From 1006b8d8996b81c7f44914bf86ddef9a2653cdde Mon Sep 17 00:00:00 2001
From: Slavi Pantaleev <slavi@devture.com>
Date: Wed, 15 Feb 2023 10:30:58 +0200
Subject: [PATCH] Replace matrix-grafana with an external role

---
 CHANGELOG.md                                  | 11 +++
 ...configuring-playbook-prometheus-grafana.md | 14 ++--
 ...onfiguring-playbook-prometheus-nginxlog.md |  6 +-
 group_vars/matrix_servers                     | 69 +++++++++++++-----
 playbooks/matrix.yml                          |  2 +-
 requirements.yml                              |  3 +
 roles/custom/matrix-grafana/defaults/main.yml | 65 -----------------
 roles/custom/matrix-grafana/tasks/main.yml    | 20 -----
 .../matrix-grafana/tasks/setup_install.yml    | 73 -------------------
 .../matrix-grafana/tasks/setup_uninstall.yml  | 20 -----
 .../matrix-grafana/tasks/validate_config.yml  | 16 ----
 .../templates/dashboards.yaml.j2              |  9 ---
 .../templates/datasources.yaml.j2             |  8 --
 .../matrix-grafana/templates/grafana.ini.j2   | 29 --------
 .../systemd/matrix-grafana.service.j2         | 43 -----------
 .../matrix-nginx-proxy/defaults/main.yml      |  5 --
 .../matrix-nginx-proxy/templates/labels.j2    | 13 ----
 .../tasks/setup_install.yml                   |  4 +-
 .../tasks/setup_uninstall.yml                 |  2 +-
 .../defaults/main.yml                         |  3 +
 .../tasks/validate_config.yml                 | 15 ++++
 21 files changed, 97 insertions(+), 333 deletions(-)
 delete mode 100644 roles/custom/matrix-grafana/defaults/main.yml
 delete mode 100644 roles/custom/matrix-grafana/tasks/main.yml
 delete mode 100644 roles/custom/matrix-grafana/tasks/setup_install.yml
 delete mode 100644 roles/custom/matrix-grafana/tasks/setup_uninstall.yml
 delete mode 100644 roles/custom/matrix-grafana/tasks/validate_config.yml
 delete mode 100644 roles/custom/matrix-grafana/templates/dashboards.yaml.j2
 delete mode 100644 roles/custom/matrix-grafana/templates/datasources.yaml.j2
 delete mode 100644 roles/custom/matrix-grafana/templates/grafana.ini.j2
 delete mode 100644 roles/custom/matrix-grafana/templates/systemd/matrix-grafana.service.j2

diff --git a/CHANGELOG.md b/CHANGELOG.md
index bbf1772d..b47433d7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,14 @@
+# 2023-02-15
+
+## The matrix-grafana role lives independently now
+
+**TLDR**: the `matrix-grafana` role is now included from another repository. Some variables have been renamed. All functionality remains intact.
+
+The `matrix-grafana` role (which configures [Grafana](docs/configuring-playbook-prometheus-grafana.md)) has been extracted from the playbook and now lives in its [own repository](https://gitlab.com/etke.cc/roles/grafana). This makes it possible to easily use it in other Ansible playbooks.
+
+You need to **update you roles** (`just roles` or `make roles`) regardless of whether you're enabling Grafana or not. If you're making use of Grafana via this playbook, you will need to update variable references in your `vars.yml` file (`matrix_grafana_` -> `grafana_`).
+
+
 # 2023-02-13
 
 ## The matrix-backup-borg role lives independently now
diff --git a/docs/configuring-playbook-prometheus-grafana.md b/docs/configuring-playbook-prometheus-grafana.md
index 956b0573..de05d690 100644
--- a/docs/configuring-playbook-prometheus-grafana.md
+++ b/docs/configuring-playbook-prometheus-grafana.md
@@ -18,16 +18,16 @@ prometheus_postgres_exporter_enabled: true
 # You can remove this, if unnecessary.
 matrix_prometheus_nginxlog_exporter_enabled: true
 
