Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion assets/aws/Makefile
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ TELEGRAF_VERSION ?= 1.9.3
INFLUXDB_VERSION ?= 1.8.5

# Grafana version
GRAFANA_VERSION ?= 5.4.3
GRAFANA_VERSION ?= 9.0.7

# AWS account ID which hosts the public Teleport AMIs
AWS_ACCOUNT_ID ?= 126027368216
Expand Down
8 changes: 4 additions & 4 deletions assets/aws/files/install.sh
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
#!/bin/bash
if [[ "${DEBUG}" == "true" ]]; then
if [[ "${DEBUG:-false}" == "true" ]]; then
set -x
fi

Expand All @@ -17,17 +17,17 @@ amazon-linux-extras install nginx1
CURL_OPTS="-L --retry 100 --retry-delay 0 --connect-timeout 10 --max-time 300"

# Install telegraf to collect stats from influx
curl ${CURL_OPTS} -o /tmp/telegraf.rpm https://dl.influxdata.com/telegraf/releases/telegraf-${TELEGRAF_VERSION}-1.x86_64.rpm
curl ${CURL_OPTS} -o /tmp/telegraf.rpm "https://dl.influxdata.com/telegraf/releases/telegraf-${TELEGRAF_VERSION}-1.x86_64.rpm"
yum install -y /tmp/telegraf.rpm
rm -f /tmp/telegraf.rpm

# Install grafana
curl ${CURL_OPTS} -o /tmp/grafana.rpm https://s3-us-west-2.amazonaws.com/grafana-releases/release/grafana-${GRAFANA_VERSION}-1.x86_64.rpm
curl ${CURL_OPTS} -o /tmp/grafana.rpm "https://dl.grafana.com/oss/release/grafana-${GRAFANA_VERSION}-1.x86_64.rpm"
yum install -y /tmp/grafana.rpm
rm -f /tmp/grafana.rpm

# Install InfluxDB
curl $CURL_OPTS -o /tmp/influxdb.rpm https://dl.influxdata.com/influxdb/releases/influxdb-${INFLUXDB_VERSION}.x86_64.rpm
curl $CURL_OPTS -o /tmp/influxdb.rpm "https://dl.influxdata.com/influxdb/releases/influxdb-${INFLUXDB_VERSION}.x86_64.rpm"
yum install -y /tmp/influxdb.rpm
rm -f /tmp/influxdb.rpm

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ user nginx;
pid /run/nginx.pid;

events {
worker_connections 2048;
worker_connections 2048;
}

http {
Expand Down Expand Up @@ -33,13 +33,30 @@ http {
##
gzip on;

#
# Frontend grafana (no TLS as we're using ACM on the LB)
#
server {
listen 8444 default_server;
location / {
proxy_pass http://127.0.0.1:3000;
}
}
##
# Websocket settings
##
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}

#
# Frontend grafana (no TLS as we're using ACM on the LB)
#
server {
listen 8444 default_server;
location / {
proxy_pass http://127.0.0.1:3000;
proxy_set_header Host $http_host;
}
# Proxy Grafana Live WebSocket connections.
location /api/live/ {
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_set_header Host $http_host;
proxy_pass http://127.0.0.1:3000;
}
}
}
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ user nginx;
pid /run/nginx.pid;

events {
worker_connections 2048;
worker_connections 2048;
}

http {
Expand All @@ -22,7 +22,7 @@ http {

##
# TLS settings - we are pretty strict here
# but well, it's a dev service, why not?
# but well, it's a dev service, why not?
##
ssl_protocols TLSv1.2;
ssl_prefer_server_ciphers on;
Expand All @@ -40,16 +40,33 @@ http {
##
gzip on;

#
# Frontend grafana with TLS
#
server {
listen 8443 default_server ssl;
ssl_certificate_key /etc/tls/certs/privkey.pem;
ssl_certificate /etc/tls/certs/fullchain.pem;
ssl_ciphers AES256+EECDH:AES256+EDH:!aNULL;
location / {
proxy_pass http://127.0.0.1:3000;
}
}
##
# Websocket settings
##
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}

#
# Frontend grafana with TLS
#
server {
listen 8443 default_server ssl;
ssl_certificate_key /etc/tls/certs/privkey.pem;
ssl_certificate /etc/tls/certs/fullchain.pem;
ssl_ciphers AES256+EECDH:AES256+EDH:!aNULL;
location / {
proxy_pass http://127.0.0.1:3000;
proxy_set_header Host $http_host;
}
# Proxy Grafana Live WebSocket connections.
location /api/live/ {
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_set_header Host $http_host;
proxy_pass http://127.0.0.1:3000;
}
}
}
3 changes: 3 additions & 0 deletions examples/aws/terraform/ha-autoscale-cluster/s3.tf
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@ resource "aws_s3_bucket_object" "grafana_teleport_dashboard" {
bucket = aws_s3_bucket.certs.bucket
key = "health-dashboard.json"
source = "./assets/health-dashboard.json"
etag = filemd5("./assets/health-dashboard.json")
}

// Grafana nginx config (letsencrypt)
Expand All @@ -24,6 +25,7 @@ resource "aws_s3_bucket_object" "grafana_teleport_nginx" {
key = "grafana-nginx.conf"
source = "./assets/grafana-nginx.conf"
count = var.use_acm ? 0 : 1
etag = filemd5("./assets/grafana-nginx.conf")
}

// Grafana nginx config (ACM)
Expand All @@ -32,5 +34,6 @@ resource "aws_s3_bucket_object" "grafana_teleport_nginx_acm" {
key = "grafana-nginx.conf"
source = "./assets/grafana-nginx-acm.conf"
count = var.use_acm ? 1 : 0
etag = filemd5("./assets/grafana-nginx-acm.conf")
}