
|
||||
;min_interval = 10s
|
||||
|
||||
[unified_alerting.reserved_labels]
|
||||
# Comma-separated list of reserved labels added by the Grafana Alerting engine that should be disabled.
|
||||
# For example: disabled_labels=grafana_folder
|
||||
;disabled_labels =
|
||||
|
||||
#################################### Internal Grafana Metrics ##########################
|
||||
# Metrics available at HTTP URL /metrics and /metrics/plugins/:pluginId
|
||||
[metrics]
|
||||
# Disable / Enable internal metrics
|
||||
;enabled = true
|
||||
# Graphite Publish interval
|
||||
;interval_seconds = 10
|
||||
# Disable total stats (stat_totals_*) metrics to be generated
|
||||
;disable_total_stats = false
|
||||
|
||||
#If both are set, basic auth will be required for the metrics endpoints.
|
||||
; basic_auth_username =
|
||||
; basic_auth_password =
|
||||
|
||||
# Metrics environment info adds dimensions to the grafana_environment_info metric, which
|
||||
# can expose more information about the Grafana instance.
|
||||
[metrics.environment_info]
|
||||
#exampleLabel1 = exampleValue1
|
||||
#exampleLabel2 = exampleValue2
|
||||
|
||||
# Send internal metrics to Graphite
|
||||
[metrics.graphite]
|
||||
# Enable by setting the address setting (ex localhost:2003)
|
||||
;address =
|
||||
;prefix = prod.grafana.%(instance_name)s.
|
||||
|
||||
#################################### Distributed tracing ############
|
||||
# Opentracing is deprecated use opentelemetry instead
|
||||
[tracing.jaeger]
|
||||
# Enable by setting the address sending traces to jaeger (ex localhost:6831)
|
||||
;address = localhost:6831
|
||||
# Tag that will always be included in when creating new spans. ex (tag1:value1,tag2:value2)
|
||||
;always_included_tag = tag1:value1
|
||||
# Type specifies the type of the sampler: const, probabilistic, rateLimiting, or remote
|
||||
;sampler_type = const
|
||||
# jaeger samplerconfig param
|
||||
# for "const" sampler, 0 or 1 for always false/true respectively
|
||||
# for "probabilistic" sampler, a probability between 0 and 1
|
||||
# for "rateLimiting" sampler, the number of spans per second
|
||||
# for "remote" sampler, param is the same as for "probabilistic"
|
||||
# and indicates the initial sampling rate before the actual one
|
||||
# is received from the mothership
|
||||
;sampler_param = 1
|
||||
# sampling_server_url is the URL of a sampling manager providing a sampling strategy.
|
||||
;sampling_server_url =
|
||||
# Whether or not to use Zipkin propagation (x-b3- HTTP headers).
|
||||
;zipkin_propagation = false
|
||||
# Setting this to true disables shared RPC spans.
|
||||
# Not disabling is the most common setting when using Zipkin elsewhere in your infrastructure.
|
||||
;disable_shared_zipkin_spans = false
|
||||
|
||||
[tracing.opentelemetry]
|
||||
# attributes that will always be included in when creating new spans. ex (key1:value1,key2:value2)
|
||||
;custom_attributes = key1:value1,key2:value2
|
||||
|
||||
[tracing.opentelemetry.jaeger]
|
||||
# jaeger destination (ex http://localhost:14268/api/traces)
|
||||
; address = http://localhost:14268/api/traces
|
||||
# Propagation specifies the text map propagation format: w3c, jaeger
|
||||
; propagation = jaeger
|
||||
|
||||
# This is a configuration for OTLP exporter with GRPC protocol
|
||||
[tracing.opentelemetry.otlp]
|
||||
# otlp destination (ex localhost:4317)
|
||||
; address = localhost:4317
|
||||
# Propagation specifies the text map propagation format: w3c, jaeger
|
||||
; propagation = w3c
|
||||
|
||||
[rendering]
|
||||
# Options to configure a remote HTTP image rendering service, e.g. using https://github.com/grafana/grafana-image-renderer.
|
||||
# URL to a remote HTTP image renderer service, e.g. http://localhost:8081/render, will enable Grafana to render panels and dashboards to PNG-images using HTTP requests to an external service.
|
||||
;server_url =
|
||||
# If the remote HTTP image renderer service runs on a different server than the Grafana server you may have to configure this to a URL where Grafana is reachable, e.g. http://grafana.domain/.