-matrix_grafana_enabled: true
+grafana_enabled: true
 
-matrix_grafana_anonymous_access: false
+grafana_anonymous_access: false
 
 # This has no relation to your Matrix user id. It can be any username you'd like.
 # Changing the username subsequently won't work.
-matrix_grafana_default_admin_user: "some_username_chosen_by_you"
+grafana_default_admin_user: "some_username_chosen_by_you"
 
 # Changing the password subsequently won't work.
-matrix_grafana_default_admin_password: "some_strong_password_chosen_by_you"
+grafana_default_admin_password: "some_strong_password_chosen_by_you"
 ```
 
 By default, a [Grafana](https://grafana.com/) web user-interface will be available at `https://stats.<your-domain>`.
@@ -43,9 +43,9 @@ Name | Description
 `prometheus_node_exporter_enabled`|[Node Exporter](https://prometheus.io/docs/guides/node-exporter/) is an addon of sorts to Prometheus that collects generic system information such as CPU, memory, filesystem, and even system temperatures
 `prometheus_postgres_exporter_enabled`|[Postgres Exporter](configuring-playbook-prometheus-postgres.md) is an addon of sorts to expose Postgres database metrics to Prometheus.
 `matrix_prometheus_nginxlog_exporter_enabled`|[NGINX Log Exporter](configuring-playbook-prometheus-nginxlog.md) is an addon of sorts to expose NGINX logs to Prometheus.
-`matrix_grafana_enabled`|[Grafana](https://grafana.com/) is the visual component. It shows (on the `stats.<your-domain>` subdomain) the dashboards with the graphs that we're interested in
-`matrix_grafana_anonymous_access`|By default you need to log in to see graphs. If you want to publicly share your graphs (e.g. when asking for help in [`#synapse:matrix.org`](https://matrix.to/#/#synapse:matrix.org?via=matrix.org&via=privacytools.io&via=mozilla.org)) you'll want to enable this option.
-`matrix_grafana_default_admin_user`<br>`matrix_grafana_default_admin_password`|By default Grafana creates a user with `admin` as the username and password. If you feel this is insecure and you want to change it beforehand, you can do that here
+`grafana_enabled`|[Grafana](https://grafana.com/) is the visual component. It shows (on the `stats.<your-domain>` subdomain) the dashboards with the graphs that we're interested in
+`grafana_anonymous_access`|By default you need to log in to see graphs. If you want to publicly share your graphs (e.g. when asking for help in [`#synapse:matrix.org`](https://matrix.to/#/#synapse:matrix.org?via=matrix.org&via=privacytools.io&via=mozilla.org)) you'll want to enable this option.
+`grafana_default_admin_user`<br>`grafana_default_admin_password`|By default Grafana creates a user with `admin` as the username and password. If you feel this is insecure and you want to change it beforehand, you can do that here
 
 
 ## Security and privacy
diff --git a/docs/configuring-playbook-prometheus-nginxlog.md b/docs/configuring-playbook-prometheus-nginxlog.md
index 832efbd8..321a1d6e 100644
--- a/docs/configuring-playbook-prometheus-nginxlog.md
+++ b/docs/configuring-playbook-prometheus-nginxlog.md
@@ -15,13 +15,13 @@ matrix_prometheus_nginxlog_exporter_enabled: true
 matrix_prometheus_enabled: true
 
 # optional for visualization
-matrix_grafana_enabled: true
+grafana_enabled: true
 ```
 
 x | Prerequisites | Variable | Description
 |:--:|:--:|:--:|:--|
 **REQUIRED** | `matrix-prometheus`| `matrix_prometheus_enabled`|[Prometheus](https://prometheus.io) is a time series database. It holds all the data we're going to talk about.
-_Optional_ | [`matrix-grafana`](configuring-playbook-prometheus-grafana.md) | [`matrix_grafana_enabled`](configuring-playbook-prometheus-grafana.md)|[Grafana](https://grafana.com) is the visual component. It shows (on the `stats.<your-domain>` subdomain) graphs that we're interested in. When enabled the `NGINX PROXY` dashboard is automatically added.
+_Optional_ | [`matrix-grafana`](configuring-playbook-prometheus-grafana.md) | [`grafana_enabled`](configuring-playbook-prometheus-grafana.md)|[Grafana](https://grafana.com) is the visual component. It shows (on the `stats.<your-domain>` subdomain) graphs that we're interested in. When enabled the `NGINX PROXY` dashboard is automatically added.
 
