|
| 1 | +//! Grafana firewall configuration step |
| 2 | +//! |
| 3 | +//! This module provides the `ConfigureGrafanaFirewallStep` which handles configuration |
| 4 | +//! of UFW firewall rules for Grafana UI access. This step opens port 3100 to allow |
| 5 | +//! public access to the Grafana web interface for metrics visualization. |
| 6 | +//! |
| 7 | +//! ## Key Features |
| 8 | +//! |
| 9 | +//! - Opens firewall port 3100 for Grafana UI (container port 3000 → host port 3100) |
| 10 | +//! - Reloads firewall rules without disrupting SSH access |
| 11 | +//! - Conditional execution based on Grafana configuration presence |
| 12 | +//! |
| 13 | +//! ## Port Configuration |
| 14 | +//! |
| 15 | +//! The Grafana UI is exposed on a fixed port: |
| 16 | +//! - **Host port 3100** → Container port 3000 (Grafana default) |
| 17 | +//! - Unlike tracker ports, this is not configurable (fixed mapping) |
| 18 | +//! |
| 19 | +//! ## Execution Order |
| 20 | +//! |
| 21 | +//! This step must be run **AFTER** `ConfigureFirewallStep` (which sets up SSH access). |
| 22 | +//! It should only be executed if Grafana configuration is present in the environment. |
| 23 | +//! |
| 24 | +//! ## Security Note |
| 25 | +//! |
| 26 | +//! This public port exposure is **temporary** until HTTPS support with reverse proxy |
| 27 | +//! is implemented. Once a reverse proxy (like nginx) is added with HTTPS, this direct |
| 28 | +//! port exposure will be removed, and Grafana will only be accessible through the proxy. |
| 29 | +//! |
| 30 | +//! ## Safety |
| 31 | +//! |
| 32 | +//! This step is designed to be safe for the following reasons: |
| 33 | +//! 1. SSH firewall rules are already configured by `ConfigureFirewallStep` |
| 34 | +//! 2. Only opens a single, fixed port (3100) |
| 35 | +//! 3. Firewall reload preserves existing rules |
| 36 | +//! 4. No risk of SSH lockout (SSH rules already applied) |
| 37 | +
|
| 38 | +use std::sync::Arc; |
| 39 | +use tracing::{info, instrument}; |
| 40 | + |
| 41 | +use crate::adapters::ansible::AnsibleClient; |
| 42 | +use crate::shared::command::CommandError; |
| 43 | + |
| 44 | +/// Step that configures UFW firewall rules for Grafana UI access |
| 45 | +/// |
| 46 | +/// This step opens firewall port 3100 to allow public access to the Grafana |
| 47 | +/// web interface. The playbook execution is unconditional - the decision to |
| 48 | +/// execute this step is made at the command handler level based on whether |
| 49 | +/// Grafana is configured in the environment. |
| 50 | +pub struct ConfigureGrafanaFirewallStep { |
| 51 | + ansible_client: Arc<AnsibleClient>, |
| 52 | +} |
| 53 | + |
| 54 | +impl ConfigureGrafanaFirewallStep { |
| 55 | + /// Create a new Grafana firewall configuration step |
| 56 | + /// |
| 57 | + /// # Arguments |
| 58 | + /// |
| 59 | + /// * `ansible_client` - Ansible client for running playbooks |
| 60 | + /// |
| 61 | + /// # Note |
| 62 | + /// |
| 63 | + /// Unlike tracker ports which are variable, Grafana UI port is fixed at 3100. |
| 64 | + /// The playbook always opens this port when executed - conditional execution |
| 65 | + /// happens at the step level (don't run if Grafana is disabled). |
| 66 | + #[must_use] |
| 67 | + pub fn new(ansible_client: Arc<AnsibleClient>) -> Self { |
| 68 | + Self { ansible_client } |
| 69 | + } |
| 70 | + |
| 71 | + /// Execute the Grafana firewall configuration |
| 72 | + /// |
| 73 | + /// This method opens firewall port 3100 for Grafana UI access and reloads |
| 74 | + /// the firewall. The port is fixed and not configurable. |
| 75 | + /// |
| 76 | + /// # Safety |
| 77 | + /// |
| 78 | + /// This method is designed to be safe because: |
| 79 | + /// - SSH firewall rules are already configured by `ConfigureFirewallStep` |
| 80 | + /// - Only opens a single, fixed port (3100) |
| 81 | + /// - Firewall reload preserves existing SSH rules |
| 82 | + /// |
| 83 | + /// # Errors |
| 84 | + /// |
| 85 | + /// Returns `CommandError` if: |
| 86 | + /// - Ansible playbook execution fails |
| 87 | + /// - UFW commands fail |
| 88 | + /// - Firewall reload fails |
| 89 | + #[instrument( |
| 90 | + name = "configure_grafana_firewall", |
| 91 | + skip_all, |
| 92 | + fields( |
| 93 | + step_type = "system", |
| 94 | + component = "firewall", |
| 95 | + service = "grafana", |
| 96 | + method = "ansible" |
| 97 | + ) |
| 98 | + )] |
| 99 | + pub fn execute(&self) -> Result<(), CommandError> { |
| 100 | + info!( |
| 101 | + step = "configure_grafana_firewall", |
| 102 | + action = "open_grafana_ui_port", |
| 103 | + port = 3100, |
| 104 | + "Configuring UFW firewall for Grafana UI" |
| 105 | + ); |
| 106 | + |
| 107 | + // Run Ansible playbook |
| 108 | + // Unlike tracker firewall, no variables are needed (port is fixed at 3100) |
| 109 | + // The playbook unconditionally opens port 3100 when executed |
| 110 | + match self |
| 111 | + .ansible_client |
| 112 | + .run_playbook("configure-grafana-firewall", &["-e", "@variables.yml"]) |
| 113 | + { |
| 114 | + Ok(_) => { |
| 115 | + info!( |
| 116 | + step = "configure_grafana_firewall", |
| 117 | + status = "success", |
| 118 | + port = 3100, |
| 119 | + "Grafana firewall rules configured successfully" |
| 120 | + ); |
| 121 | + Ok(()) |
| 122 | + } |
| 123 | + Err(e) => { |
| 124 | + // Propagate errors to the caller |
| 125 | + Err(e) |
| 126 | + } |
| 127 | + } |
| 128 | + } |
| 129 | +} |
| 130 | + |
| 131 | +#[cfg(test)] |
| 132 | +mod tests { |
| 133 | + use std::path::PathBuf; |
| 134 | + use std::sync::Arc; |
| 135 | + |
| 136 | + use super::*; |
| 137 | + |
| 138 | + #[test] |
| 139 | + fn it_should_create_configure_grafana_firewall_step() { |
| 140 | + let ansible_client = Arc::new(AnsibleClient::new(PathBuf::from("test_inventory.yml"))); |
| 141 | + let step = ConfigureGrafanaFirewallStep::new(ansible_client); |
| 142 | + |
| 143 | + // Test that the step can be created successfully |
| 144 | + assert_eq!( |
| 145 | + std::mem::size_of_val(&step), |
| 146 | + std::mem::size_of::<Arc<AnsibleClient>>() |
| 147 | + ); |
| 148 | + } |
| 149 | +} |
0 commit comments