git init

control-plane/grafana/Dockerfile

@@ -0,0 +1,11 @@
+# syntax=docker/dockerfile:1.7
+FROM grafana/grafana:13.2.0
+
+USER root
+COPY --chown=472:0 provisioning /etc/grafana/provisioning
+COPY --chown=472:0 dashboards /etc/grafana/dashboards
+COPY --chown=472:0 entrypoint.sh /usr/local/bin/vps-control-grafana-entrypoint
+RUN chmod 0555 /usr/local/bin/vps-control-grafana-entrypoint
+USER 472
+
+ENTRYPOINT ["/usr/local/bin/vps-control-grafana-entrypoint"]

control-plane/grafana/dashboards/vps-control-overview.json

@@ -0,0 +1,67 @@
+{
+  "annotations": {"list": []},
+  "editable": false,
+  "graphTooltip": 1,
+  "id": null,
+  "links": [],
+  "panels": [
+    {
+      "datasource": {"type": "prometheus", "uid": "vps-control-prometheus"},
+      "fieldConfig": {"defaults": {"max": 100, "min": 0, "unit": "percent"}, "overrides": []},
+      "gridPos": {"h": 8, "w": 12, "x": 0, "y": 0},
+      "id": 1,
+      "options": {"legend": {"displayMode": "list", "placement": "bottom"}},
+      "targets": [{"editorMode": "code", "expr": "vps_control_cpu_usage_percent", "legendFormat": "{{server_name}}", "range": true, "refId": "A"}],
+      "title": "CPU usage",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {"type": "prometheus", "uid": "vps-control-prometheus"},
+      "fieldConfig": {"defaults": {"max": 100, "min": 0, "unit": "percent"}, "overrides": []},
+      "gridPos": {"h": 8, "w": 12, "x": 12, "y": 0},
+      "id": 2,
+      "options": {"legend": {"displayMode": "list", "placement": "bottom"}},
+      "targets": [{"editorMode": "code", "expr": "vps_control_memory_usage_percent", "legendFormat": "{{server_name}}", "range": true, "refId": "A"}],
+      "title": "Memory usage",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {"type": "prometheus", "uid": "vps-control-prometheus"},
+      "fieldConfig": {"defaults": {"max": 100, "min": 0, "unit": "percent"}, "overrides": []},
+      "gridPos": {"h": 8, "w": 12, "x": 0, "y": 8},
+      "id": 3,
+      "options": {"legend": {"displayMode": "list", "placement": "bottom"}},
+      "targets": [{"editorMode": "code", "expr": "vps_control_disk_usage_percent", "legendFormat": "{{server_name}}", "range": true, "refId": "A"}],
+      "title": "Disk usage",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {"type": "prometheus", "uid": "vps-control-prometheus"},
+      "fieldConfig": {"defaults": {"unit": "short"}, "overrides": []},
+      "gridPos": {"h": 8, "w": 12, "x": 12, "y": 8},
+      "id": 4,
+      "options": {"legend": {"displayMode": "list", "placement": "bottom"}},
+      "targets": [{"editorMode": "code", "expr": "vps_control_connections", "legendFormat": "{{server_name}}", "range": true, "refId": "A"}],
+      "title": "Connections",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {"type": "loki", "uid": "vps-control-loki"},
+      "gridPos": {"h": 12, "w": 24, "x": 0, "y": 16},
+      "id": 5,
+      "options": {"dedupStrategy": "none", "enableLogDetails": true, "prettifyLogMessage": false, "showCommonLabels": false, "showLabels": true, "showTime": true, "sortOrder": "Descending", "wrapLogMessage": true},
+      "targets": [{"editorMode": "code", "expr": "{unit=~\".+\"}", "queryType": "range", "refId": "A"}],
+      "title": "Allow-listed journald logs",
+      "type": "logs"
+    }
+  ],
+  "refresh": "1m",
+  "schemaVersion": 41,
+  "tags": ["vps-control"],
+  "templating": {"list": []},
+  "time": {"from": "now-6h", "to": "now"},
+  "timezone": "browser",
+  "title": "VPS Control Overview",
+  "uid": "vps-control-overview",
+  "version": 1
+}

control-plane/grafana/entrypoint.sh

@@ -0,0 +1,22 @@
+#!/bin/sh
+set -eu
+
+integration_token_file=/run/secrets/integration_token
+admin_password_file=/run/secrets/grafana_admin_password
+secret_key_file=/run/secrets/grafana_secret_key
+
+if [ ! -r "$integration_token_file" ] || [ ! -r "$admin_password_file" ] || [ ! -r "$secret_key_file" ]; then
+  echo "required Grafana secret file is unavailable" >&2
+  exit 1
+fi
+
+INTEGRATION_TOKEN=$(tr -d '\r\n' < "$integration_token_file")
+GF_SECURITY_ADMIN_PASSWORD=$(tr -d '\r\n' < "$admin_password_file")
+GF_SECURITY_SECRET_KEY=$(tr -d '\r\n' < "$secret_key_file")
+if [ "${#INTEGRATION_TOKEN}" -lt 32 ] || [ "${#GF_SECURITY_ADMIN_PASSWORD}" -lt 16 ] || [ "${#GF_SECURITY_SECRET_KEY}" -lt 32 ]; then
+  echo "Grafana secrets do not meet minimum length requirements" >&2
+  exit 1
+fi
+export INTEGRATION_TOKEN GF_SECURITY_ADMIN_PASSWORD GF_SECURITY_SECRET_KEY
+
+exec /run.sh

control-plane/grafana/provisioning/dashboards/vps-control.yml

@@ -0,0 +1,12 @@
+apiVersion: 1
+
+providers:
+  - name: VPS Control
+    orgId: 1
+    folder: VPS Control
+    type: file
+    disableDeletion: true
+    allowUiUpdates: false
+    updateIntervalSeconds: 30
+    options:
+      path: /etc/grafana/dashboards

control-plane/grafana/provisioning/datasources/vps-control.yml

@@ -0,0 +1,35 @@
+apiVersion: 1
+
+deleteDatasources:
+  - name: VPS Control Metrics
+    orgId: 1
+  - name: VPS Control Logs
+    orgId: 1
+
+datasources:
+  - name: VPS Control Metrics
+    uid: vps-control-prometheus
+    orgId: 1
+    type: prometheus
+    access: proxy
+    url: http://backend:8080/integrations/prometheus
+    isDefault: true
+    editable: false
+    jsonData:
+      httpMethod: POST
+      httpHeaderName1: Authorization
+    secureJsonData:
+      httpHeaderValue1: Bearer $INTEGRATION_TOKEN
+
+  - name: VPS Control Logs
+    uid: vps-control-loki
+    orgId: 1
+    type: loki
+    access: proxy
+    url: http://backend:8080/integrations/loki
+    editable: false
+    jsonData:
+      httpHeaderName1: Authorization
+      maxLines: 1000
+    secureJsonData:
+      httpHeaderValue1: Bearer $INTEGRATION_TOKEN