 ## Docker Image Compatibility
 
@@ -56,4 +56,4 @@ The following variables may be of interest:
 
 Name | Description
 -----|----------
-`matrix_nginx_proxy_proxy_matrix_metrics_enabled`|Set this to `true` to enable metrics exposure for various services on `https://matrix.DOMAIN/metrics/*`. Refer to the individual `matrix_SERVICE_metrics_proxying_enabled` variables below for exposing metrics for each individual service.
\ No newline at end of file
+`matrix_nginx_proxy_proxy_matrix_metrics_enabled`|Set this to `true` to enable metrics exposure for various services on `https://matrix.DOMAIN/metrics/*`. Refer to the individual `matrix_SERVICE_metrics_proxying_enabled` variables below for exposing metrics for each individual service.
diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers
index 3e64c14a..76b718ef 100755
--- a/group_vars/matrix_servers
+++ b/group_vars/matrix_servers
@@ -306,7 +306,7 @@ devture_systemd_service_manager_services_list_auto: |
     +
     ([{'name': 'matrix-etherpad.service', 'priority': 4000, 'groups': ['matrix', 'etherpad']}] if matrix_etherpad_enabled else [])
     +
-    ([{'name': 'matrix-grafana.service', 'priority': 4000, 'groups': ['matrix', 'monitoring', 'grafana']}] if matrix_grafana_enabled else [])
+    ([{'name': (grafana_identifier + '.service'), 'priority': 4000, 'groups': ['matrix', 'monitoring', 'grafana']}] if grafana_enabled else [])
     +
     ([{'name': 'matrix-jitsi-web.service', 'priority': 4200, 'groups': ['matrix', 'jitsi', 'jitsi-web']}] if matrix_jitsi_enabled else [])
     +
@@ -2389,7 +2389,7 @@ matrix_nginx_proxy_proxy_bot_go_neb_enabled: "{{ matrix_bot_go_neb_enabled }}"
 matrix_nginx_proxy_proxy_jitsi_enabled: "{{ matrix_jitsi_enabled }}"
 matrix_nginx_proxy_proxy_jitsi_manage_wellknown: "{{ matrix_jitsi_require_well_known }}"
 
-matrix_nginx_proxy_proxy_grafana_enabled: "{{ matrix_grafana_enabled }}"
+matrix_nginx_proxy_proxy_grafana_enabled: "{{ grafana_enabled }}"
 matrix_nginx_proxy_proxy_sygnal_enabled: "{{ matrix_sygnal_enabled }}"
 matrix_nginx_proxy_proxy_ntfy_enabled: "{{ matrix_ntfy_enabled }}"
 
@@ -2403,7 +2403,6 @@ matrix_nginx_proxy_container_labels_traefik_proxy_dimension_enabled: "{{ matrix_
 matrix_nginx_proxy_container_labels_traefik_proxy_etherpad_enabled: "{{ matrix_etherpad_enabled and matrix_etherpad_mode == 'standalone' }}"
 matrix_nginx_proxy_container_labels_traefik_proxy_bot_go_neb_enabled: "{{ matrix_bot_go_neb_enabled }}"
 matrix_nginx_proxy_container_labels_traefik_proxy_jitsi_enabled: "{{ matrix_jitsi_enabled }}"
-matrix_nginx_proxy_container_labels_traefik_proxy_grafana_enabled: "{{ matrix_grafana_enabled }}"
 matrix_nginx_proxy_container_labels_traefik_proxy_sygnal_enabled: "{{ matrix_sygnal_enabled }}"
 matrix_nginx_proxy_container_labels_traefik_proxy_ntfy_enabled: "{{ matrix_ntfy_enabled }}"
 
