Feature 57 (config and provisioning): modules declare config and provisions, their files rendered from templates; synced with main (issues of feature 57, 874)

modules/grafana/module.json

@@ -29,6 +29,20 @@
       }
     ]
   },
+  "config": {
+    "user": {
+      "type": "string",
+      "description": "The Grafana account the module's tools sign in as with the vault's password; the file's default is admin.",
+      "trusted": true,
+      "default": "admin"
+    },
+    "url": {
+      "type": "string",
+      "description": "The address the module's tools reach Grafana at, as a URL; unset, the code falls back to its environment, else this machine's Grafana on its port.",
+      "trusted": true,
+      "default": ""
+    }
+  },
   "resources": [
     {
       "id": "mesh-state",
@@ -54,7 +68,7 @@
       "path": "${dir:state}/admin.secret",
       "mode": "0400",
       "owner": "472:472",
-      "content": "${secret:admin}"
+      "template": "files/admin.secret"
     },
     {
       "id": "oidc-secret",
@@ -62,14 +76,14 @@
       "path": "${dir:state}/oidc-client.secret",
       "mode": "0400",
       "owner": "472:472",
-      "content": "${secret:oidc-client}"
+      "template": "files/oidc-client.secret"
     },
     {
       "id": "oidc-env",
       "type": "file",
       "path": "${dir:state}/oidc.env",
       "mode": "0644",
-      "content": "GF_SERVER_ROOT_URL=https://${bound:route:name}\nGF_AUTH_GENERIC_OAUTH_ENABLED=true\nGF_AUTH_GENERIC_OAUTH_NAME=Keycloak\nGF_AUTH_GENERIC_OAUTH_CLIENT_ID=${bound:oidc-client:as}\nGF_AUTH_GENERIC_OAUTH_CLIENT_SECRET__FILE=/run/secrets/oidc-client\nGF_AUTH_GENERIC_OAUTH_SCOPES=openid email profile roles\nGF_AUTH_GENERIC_OAUTH_AUTH_URL=${bound:oidc-client:issuer}${bound:oidc-client:authorization-path}\nGF_AUTH_GENERIC_OAUTH_TOKEN_URL=${bound:oidc-client:issuer}${bound:oidc-client:token-path}\nGF_AUTH_GENERIC_OAUTH_API_URL=${bound:oidc-client:issuer}${bound:oidc-client:userinfo-path}\nGF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH=contains(roles[*], 'admin') && 'Admin' || contains(realm_access.roles[*], 'admin') && 'Admin' || 'Viewer'\nGF_AUTH_GENERIC_OAUTH_USE_PKCE=true\nGF_AUTH_GENERIC_OAUTH_ALLOW_SIGN_UP=true\nGF_AUTH_GENERIC_OAUTH_ALLOW_ASSIGN_GRAFANA_ADMIN=true\n"
+      "template": "files/oidc.env"
     },
     {
       "id": "influxdb-datasources",
@@ -91,7 +105,7 @@
       "path": "${dir:influxdb-credential}/influxdb-api",
       "mode": "0400",
       "owner": "472:472",
-      "content": "${secret:influxdb-api}",
+      "template": "files/influxdb-api",
       "only-when-bound": "influxdb-api"
     },
     {
@@ -99,7 +113,7 @@
       "type": "file",
       "path": "${dir:influxdb-datasources}/mesh-influxdb.yaml",
       "mode": "0644",
-      "content": "apiVersion: 1\n# Written by the mesh from grafana's influxdb-api binding, only while it is bound (novox/hq ADR 0330):\n# without influxdb, grafana runs with no mesh data source. grafana reads it at start. Its own name and\n# uid, so a data source somebody made in the UI is never overwritten, and read-only in the UI because\n# the mesh resets it. The password is read from the file the mesh delivers, never written here.\ndatasources:\n  - name: InfluxDB (mesh)\n    uid: mesh-influxdb-api\n    type: influxdb\n    access: proxy\n    url: ${bound:influxdb-api:scheme}://${bound:influxdb-api:at}:${bound:influxdb-api:port}\n    user: ${bound:influxdb-api:as}\n    isDefault: false\n    editable: false\n    jsonData:\n      dbName: ${bound:influxdb-api:bucket}\n      httpMode: POST\n    secureJsonData:\n      password: $__file{/run/secrets/influxdb/influxdb-api}\n",
+      "template": "files/mesh-influxdb.yaml",
       "only-when-bound": "influxdb-api"
     },
     {
@@ -140,8 +154,9 @@
       "type": "file",
       "path": "${dir:mesh-state}/config.json",
       "mode": "0600",
-      "content": "{\n  \"user\": \"admin\",\n  \"password\": \"${secret:admin}\"\n}\n",
+      "template": "files/config.json",
       "merge": "json",
+      "takes-config": ["user", "url"],
       "protected": ["password", "token"]
     }
   ],
@@ -194,6 +209,11 @@
           "MESH_GRAFANA_URL": "http://127.0.0.1:${port:3000}",
           "MESH_GRAFANA_CONFIG_FILE": "${dir:mesh-state}/config.json"
         }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
       }
     ]
   }