add password generator

monitoring/README.md

@@ -7,6 +7,7 @@
 
 ```
 printf $(pass show hosts/swarm.autonomic.zone/minio/secret_key) | docker secret create gp_monitoring_loki_aws_secret_access_key_v1 -
+printf password | docker secret create gp_monitoring_grafana_admin_password_v1 -
 set -a && source env && set +a
 docker context use monitor.autonomic.zone
 docker stack deploy -c compose.yml gp_monitoring

monitoring/compose.yml

@@ -6,6 +6,8 @@ services:
     image: grafana/grafana:8.4.4
     volumes:
       - grafana-data:/var/lib/grafana:rw
+    secrets:
+      - grafana_admin_password
     configs:
       - source: grafana_datasources_yml
         target: /etc/grafana/provisioning/datasources/datasources.yml
@@ -28,6 +30,7 @@ services:
       - GF_SECURITY_ALLOW_EMBEDDING
       - GF_INSTALL_PLUGINS=grafana-piechart-panel
       - GF_SERVER_ROOT_URL=https://${GRAFANA_DOMAIN}
+      - GF_SECURITY_ADMIN_PASSWORD__FILE=/run/secrets/grafana_admin_password
     deploy:
       labels:
         - "traefik.enable=true"
@@ -134,3 +137,6 @@ secrets:
   loki_aws_secret_access_key:
     external: true
     name: ${STACK_NAME}_loki_aws_secret_access_key_${SECRET_LOKI_AWS_SECRET_ACCESS_KEY_VERSION}
+  grafana_admin_password:
+    external: true
+    name: ${STACK_NAME}_grafana_admin_password_${SECRET_GRAFANA_ADMIN_PASSWORD_VERSION}

monitoring/env

@@ -41,3 +41,4 @@ GRAFANA_STACKS_DASHBOARD_JSON_VERSION=v1
 GRAFANA_TRAEFIK_DASHBOARD_JSON_VERSION=v1
 
 SECRET_LOKI_AWS_SECRET_ACCESS_KEY_VERSION=v1
+SECRET_GRAFANA_ADMIN_PASSWORD_VERSION=v1