@@ -2481,7 +2480,7 @@ matrix_nginx_proxy_systemd_wanted_services_list: |
     +
     (['matrix-client-hydrogen.service'] if matrix_client_hydrogen_enabled else [])
     +
-    (['matrix-grafana.service'] if matrix_grafana_enabled else [])
+    ([(grafana_idenifier + '.service')] if grafana_enabled else [])
     +
     (['matrix-dimension.service'] if matrix_dimension_enabled else [])
     +
@@ -2520,7 +2519,7 @@ matrix_ssl_domains_to_obtain_certificates_for: |
     +
     ([matrix_server_fqn_jitsi] if matrix_jitsi_enabled else [])
     +
-    ([matrix_server_fqn_grafana] if matrix_grafana_enabled else [])
+    ([matrix_server_fqn_grafana] if grafana_enabled else [])
     +
     ([matrix_server_fqn_sygnal] if matrix_sygnal_enabled else [])
     +
@@ -2938,7 +2937,7 @@ matrix_client_element_container_additional_networks: "{{ [matrix_playbook_revers
 
 matrix_client_element_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
 matrix_client_element_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
-matrix_client_element_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary if devture_traefik_enabled else '' }}"
+matrix_client_element_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
 
 matrix_client_element_default_hs_url: "{{ matrix_homeserver_url }}"
 matrix_client_element_default_is_url: "{{ matrix_identity_server_url }}"
@@ -2991,7 +2990,7 @@ matrix_client_hydrogen_container_additional_networks: "{{ [matrix_playbook_rever
 
 matrix_client_hydrogen_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
 matrix_client_hydrogen_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
-matrix_client_hydrogen_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary if devture_traefik_enabled else '' }}"
+matrix_client_hydrogen_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
 
 matrix_client_hydrogen_default_hs_url: "{{ matrix_homeserver_url }}"
 
@@ -3024,7 +3023,7 @@ matrix_client_cinny_container_additional_networks: "{{ [matrix_playbook_reverse_
 
 matrix_client_cinny_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
 matrix_client_cinny_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
-matrix_client_cinny_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary if devture_traefik_enabled else '' }}"
+matrix_client_cinny_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
 
 matrix_client_cinny_default_hs_url: "{{ matrix_homeserver_url }}"
 
@@ -3192,7 +3191,7 @@ matrix_synapse_admin_container_additional_networks: "{{ [matrix_playbook_reverse
 
 matrix_synapse_admin_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
 matrix_synapse_admin_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
-matrix_synapse_admin_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary if devture_traefik_enabled else '' }}"
+matrix_synapse_admin_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
 
 ######################################################################
 #
@@ -3329,18 +3328,52 @@ matrix_prometheus_scraper_nginxlog_server_port: "{{ (matrix_prometheus_nginxlog_
 
 ######################################################################
 #
-# matrix-grafana
+# etke/grafana
 #
 ######################################################################
 
-matrix_grafana_enabled: false
+grafana_enabled: false
+
+grafana_identifier: matrix-grafana
+
+grafana_uid: "{{ matrix_user_uid }}"
+grafana_gid: "{{ matrix_user_gid }}"
+
+grafana_hostname: "{{ matrix_server_fqn_grafana }}"
+
+grafana_base_path: "{{ matrix_base_data_path }}/grafana"
+
+grafana_container_network: "{{ matrix_nginx_proxy_container_network if matrix_playbook_reverse_proxy_type == 'playbook-managed-nginx' else grafana_identifier }}"
+
+grafana_container_additional_networks: |
+  {{
+    (
+      ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else [])
+      +
+      ([matrix_prometheus_container_network] if matrix_prometheus_enabled and matrix_prometheus_container_network != grafana_container_network else [])
+    ) | unique
+  }}
+
+grafana_container_labels_traefik_enabled: "{{ matrix_playbook_traefik_labels_enabled }}"
+grafana_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
+grafana_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
 
 # Normally, matrix-nginx-proxy is enabled and nginx can reach Grafana over the container network.
 # If matrix-nginx-proxy is not enabled, or you otherwise have a need for it, you can expose
 # Grafana's HTTP port to the local host.
-matrix_grafana_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '3000') if matrix_playbook_service_host_bind_interface_prefix else '' }}"
+grafana_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '3000') if matrix_playbook_service_host_bind_interface_prefix else '' }}"
+
+grafana_provisioning_datasources: |
+  {{
+    ([{
+      'name': (matrix_server_fqn_matrix + ' - Prometheus'),
+      'type': 'prometheus',
+      'access': 'proxy',
+      'url': 'http://matrix-prometheus:9090',
+    }] if matrix_prometheus_enabled else [])
+  }}
 
