Ajout authentification et tls sur nodeexporter via traefik

defaults/main.yml

@@ -1,2 +1 @@
 docker_nodeexporter_port: "9100"
-docker_nodeexporter_enable_tlsauth: false

tasks/main.yml

@@ -8,36 +8,3 @@
     src: docker-compose.yml
     dest: /opt/{{ docker_nodeexporter_service_id }}/
   notify: docker-compose-up
-
-- name: Prepare config.yml
-  ansible.builtin.template:
-    src: config.yml
-    dest: /opt/{{ docker_nodeexporter_service_id }}/
-  when: docker_nodeexporter_enable_tlsauth
-  notify: docker-compose-up
-
-- name: Copie le certificat pour tls
-  ansible.builtin.get_url:
-    url: "{{ docker_nodeexporter_certificate_url }}"
-    dest: /opt/{{ docker_nodeexporter_service_id }}/cert.pem
-    username: "{{ lookup('env', 'AAP_RESSOURCES_USER') }}"
-    password: "{{ lookup('env', 'AAP_RESSOURCES_PASSWORD') }}"
-    mode: u=rw,g=r,o=r
-    owner: root
-    group: root
-  notify:
-    - docker-compose-up
-  when: docker_nodeexporter_enable_tlsauth
-
-- name: Copie la clé pour tls
-  ansible.builtin.get_url:
-    url: "{{ docker_nodeexporter_key_url }}"
-    dest: /opt/{{ docker_nodeexporter_service_id }}/key.pem
-    username: "{{ lookup('env', 'AAP_RESSOURCES_USER') }}"
-    password: "{{ lookup('env', 'AAP_RESSOURCES_PASSWORD') }}"
-    mode: u=rw,g=r,o=r
-    owner: root
-    group: root
-  notify:
-    - docker-compose-up
-  when: docker_nodeexporter_enable_tlsauth

templates/config.yml

@@ -1,6 +0,0 @@
-basic_auth_users:
-  prometheus: {{ docker_nodeexporter_auth_password }}
-
-tls_server_config:
-  cert_file: /cert.pem
-  key_file: /key.pem

templates/docker-compose.yml

@@ -8,21 +8,25 @@ services:
       - /proc:/host/proc:ro
       - /sys:/host/sys:ro
       - /:/rootfs:ro
-{% if docker_nodeexporter_enable_tlsauth %}
-      - ./config.yml:/config.yml
-      - ./key.pem:/key.pem
-      - ./cert.pem:/cert.pem
-{% endif %}
     command:
       - '--path.procfs=/host/proc'
       - '--path.rootfs=/rootfs'
       - '--path.sysfs=/host/sys'
       - '--collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc|run)($$|/)'
-{% if docker_nodeexporter_enable_tlsauth %}
-      - '--web.config.file=/config.yml'
-{% endif %}
     restart: always
     labels:
-      org.label-schema.group: "monitoring"
+      org.label-schema.group: monitoring
+      traefik.enable: true
+      traefik.docker.network: traefik
+      traefik.http.routers.nodeexporter.entrypoints: nodeexporter
+      traefik.http.routers.nodeexporter.tls: true
+      traefik.http.routers.nodeexporter.rule: Host(`{{ ansible_fqdn }}`)
+      traefik.http.services.nodeexporter.loadbalancer.server.port: 9100
+      traefik.http.routers.nodeexporter.middlewares: nodeexporter_auth
+      traefik.http.middlewares.nodeexporter_auth.basicauth.users: "{{ docker_nodeexporter_auth_user }}:{{ docker_nodeexporter_auth_password }}"
     ports:
       - {{ docker_nodeexporter_port }}:9100
+
+networks:
+  traefik:
+    external: true