Automate configuration of prometheus allow list for discourse

diff --git a/cookbooks/community/recipes/default.rb b/cookbooks/community/recipes/default.rb
index 76b8a97b62333c052d1f9c3b8bfcfc2ff472d5eb..224cb975daf7d35b6103b459cd59e12ca25a71da 100644 (file)
--- a/cookbooks/community/recipes/default.rb
+++ b/cookbooks/community/recipes/default.rb
@@ -25,6 +25,10 @@ include_recipe "ssl"
 passwords = data_bag_item("community", "passwords")
 license_keys = data_bag_item("geoipupdate", "license-keys") unless kitchen?
 
 passwords = data_bag_item("community", "passwords")
 license_keys = data_bag_item("geoipupdate", "license-keys") unless kitchen?
 

+prometheus_servers = search(:node, "recipes:prometheus\\:\\:server").map do |server|
+  server.ipaddresses(:role => :external)
+end.flatten
+

 # Disable any default installed apache2 service. Web server is embedded within the discourse docker container
 service "apache2" do
   action [:disable, :stop]
 # Disable any default installed apache2 service. Web server is embedded within the discourse docker container
 service "apache2" do
   action [:disable, :stop]


@@ -82,7 +86,8 @@ template "/srv/community.openstreetmap.org/docker/containers/web_only.yml" do
   owner "root"
   group "root"
   mode "640"
   owner "root"
   group "root"
   mode "640"

-  variables :license_keys => license_keys, :passwords => passwords
+  variables :license_keys => license_keys, :passwords => passwords,
+            :prometheus_servers => prometheus_servers

   notifies :run, "notify_group[discourse_container_new_web_only]"
 end
 
   notifies :run, "notify_group[discourse_container_new_web_only]"
 end
 

diff --git a/cookbooks/community/templates/default/web_only.yml.erb b/cookbooks/community/templates/default/web_only.yml.erb
index 6324baeb97539d78588bf4af7410d72dd60631e1..d5ce8a60afaabee4b2e6a9411dea8c3978998c51 100644 (file)
--- a/cookbooks/community/templates/default/web_only.yml.erb
+++ b/cookbooks/community/templates/default/web_only.yml.erb
@@ -66,8 +66,8 @@ env:
   DISCOURSE_MAXMIND_LICENSE_KEY: '<%= @license_keys[node[:geoipupdate][:account]] %>'
 <% end -%>
 
   DISCOURSE_MAXMIND_LICENSE_KEY: '<%= @license_keys[node[:geoipupdate][:account]] %>'
 <% end -%>
 

-  # FIXME: hardcoded IPs should be replaced by chef node search
-  DISCOURSE_PROMETHEUS_TRUSTED_IP_ALLOWLIST_REGEX: '^(140\.211\.167\.99|2605:bc80:3010:700::8cd3:a763)$'
+  # Allow list for prometheus metric collection
+  DISCOURSE_PROMETHEUS_TRUSTED_IP_ALLOWLIST_REGEX: '^<%= @prometheus_servers.map { |a| Regexp.escape(a) }.join("|") %>$'

 
   # Increase base SIDEKIQ memory limit to 1GB
   UNICORN_SIDEKIQ_MAX_RSS: 1000
 
   # Increase base SIDEKIQ memory limit to 1GB
   UNICORN_SIDEKIQ_MAX_RSS: 1000