-matrix_grafana_dashboard_download_urls: |
+grafana_dashboard_download_urls: |
   {{
     (matrix_synapse_grafana_dashboard_urls if matrix_homeserver_implementation == 'synapse' and matrix_synapse_metrics_enabled else [])
     +
@@ -3351,18 +3384,18 @@ matrix_grafana_dashboard_download_urls: |
     (matrix_prometheus_nginxlog_exporter_dashboard_urls if matrix_prometheus_nginxlog_exporter_enabled else [])
   }}
 
-matrix_grafana_default_home_dashboard_path: |-
+grafana_default_home_dashboard_path: |-
   {{
     {
-      'synapse': ('/etc/grafana/dashboards/synapse.json' if matrix_synapse_metrics_enabled else '/etc/grafana/dashboards/node-exporter-full.json'),
-      'dendrite': '/etc/grafana/dashboards/node-exporter-full.json',
-      'conduit': '/etc/grafana/dashboards/node-exporter-full.json',
+      'synapse': ('/etc/grafana/dashboards/synapse.json' if matrix_synapse_metrics_enabled and matrix_synapse_metrics_enabled else ('/etc/grafana/dashboards/node-exporter-full.json' if prometheus_node_exporter_enabled else '')),
+      'dendrite': ('/etc/grafana/dashboards/node-exporter-full.json' if prometheus_node_exporter_enabled else ''),
+      'conduit': ('/etc/grafana/dashboards/node-exporter-full.json' if prometheus_node_exporter_enabled else ''),
     }[matrix_homeserver_implementation]
   }}
 
 ######################################################################
 #
-# /matrix-grafana
+# /etke/grafana
 #
 ######################################################################
 
diff --git a/playbooks/matrix.yml b/playbooks/matrix.yml
index d976a012..f5e21493 100755
--- a/playbooks/matrix.yml
+++ b/playbooks/matrix.yml
@@ -91,7 +91,7 @@
     - galaxy/prometheus_postgres_exporter
     - custom/matrix-prometheus-nginxlog-exporter
     - custom/matrix-prometheus
-    - custom/matrix-grafana
+    - galaxy/grafana
     - custom/matrix-prometheus-services-proxy-connect
     - custom/matrix-registration
     - custom/matrix-client-element
diff --git a/requirements.yml b/requirements.yml
index 1244c465..829ef99b 100644
--- a/requirements.yml
+++ b/requirements.yml
@@ -39,6 +39,9 @@
 - src: git+https://gitlab.com/etke.cc/roles/backup_borg.git
   version: v1.2.3-1.7.6-0
 
+- src: git+https://gitlab.com/etke.cc/roles/grafana.git
+  version: v9.3.6-0
+
 - src: git+https://github.com/devture/com.devture.ansible.role.traefik.git
   version: fb09fd26f877372417d5586f1e79e83f983f0bd6
 