|
||||
;callback_url =
|
||||
# An auth token that will be sent to and verified by the renderer. The renderer will deny any request without an auth token matching the one configured on the renderer side.
|
||||
;renderer_token = -
|
||||
# Concurrent render request limit affects when the /render HTTP endpoint is used. Rendering many images at the same time can overload the server,
|
||||
# which this setting can help protect against by only allowing a certain amount of concurrent requests.
|
||||
;concurrent_render_request_limit = 30
|
||||
|
||||
[panels]
|
||||
# If set to true Grafana will allow script tags in text panels. Not recommended as it enable XSS vulnerabilities.
|
||||
;disable_sanitize_html = false
|
||||
|
||||
[plugins]
|
||||
;enable_alpha = false
|
||||
;app_tls_skip_verify_insecure = false
|
||||
# Enter a comma-separated list of plugin identifiers to identify plugins to load even if they are unsigned. Plugins with modified signatures are never loaded.
|
||||
;allow_loading_unsigned_plugins =
|
||||
# Enable or disable installing / uninstalling / updating plugins directly from within Grafana.
|
||||
;plugin_admin_enabled = false
|
||||
;plugin_admin_external_manage_enabled = false
|
||||
;plugin_catalog_url = https://grafana.com/grafana/plugins/
|
||||
# Enter a comma-separated list of plugin identifiers to hide in the plugin catalog.
|
||||
;plugin_catalog_hidden_plugins =
|
||||
|
||||
#################################### Grafana Live ##########################################
|
||||
[live]
|
||||
# max_connections to Grafana Live WebSocket endpoint per Grafana server instance. See Grafana Live docs
|
||||
# if you are planning to make it higher than default 100 since this can require some OS and infrastructure
|
||||
# tuning. 0 disables Live, -1 means unlimited connections.
|
||||
;max_connections = 100
|
||||
|
||||
# allowed_origins is a comma-separated list of origins that can establish connection with Grafana Live.
|
||||
# If not set then origin will be matched over root_url. Supports wildcard symbol "*".
|
||||
;allowed_origins =
|
||||
|
||||
# engine defines an HA (high availability) engine to use for Grafana Live. By default no engine used - in
|
||||
# this case Live features work only on a single Grafana server. Available options: "redis".
|
||||
# Setting ha_engine is an EXPERIMENTAL feature.
|
||||
;ha_engine =
|
||||
|
||||
# ha_engine_address sets a connection address for Live HA engine. Depending on engine type address format can differ.
|
||||
# For now we only support Redis connection address in "host:port" format.
|
||||
# This option is EXPERIMENTAL.
|
||||
;ha_engine_address = "127.0.0.1:6379"
|
||||
|
||||
#################################### Grafana Image Renderer Plugin ##########################
|
||||
[plugin.grafana-image-renderer]
|
||||
# Instruct headless browser instance to use a default timezone when not provided by Grafana, e.g. when rendering panel image of alert.
|
||||
# See ICU’s metaZones.txt (https://cs.chromium.org/chromium/src/third_party/icu/source/data/misc/metaZones.txt) for a list of supported
|
||||
# timezone IDs. Fallbacks to TZ environment variable if not set.
|
||||
;rendering_timezone =
|
||||
|
||||
# Instruct headless browser instance to use a default language when not provided by Grafana, e.g. when rendering panel image of alert.
|
||||
# Please refer to the HTTP header Accept-Language to understand how to format this value, e.g. 'fr-CH, fr;q=0.9, en;q=0.8, de;q=0.7, *;q=0.5'.
|
||||
;rendering_language =
|
||||
|
||||
# Instruct headless browser instance to use a default device scale factor when not provided by Grafana, e.g. when rendering panel image of alert.
|
||||
# Default is 1. Using a higher value will produce more detailed images (higher DPI), but will require more disk space to store an image.
|
||||
;rendering_viewport_device_scale_factor =
|
||||
|
||||
# Instruct headless browser instance whether to ignore HTTPS errors during navigation. Per default HTTPS errors are not ignored. Due to
|
||||
# the security risk it's not recommended to ignore HTTPS errors.
|
||||
;rendering_ignore_https_errors =
|
||||
|
||||
# Instruct headless browser instance whether to capture and log verbose information when rendering an image. Default is false and will
|
||||
# only capture and log error messages. When enabled, debug messages are captured and logged as well.
|
||||
# For the verbose information to be included in the Grafana server log you have to adjust the rendering log level to debug, configure
|
||||
# [log].filter = rendering:debug.
|
||||
;rendering_verbose_logging =
|
||||
|
||||
# Instruct headless browser instance whether to output its debug and error messages into running process of remote rendering service.
