Wire Forge-native release infrastructure

infra/grafana/.gitignore

@@ -0,0 +1,4 @@
+.terraform/
+backend.hcl
+terraform.tfvars
+*.tfplan

infra/grafana/.terraform.lock.hcl

@@ -0,0 +1,29 @@
+# This file is maintained automatically by "tofu init".
+# Manual edits may be lost in future updates.
+
+provider "registry.opentofu.org/grafana/grafana" {
+  version     = "4.37.0"
+  constraints = ">= 4.36.0, < 5.0.0"
+  hashes = [
+    "h1:EqimatXUHgE9jIko0ifoR+kOLVCQlLGvj13iH5GoCnE=",
+    "zh:02dcb17aae3e97a4b946e28267a80845b130e4a062ebd0f7dbf15ef1f65713e7",
+    "zh:07b57580fe411de152a3b29a5ac1e0ff2541f9a62904c5b9703cf7e3c63bbbfa",
+    "zh:089b7ce58b919732bedcb95e2a5d99553956a3637e89bb0b814de82050cca635",
+    "zh:08c15290aafeec6945cd5321b5cdc2adb5f077b26fb77225984e3acd055293f7",
+    "zh:0e0d0f89d8f2ca89541b5981c9388263af15c83c98f57d831a2dc162f1586af5",
+    "zh:3363c8c5a987951ec6bf69bfdd1293d2fb1e72aa94e272280b69ef2dd3988e34",
+    "zh:479e2f82ad2b7522851c828f33d6ab7a0cfce44304f25b5b1f5ddabed0fb879c",
+    "zh:4d9d619b6c6c619f58624a9fba8414201fe68403eb5e1588b95d8c31ecc9c71e",
+    "zh:545f24ef5b1d87d641a577556ada8b0ac67417e0bc51ac01238898fb6429d67a",
+    "zh:8b43993924d12d946e002acbf54c8bf7f05a269436ad085c45317c6020ba10df",
+    "zh:965cf4bf12a8a8e858d791743716433d71a17ed2a15e6cd183dc3d7349be24e3",
+    "zh:9a1205bc5cf01f143611afb97934f2cbc5c9225f6bc5c279f6424ea4da96151b",
+    "zh:b49d28a1a0226799a9421b50dcdc2c85de5858d42f92c8443745d80c9dd5e0cd",
+    "zh:b618aa9e7272447b2e1ce46bb399e39d21f605de48c756b6af0b42fddca50674",
+    "zh:b9dac24ca39fcc95575f0051390c71dabdd540ea2c365bb87b5621e5d6219594",
+    "zh:ba3b79a13ece3bd782a79afe590200940ce740eee809ed4cb9e1086253dba1d2",
+    "zh:ba3f77877ed139cbf0d9af9d1b84e827c49fc42c60e545c67c9d05d1e63e9b0c",
+    "zh:ba84824517ef8bb78122f7bdcbd49bbdf289df9b82040dfbee913a73f29fc158",
+    "zh:de116fd3a62a20f183793c760fa4d9521cee7d718165924cc9b0012e297636b5",
+  ]
+}

infra/grafana/README.md

@@ -0,0 +1,46 @@
+# Burrow Grafana API Control Plane
+
+This OpenTofu stack creates Grafana folders and dashboards through the official
+`grafana/grafana` provider.
+
+This is not a Grafana deployment mechanism. NixOS owns the Grafana service,
+authentication, data sources, and boot-time provisioning.
+
+## Run
+
+Use the repository wrapper so the OpenTofu runtime comes from Nix:
+
+```sh
+Scripts/grafana-tofu.sh init -backend-config=backend.hcl
+Scripts/grafana-tofu.sh plan -var-file=terraform.tfvars
+```
+
+For a local syntax check without remote state:
+
+```sh
+Scripts/grafana-tofu.sh init -backend=false
+Scripts/grafana-tofu.sh validate
+```
+
+Manual Forgejo runs use `.forgejo/workflows/infra-opentofu.yml`. Plan, apply,
+and import modes need `GRAFANA_AUTH` or a decrypted admin password so the
+Grafana provider can reach the API.
+
+## Adoption
+
+The default stack manages the checked-in dashboards:
+
+```text
+services/grafana/dashboards/burrow-overview.json
+services/grafana/dashboards/headscale.json
+services/grafana/dashboards/observability.json
+```
+
+Import existing production objects before enabling apply:
+
+```sh
+Scripts/grafana-tofu.sh import 'grafana_folder.folders["burrow"]' 'burrow'
+Scripts/grafana-tofu.sh import 'grafana_dashboard.dashboards["burrow-overview"]' 'burrow-overview'
+Scripts/grafana-tofu.sh import 'grafana_dashboard.dashboards["burrow-headscale"]' 'burrow-headscale'
+Scripts/grafana-tofu.sh import 'grafana_dashboard.dashboards["burrow-observability"]' 'burrow-observability'
+```

