Azure上のGrafanaでAD認証（App Service版） のバックアップ(No.6) - 闘うITエンジニアの覚え書き

0_env.sh

#!/bin/bash

PREFIX="各リソース名に付ける接頭文字"
subscriptionId="サブスクリプションID"
region=japanwest

resourceGroup=${PREFIX}ResourceGroup

vnetName=${PREFIX}VNet
vnetPrefix=10.1.0.0/16

nsgName=${vnetName}SecGrp
nsgPubRuleName=${nsgName}PubRule
nsgPubInboundPort="3000"

vmSubnetName=${PREFIX}VmSubnet
vmSubnetPrefix=10.1.1.0/24

vmName=${PREFIX}Vm
vmImage=UbuntuLTS
vmIpAddress=10.1.1.5
vmUser=sample

# 登録したアプリケーションのクライアントID、シークレット
clientId="確認したクライアントID"
clientSecret="確認したクライアントシークレット"

# テナントIDの取得
tenantId=`az account show -s $subscriptionId -o table | tail -1 | awk '{print $NF}'`

#!/bin/bash

# 設定の読み込み
source 0_env.sh

# リソース作成
if [ "$1" == "--create" ]; then

  # リソースグループの作成
  echo az group create
  az group create --name $resourceGroup --location $region

  # NSG(ネットワークセキュリティグループの)作成
  echo az network nsg create
  az network nsg create --resource-group $resourceGroup --name $nsgName

  # NSGルール(Public)
  echo az network nsg rule create
  az network nsg rule create \
    --resource-group $resourceGroup --nsg-name $nsgName --name ${nsgPubRuleName}1\
    --access Allow --protocol Tcp --direction Inbound --priority 100 \
    --source-address-prefix Internet --source-port-range "*" --destination-port-range $nsgPubInboundPort

  # NSGルール(Public) SSH
  echo "az network nsg rule create(ssh)"
  az network nsg rule create \
    --resource-group $resourceGroup --nsg-name $nsgName --name ${nsgPubRuleName}2 \
    --access Allow --protocol Tcp --direction Inbound --priority 101 \
    --source-address-prefix Internet --source-port-range "*" --destination-port-range "22"

  # 仮想ネットワーク 及び サブネット作成
  echo az network vnet create
  az network vnet create \
      --name $vnetName --resource-group $resourceGroup \
      --address-prefixes $vnetPrefix --network-security-group $nsgName \
      --subnet-name $vmSubnetName --subnet-prefixes $vmSubnetPrefix

  # VM用の初期化シェルに含まれているシークレットID等を置換する
  cat 2_vm_setup.tmpl | sed "s/\$clientId/$clientId/g" \
      | sed "s/\$clientSecret/$clientSecret/g" \
      | sed "s/\$tenantId/$tenantId/g">2_vm_setup.sh

  # 仮想マシンの作成
  rm -rf  ~/.ssh/id_rsa
  rm -rf  ~/.ssh/id_rsa.pub
  echo az vm create
  az vm create \
    --resource-group $resourceGroup --name $vmName --image $vmImage --generate-ssh-keys \
    --vnet-name $vnetName --subnet $vmSubnetName \
    --private-ip-address $vmIpAddress --admin-username $vmUser \
    --public-ip-address-dns-name `echo $vmName | tr '[A-Z]' '[a-z]'` \
    --custom-data 2_vm_setup.sh

  # Grafana用のポート開放
  az vm open-port --resource-group $resourceGroup --name $vmName --port 3000

  # 生成されたSSH鍵を移動( --ssh-dest-key-path が効かない為 )
  mkdir -p pem
  if [ -e ~/.ssh/id_rsa ]; then
    mv ~/.ssh/id_rsa     ./pem/id_rsa_${vmName}
    mv ~/.ssh/id_rsa.pub ./pem/id_rsa_${vmName}.pub
  fi

fi

# リソース削除
if [ "$1" == "--delete" ]; then
  echo az group delete
  az group delete --name $resourceGroup
fi

#!/bin/bash

apt-get update
apt-get install -y apt-transport-https ca-certificates curl gnupg-agent software-properties-common

curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -

add-apt-repository \
   "deb [arch=amd64] https://download.docker.com/linux/ubuntu \
   $(lsb_release -cs) \
   stable"

apt-get update
apt-get install -y docker-ce docker-ce-cli containerd.io

curl -L "https://github.com/docker/compose/releases/download/1.26.2/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
chmod +x /usr/local/bin/docker-compose

mkdir /tmp/grafana_docker && cd /tmp/grafana_docker
mkdir -p data/grafana && chmod 777 data/grafana

cat <<_EOYML_>docker-compose.yml
version: "3"

services:
  grafana:
    image: grafana/grafana:7.1.1
    hostname: grafana_sample
    container_name: grafana_sample
    ports:
      - "3000:3000"
    volumes:
      - ./grafana.ini:/etc/grafana/grafana.ini
    environment:
      - GF_SERVER_ROOT_URL=http://localhost:3000
      - GF_SECURITY_ADMIN_PASSWORD=admin
_EOYML_

# get grafana.ini template
docker run -d --name grafana_tmp --rm grafana/grafana:7.1.1
while [ true ]; do
  docker cp grafana_tmp:/etc/grafana/grafana.ini grafana.ini.tmpl
  if [ "$?" == "0" ]; then
    docker stop grafana_tmp
    break
  fi  
  sleep 2
done

# replace [auth.azuread] config
cat grafana.ini.tmpl | awk -v client_id="$clientId" -v client_secret="$clientSecret" -v tenant_id="$tenantId" '
BEGIN{
  target=0
}
{
  if ($1=="[auth.azuread]") {
    target=1
    print $1
  }
  if (target>1){
    target=target+1
    if (substr($1, 1, 1) == "[") {
      target=0
    } else {
      print
    }   
  }
  if (target==1){
    print "name = Azure AD" 
    print "enabled = true"
    print "client_id = "client_id
    print "client_secret = "client_secret
    print "auth_url = https://login.microsoftonline.com/"tenant_id"/oauth2/v2.0/authorize"
    print "token_url = https://login.microsoftonline.com/"tenant_id"/oauth2/v2.0/token"
    print "role_attribute_path = contains(groups[*], 'admin') && 'Admin' || contains(groups[*], 'editor') && 'Editor' || 'Viewer'"
    print ""
    target=target+1
  }
  if (target==0) {
    print
  }
}' > grafana.ini

# start grafana
docker-compose up -d