|
||||
# Default is false. This can be useful to enable (true) when troubleshooting.
|
||||
;rendering_dumpio =
|
||||
|
||||
# Additional arguments to pass to the headless browser instance. Default is --no-sandbox. The list of Chromium flags can be found
|
||||
# here (https://peter.sh/experiments/chromium-command-line-switches/). Multiple arguments is separated with comma-character.
|
||||
;rendering_args =
|
||||
|
||||
# You can configure the plugin to use a different browser binary instead of the pre-packaged version of Chromium.
|
||||
# Please note that this is not recommended, since you may encounter problems if the installed version of Chrome/Chromium is not
|
||||
# compatible with the plugin.
|
||||
;rendering_chrome_bin =
|
||||
|
||||
# Instruct how headless browser instances are created. Default is 'default' and will create a new browser instance on each request.
|
||||
# Mode 'clustered' will make sure that only a maximum of browsers/incognito pages can execute concurrently.
|
||||
# Mode 'reusable' will have one browser instance and will create a new incognito page on each request.
|
||||
;rendering_mode =
|
||||
|
||||
# When rendering_mode = clustered, you can instruct how many browsers or incognito pages can execute concurrently. Default is 'browser'
|
||||
# and will cluster using browser instances.
|
||||
# Mode 'context' will cluster using incognito pages.
|
||||
;rendering_clustering_mode =
|
||||
# When rendering_mode = clustered, you can define the maximum number of browser instances/incognito pages that can execute concurrently. Default is '5'.
|
||||
;rendering_clustering_max_concurrency =
|
||||
# When rendering_mode = clustered, you can specify the duration a rendering request can take before it will time out. Default is 30 seconds.
|
||||
;rendering_clustering_timeout =
|
||||
|
||||
# Limit the maximum viewport width, height and device scale factor that can be requested.
|
||||
;rendering_viewport_max_width =
|
||||
;rendering_viewport_max_height =
|
||||
;rendering_viewport_max_device_scale_factor =
|
||||
|
||||
# Change the listening host and port of the gRPC server. Default host is 127.0.0.1 and default port is 0 and will automatically assign
|
||||
# a port not in use.
|
||||
;grpc_host =
|
||||
;grpc_port =
|
||||
|
||||
[enterprise]
|
||||
# Path to a valid Grafana Enterprise license.jwt file
|
||||
;license_path =
|
||||
|
||||
[feature_toggles]
|
||||
# there are currently two ways to enable feature toggles in the grafana.ini.
|
||||
# you can either pass an array of feature you want to enable to the enable field or
|
||||
# configure each toggle by setting the name of the toggle to true/false. Toggles set to true/false
|
||||
# will take presidence over toggles in the enable list.
|
||||
|
||||
;enable = feature1,feature2
|
||||
|
||||
;feature1 = true
|
||||
;feature2 = false
|
||||
|
||||
`;
|
||||
}
|
||||
21
services/grafana/secrets.ts
Normal file
21
services/grafana/secrets.ts
Normal file
|
|
@ -0,0 +1,21 @@
|
|||
import { nanoid } from "nanoid";
|
||||
import { generateSecretsFile, loadSecretsFile } from "../../helpers/secrets.js";
|
||||
|
||||
export interface GrafanaSecrets {
|
||||
defaultAdminPassword: string;
|
||||
}
|
||||
|
||||
export const loadGrafanaSecretsFile =
|
||||
loadSecretsFile<GrafanaSecrets>("grafana");
|
||||
export const generateGrafanaSecretsFile = generateSecretsFile(
|
||||
"grafana",
|
||||
generateGrafanaSecrets
|
||||
);
|
||||
export async function generateGrafanaSecrets(): Promise<GrafanaSecrets> {
|
||||
console.info(
|
||||
"La contraseña por defecto de lx usuarix admin va a estar en secrets/grafana.json"
|
||||
);
|
||||
return {
|
||||
defaultAdminPassword: nanoid(),
|
||||
};
|
||||
}
|
||||
Loading…
Reference in a new issue