infra/grafana/backend.hcl.example

@@ -0,0 +1,5 @@
+bucket         = "burrow-opentofu-state"
+key            = "grafana/grafana.tfstate"
+region         = "us-west-2"
+dynamodb_table = "burrow-opentofu-locks"
+encrypt        = true

infra/grafana/grafana.tf

@@ -0,0 +1,17 @@
+resource "grafana_folder" "folders" {
+  for_each = var.manage_grafana_dashboards ? var.grafana_folders : {}
+
+  title = each.value.title
+  uid   = each.value.uid
+}
+
+resource "grafana_dashboard" "dashboards" {
+  for_each = var.manage_grafana_dashboards ? var.grafana_dashboards : {}
+
+  config_json = file(startswith(each.value.path, "/") ? each.value.path : "${path.module}/${each.value.path}")
+  folder      = each.value.folder
+  message     = each.value.message
+  overwrite   = each.value.overwrite
+
+  depends_on = [grafana_folder.folders]
+}

infra/grafana/outputs.tf

@@ -0,0 +1,9 @@
+output "grafana_dashboard_urls" {
+  description = "Grafana dashboard URLs managed by this stack."
+  value       = { for name, dashboard in grafana_dashboard.dashboards : name => dashboard.url }
+}
+
+output "grafana_folder_uids" {
+  description = "Grafana folder UIDs managed by this stack."
+  value       = { for name, folder in grafana_folder.folders : name => folder.uid }
+}

infra/grafana/providers.tf

@@ -0,0 +1,4 @@
+provider "grafana" {
+  url  = var.grafana_url
+  auth = var.grafana_auth
+}

infra/grafana/terraform.tfvars.example

@@ -0,0 +1,18 @@
+grafana_url = "https://graphs.burrow.net"
+
+manage_grafana_dashboards = true
+
+grafana_folders = {
+  burrow = {
+    title = "Burrow"
+    uid   = "burrow"
+  }
+}
+
+grafana_dashboards = {
+  burrow-overview = {
+    path      = "../../services/grafana/dashboards/burrow-overview.json"
+    folder    = "burrow"
+    overwrite = true
+  }
+}

infra/grafana/variables.tf

@@ -0,0 +1,56 @@
+variable "grafana_url" {
+  description = "Grafana base URL."
+  type        = string
+  default     = "https://graphs.burrow.net"
+}
+
+variable "grafana_auth" {
+  description = "Grafana API token or basic auth in username:password form. Prefer GRAFANA_AUTH in CI."
+  type        = string
+  default     = null
+  sensitive   = true
+}
+
+variable "manage_grafana_dashboards" {
+  description = "Manage Grafana folders and dashboards through the Grafana API."
+  type        = bool
+  default     = false
+}
+
+variable "grafana_folders" {
+  description = "Grafana folders to create before dashboards."
+  type = map(object({
+    title = string
+    uid   = optional(string)
+  }))
+  default = {
+    burrow = {
+      title = "Burrow"
+      uid   = "burrow"
+    }
+  }
+}
+
+variable "grafana_dashboards" {
+  description = "Grafana dashboards to manage from checked-in JSON."
+  type = map(object({
+    path      = string
+    folder    = optional(string)
+    message   = optional(string, "Managed by Burrow OpenTofu")
+    overwrite = optional(bool, true)
+  }))
+  default = {
+    burrow-overview = {
+      path   = "../../services/grafana/dashboards/burrow-overview.json"
+      folder = "burrow"
+    }
+    burrow-headscale = {
+      path   = "../../services/grafana/dashboards/headscale.json"
+      folder = "burrow"
+    }
+    burrow-observability = {
+      path   = "../../services/grafana/dashboards/observability.json"
+      folder = "burrow"
+    }
+  }
+}

infra/grafana/versions.tf

@@ -0,0 +1,12 @@
+terraform {
+  required_version = ">= 1.8.0"
+
+  required_providers {
+    grafana = {
+      source  = "grafana/grafana"
+      version = ">= 4.36.0, < 5.0"
+    }
+  }
+
+  backend "s3" {}
+}