Update: get ssl cert

Updated project plans section to indicate completion of task splitting by Ansible roles.

README.md

@@ -75,6 +75,6 @@ ansible_ssh_private_key_file: "путь_до_ssh_ключа"
 ***
 
 # Планы дальнейшего развития проекта:
-* Разбить таски по ролям Ansible.
+* Разбить таски по ролям Ansible. >>> сделано :white_check_mark:
 * Добавить возможность получения SSL-сертификата ради безопасного HTTPS соединения.
 * Прикрутить Alertmanager + Telegram Notifications.

roles/deploy_prometheus_and_grafana/handlers/main.yml

@@ -1,4 +1,6 @@
 - name: Restart docker-compose
   community.docker.docker_compose_v2:
     project_src: "{{ monitoring_dir }}"
+    files:
+      - "{{ 'docker-compose-https.yml' if (domain is defined and domain | length > 0) else 'docker-compose.yml' }}"
     state: restarted

roles/deploy_prometheus_and_grafana/tasks/main.yml

@@ -5,9 +5,16 @@
   ansible.builtin.import_role:
     name: install_Docker_and_utilities
 
+- name: Установка nginx
+  ansible.builtin.apt:
+    name: nginx
+    state: present
+    update_cache: true
+
 - name: Получаем сертификат, если его нет
   ansible.builtin.import_role:
     name: get_ssl_cert
+  when: domain is defined and domain | length > 0
 
 - name: Скопировать конфигурации сервисов
   ansible.builtin.template:
@@ -22,9 +29,38 @@
     - { src: "node-exporter-web.yml.j2", dest: "node-exporter-web.yml" }
     - { src: "grafana-datasource.yml.j2", dest: "grafana_provisioning/datasource.yml" }
     - { src: "docker-compose.yml.j2", dest: "docker-compose.yml" }
+    - { src: "docker-compose-https.yml.j2", dest: "docker-compose-https.yml" }
   notify: Restart docker-compose
 
-- name: Запустить Docker Compose
+- name: Скопировать конфиг nginx
+  ansible.builtin.template:
+    src: "nginx-https.conf.j2"
+    dest: "/etc/nginx/sites-available/nginx-https.conf"
+    mode: '0644'
+  when: domain is defined and domain | length > 0
+
+- name: Включить nginx конфиг (symlink)
+  ansible.builtin.file:
+    src: /etc/nginx/sites-available/nginx-https.conf
+    dest: /etc/nginx/sites-enabled/nginx-https.conf
+    state: link
+  when: domain is defined and domain | length > 0
+
+- name: Удалить дефолтную конфигурацию nginx
+  ansible.builtin.file:
+    path: /etc/nginx/sites-enabled/default
+    state: absent
+
+- name: Перезагрузить nginx
+  ansible.builtin.systemd:
+    name: nginx
+    enabled: true
+    state: reloaded
+  when: domain is defined and domain | length > 0
+
+- name: Запуск нужного compose-файла в зависимости от наличия domain
   community.docker.docker_compose_v2:
     project_src: "{{ monitoring_dir }}"
-    state: present
+    files:
+      - "{{ 'docker-compose-https.yml' if (domain is defined and domain | length > 0) else 'docker-compose.yml' }}"
+    state: present

templates/docker-compose-https.yml.j2

@@ -0,0 +1,42 @@
+services:
+  prometheus:
+    image: prom/prometheus:latest
+    container_name: prometheus
+    ports:
+      - "9090:9090"
+    volumes:
+      - ./prometheus.yml:/etc/prometheus/prometheus.yml:ro
+      - ./prometheus-web.yml:/etc/prometheus/prometheus-web.yml:ro
+      - prom_data:/prometheus
+
+    command:
+      - '--config.file=/etc/prometheus/prometheus.yml'
+      - '--web.config.file=/etc/prometheus/prometheus-web.yml'
+      - '--storage.tsdb.path=/prometheus'
+      - '--web.enable-admin-api'
+    
+    restart: unless-stopped
+
+
+  grafana:
+    image: grafana/grafana:latest
+    container_name: grafana
+    ports:
+      - "3001:3000"
+    volumes:
+      - ./grafana_provisioning/datasource.yml:/etc/grafana/provisioning/datasources/datasource.yml:ro
+      - grafana_data:/var/lib/grafana
+
+    environment:
+      - GF_SECURITY_ADMIN_USER="{{ grafana_admin_user }}"
+      - GF_SECURITY_ADMIN_PASSWORD="{{ grafana_admin_password }}"
+      - GF_USERS_ALLOW_SIGN_UP=false
+    
+    restart: unless-stopped
+      
+    depends_on:
+      - prometheus
+
+volumes:
+  prom_data:
+  grafana_data:

templates/nginx-https.conf.j2

@@ -0,0 +1,20 @@
+server {
+    listen 80;
+    server_name {{ domain }};
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen 443 ssl;
+    server_name {{ domain }};
+
+    ssl_certificate /etc/letsencrypt/live/{{ domain }}/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/{{ domain }}/privkey.pem;
+
+    location / {
+        proxy_pass http://127.0.0.1:3001;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+    }