From 95b4b5abc9a5d2299ae6ffbb114a200b3ede2d8a Mon Sep 17 00:00:00 2001
From: Eric Meehan <eric@eom.dev>
Date: Fri, 6 Nov 2026 14:09:23 -0500
Subject: [PATCH] Move Grafana to ansible-role-grafana

Grafana now has its own role (DevOps/ansible-role-grafana). Remove its
tasks and LDAP template from this role and drop it from full.yaml.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 tasks/full.yaml        |  1 -
 tasks/grafana.yaml     | 61 -------------------------------------
 templates/ldap.toml.j2 | 69 ------------------------------------------
 3 files changed, 131 deletions(-)
 delete mode 100644 tasks/grafana.yaml
 delete mode 100644 templates/ldap.toml.j2

diff --git a/tasks/full.yaml b/tasks/full.yaml
index 69199e5..7950595 100644
--- a/tasks/full.yaml
+++ b/tasks/full.yaml
@@ -32,4 +32,3 @@
   include_tasks: "{{ item }}"
   loop:
     - prometheus.yaml
-    - grafana.yaml
diff --git a/tasks/grafana.yaml b/tasks/grafana.yaml
deleted file mode 100644
index b069cd5..0000000
--- a/tasks/grafana.yaml
+++ /dev/null
@@ -1,61 +0,0 @@
----
-# tasks file for grafana
-- name: Deploy Grafana
-  kubernetes.core.helm:
-    name: grafana
-    chart_ref: bitnami/grafana
-    release_namespace: grafana
-    create_namespace: true
-    values:
-      metrics:
-        enabled: true
-      admin:
-        user: grafana_admin
-        password: "{{ grafana_admin_password }}"
-      persistence:
-        size: 64Gi
-      grafana:
-        extraEnvVars:
-          - name: GF_SERVER_DOMAIN
-            value: grafana.eom.dev
-          - name: GF_SERVER_ROOT_URL
-            value: https://grafana.eom.dev/
-      smtp:
-        enabled: true
-        user: grafana
-        password: "{{ grafana_admin_password }}"
-        host: mail.eom.dev:587
-        fromAddress: grafana@eom.dev
-        fromName: Grafana
-      ldap:
-        enabled: true
-        allowSignUp: true
-        configuration: "{{ lookup('template', 'ldap.toml.j2') }}"
-      ingress:
-        enabled: true
-        pathType: Prefix
-        hostname: grafana.eom.dev
-        annotations:
-          cert-manager.io/cluster-issuer: ca-issuer
-        ingressClassName: nginx
-        tls: true
-      datasources:
-        secretDefinition:
-          apiVersion: 1
-          datasources:
-            - name: Prometheus
-              type: prometheus
-              access: proxy
-              orgId: 1
-              url: http://prometheus-server.prometheus.svc.cluster.local
-              version: 1
-              editable: true
-              isDefault: true
-            - name: Alertmanager
-              uid: alertmanager
-              type: alertmanager
-              access: proxy
-              orgId: 1
-              url: http://prometheus-alertmanager.prometheus.svc.cluster.local
-              version: 1
-              editable: true
diff --git a/templates/ldap.toml.j2 b/templates/ldap.toml.j2
deleted file mode 100644
index 219824e..0000000
--- a/templates/ldap.toml.j2
+++ /dev/null
@@ -1,69 +0,0 @@
-[[servers]]
-# Ldap server host (specify multiple hosts space separated)
-host = "openldap.openldap.svc.cluster.local"
-# Default port is 389 or 636 if use_ssl = true
-port = 389
-# Set to true if LDAP server should use an encrypted TLS connection (either with STARTTLS or LDAPS)
-use_ssl = false
-# If set to true, use LDAP with STARTTLS instead of LDAPS
-start_tls = false
-# The value of an accepted TLS cipher. By default, this value is empty. Example value: ["TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"])
-# For a complete list of supported ciphers and TLS versions, refer to: https://go.dev/src/crypto/tls/cipher_suites.go
-# Starting with Grafana v11.0 only ciphers with ECDHE support are accepted for TLS 1.2 connections.
-tls_ciphers = []
-# This is the minimum TLS version allowed. By default, this value is empty. Accepted values are: TLS1.1 (only for Grafana v10.4 or earlier), TLS1.2, TLS1.3.
-min_tls_version = ""
-# set to true if you want to skip SSL cert validation
-ssl_skip_verify = false
-# set to the path to your root CA certificate or leave unset to use system defaults
-# root_ca_cert = "/path/to/certificate.crt"
-# Authentication against LDAP servers requiring client certificates
-# client_cert = "/path/to/client.crt"
-# client_key = "/path/to/client.key"
-
-# Search user bind dn
-bind_dn = "cn=readonly,dc=eom,dc=dev"
-# Search user bind password
-# If the password contains # or ; you have to wrap it with triple quotes. Ex """#password;"""
-bind_password = "{{ openldap_readonly_password }}"
-# We recommend using variable expansion for the bind_password, for more info https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#variable-expansion
-# bind_password = '$__env{LDAP_BIND_PASSWORD}'
-
-# Timeout in seconds. Applies to each host specified in the 'host' entry (space separated).
-timeout = 30
-
-# User search filter, for example "(cn=%s)" or "(sAMAccountName=%s)" or "(uid=%s)"
-# Allow login from email or username, example "(|(sAMAccountName=%s)(userPrincipalName=%s))"
-search_filter = "(&(objectClass=posixAccount)(uid=%s)(memberOf=cn=Grafana Users,ou=Grafana,ou=Services,dc=eom,dc=dev))"
-
-# An array of base dns to search through
-search_base_dns = ["dc=eom,dc=dev"]
-
-# Specify names of the LDAP attributes your LDAP uses
-[servers.attributes]
-username = "uid"
-email =  "mail"
-name = "givenName"
-surname = "sn"
-member_of = "memberOf"
-
-[[servers.group_mappings]]
-group_dn = "cn=Grafana Administrators,ou=Grafana,ou=Services,dc=eom,dc=dev"
-org_id = 1
-org_role = "Admin"
-grafana_admin = true
-
-[[servers.group_mappings]]
-group_dn = "cn=Grafana Users,ou=Grafana,ou=Services,dc=eom,dc=dev"
-org_id = 1
-org_role = "Viewer"
-
-[[servers.group_mappings]]
-group_dn = "cn=DevOps Owners,ou=Teams,dc=eom,dc=dev"
-org_id = 2
-org_role = "Admin"
-
-[[servers.group_mappings]]
-group_dn = "cn=Finance Owners,ou=Teams,dc=eom,dc=dev"
-org_id = 3
-org_role = "Admin"