diff --git a/roles/custom/matrix-grafana/defaults/main.yml b/roles/custom/matrix-grafana/defaults/main.yml
deleted file mode 100644
index 5b730480..00000000
--- a/roles/custom/matrix-grafana/defaults/main.yml
+++ /dev/null
@@ -1,65 +0,0 @@
----
-# matrix-grafana is open source visualization and analytics software
-# See: https://github.com/matrix-org/synapse/blob/master/docs/metrics-howto.md
-# Project source code URL: https://github.com/grafana/grafana
-
-matrix_grafana_enabled: true
-
-matrix_grafana_version: 9.3.6
-matrix_grafana_docker_image: "{{ matrix_container_global_registry_prefix }}grafana/grafana:{{ matrix_grafana_version }}"
-matrix_grafana_docker_image_force_pull: "{{ matrix_grafana_docker_image.endswith(':latest') }}"
-
-# matrix_grafana_dashboard_download_urls holds a list of URLs of dashboards to download
-matrix_grafana_dashboard_download_urls: []
-
-matrix_grafana_base_path: "{{ matrix_base_data_path }}/grafana"
-matrix_grafana_config_path: "{{ matrix_grafana_base_path }}/config"
-matrix_grafana_data_path: "{{ matrix_grafana_base_path }}/data"
-
-# Allow viewing Grafana without logging in
-matrix_grafana_anonymous_access: false
-
-# When `false`, sends a `X-Frame-Options: deny` HTTP header, which allows Grafana from being embeded in a frame.
-# Read more here: https://grafana.com/docs/grafana/latest/administration/configuration/#allow_embedding
-matrix_grafana_allow_embedding: false
-
-# specify organization name that should be used for unauthenticated users
-# if you change this in the Grafana admin panel, this needs to be updated
-# to match to keep anonymous logins working
-matrix_grafana_anonymous_access_org_name: 'Main Org.'
-
-
-# default admin credentials, you are asked to change these on first login
-matrix_grafana_default_admin_user: admin
-matrix_grafana_default_admin_password: admin
-
-# Set to true to add the Content-Security-Policy header to your requests.
-# CSP allows to control resources that the user agent can load and helps
-# prevent XSS attacks.
-# [Content Security Policy](https://grafana.com/docs/grafana/latest/administration/configuration/#content_security_policy)
-matrix_grafana_content_security_policy: true
-
-# specify content security policy template to customized template
-# added https: and http: url schemes (ignored by browsers supporting 'strict-dynamic') to be backward compatible with older browsers.
-# [Content Security Policy Browser Test] (https://content-security-policy.com/browser-test/)
-# [Content Security Policy Reference](https://content-security-policy.com/script-src/)
-matrix_grafana_content_security_policy_customized: false
-matrix_grafana_content_security_policy_template: "script-src 'self' 'unsafe-eval' 'unsafe-inline' http: https: 'strict-dynamic' $NONCE;object-src 'none';font-src 'self';style-src 'self' 'unsafe-inline' blob:;img-src * data:;base-uri 'self';connect-src 'self' grafana.com ws://$ROOT_PATH wss://$ROOT_PATH;manifest-src 'self';media-src 'none';form-action 'self';"
-
-# matrix_grafana_default_home_dashboard_path influences the `default_home_dashboard_path` grafana.ini setting,
-# which is an in-container path for the default dashboard.
-matrix_grafana_default_home_dashboard_path: /etc/grafana/dashboards/node-exporter-full.json
-
-# A list of extra arguments to pass to the container
-matrix_grafana_container_extra_arguments: []
-
-# List of systemd services that matrix-grafana.service depends on
-matrix_grafana_systemd_required_services_list: ['docker.service']
-
-# List of systemd services that matrix-grafana.service wants
-matrix_grafana_systemd_wanted_services_list: []
-
-# Controls whether the matrix-grafana container exposes its HTTP port (tcp/3000 in the container).
-#
-# Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:3000"), or empty string to not expose.
-matrix_grafana_container_http_host_bind_port: ''
diff --git a/roles/custom/matrix-grafana/tasks/main.yml b/roles/custom/matrix-grafana/tasks/main.yml
deleted file mode 100644
index 263d894f..00000000
--- a/roles/custom/matrix-grafana/tasks/main.yml
+++ /dev/null
@@ -1,20 +0,0 @@
----
-
-- block:
-    - when: matrix_grafana_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
-
-    - when: matrix_grafana_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
-    - setup-all
-    - setup-grafana
-    - install-all
-    - install-grafana
-
-- block:
-    - when: not matrix_grafana_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-grafana
diff --git a/roles/custom/matrix-grafana/tasks/setup_install.yml b/roles/custom/matrix-grafana/tasks/setup_install.yml
deleted file mode 100644
index 86a6b04b..00000000
--- a/roles/custom/matrix-grafana/tasks/setup_install.yml
+++ /dev/null
@@ -1,73 +0,0 @@
----
-
-- name: Ensure matrix-grafana image is pulled
-  community.docker.docker_image:
-    name: "{{ matrix_grafana_docker_image }}"
-    source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
-    force_source: "{{ matrix_grafana_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
-    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_grafana_docker_image_force_pull }}"
-  register: result
-  retries: "{{ devture_playbook_help_container_retries_count }}"
-  delay: "{{ devture_playbook_help_container_retries_delay }}"
-  until: result is not failed
-
-- name: Ensure grafana paths exists
-  ansible.builtin.file:
-    path: "{{ item }}"
-    state: directory
-    mode: 0750
-    owner: "{{ matrix_user_username }}"
-    group: "{{ matrix_user_groupname }}"
-  with_items:
-    - "{{ matrix_grafana_base_path }}"
-    - "{{ matrix_grafana_config_path }}"
-    - "{{ matrix_grafana_config_path }}/provisioning"
-    - "{{ matrix_grafana_config_path }}/provisioning/datasources"
-    - "{{ matrix_grafana_config_path }}/provisioning/dashboards"
-    - "{{ matrix_grafana_config_path }}/dashboards"
-    - "{{ matrix_grafana_data_path }}"
-
-- name: Ensure grafana.ini present
-  ansible.builtin.template:
-    src: "{{ role_path }}/templates/grafana.ini.j2"
-    dest: "{{ matrix_grafana_config_path }}/grafana.ini"
-    mode: 0440
-    owner: "{{ matrix_user_username }}"
-    group: "{{ matrix_user_groupname }}"
-
-- name: Ensure provisioning/datasources/default.yaml present
-  ansible.builtin.template:
-    src: "{{ role_path }}/templates/datasources.yaml.j2"
-    dest: "{{ matrix_grafana_config_path }}/provisioning/datasources/default.yaml"
-    mode: 0440
-    owner: "{{ matrix_user_username }}"
-    group: "{{ matrix_user_groupname }}"
-
-- name: Ensure provisioning/dashboards/default.yaml present
-  ansible.builtin.template:
-    src: "{{ role_path }}/templates/dashboards.yaml.j2"
-    dest: "{{ matrix_grafana_config_path }}/provisioning/dashboards/default.yaml"
-    mode: 0440
-    owner: "{{ matrix_user_username }}"
-    group: "{{ matrix_user_groupname }}"
-
-- name: Ensure dashboard(s) downloaded
-  ansible.builtin.get_url:
-    url: "{{ item }}"
-    dest: "{{ matrix_grafana_config_path }}/dashboards/"
-    force: true
-    mode: 0440
-    owner: "{{ matrix_user_username }}"
-    group: "{{ matrix_user_groupname }}"
-  with_items: "{{ matrix_grafana_dashboard_download_urls }}"
-  register: result
-  retries: "{{ devture_playbook_help_geturl_retries_count }}"
-  delay: "{{ devture_playbook_help_geturl_retries_delay }}"
-  until: result is not failed
-
-- name: Ensure matrix-grafana.service installed
-  ansible.builtin.template:
-    src: "{{ role_path }}/templates/systemd/matrix-grafana.service.j2"
-    dest: "{{ devture_systemd_docker_base_systemd_path }}/matrix-grafana.service"
-    mode: 0644
-  register: matrix_grafana_systemd_service_result
diff --git a/roles/custom/matrix-grafana/tasks/setup_uninstall.yml b/roles/custom/matrix-grafana/tasks/setup_uninstall.yml
deleted file mode 100644
index 12c3cde9..00000000
--- a/roles/custom/matrix-grafana/tasks/setup_uninstall.yml
+++ /dev/null
@@ -1,20 +0,0 @@
----
-
-- name: Check existence of matrix-grafana service
-  ansible.builtin.stat:
-    path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-grafana.service"
-  register: matrix_grafana_service_stat
-
-- when: matrix_grafana_service_stat.stat.exists | bool
-  block:
-    - name: Ensure matrix-grafana is stopped
-      ansible.builtin.service:
-        name: matrix-grafana
-        state: stopped
-        enabled: false
-        daemon_reload: true
-
-    - name: Ensure matrix-grafana.service doesn't exist
-      ansible.builtin.file:
-        path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-grafana.service"
-        state: absent
diff --git a/roles/custom/matrix-grafana/tasks/validate_config.yml b/roles/custom/matrix-grafana/tasks/validate_config.yml
deleted file mode 100644
index 21c44dc8..00000000
--- a/roles/custom/matrix-grafana/tasks/validate_config.yml
+++ /dev/null
@@ -1,16 +0,0 @@
----
-
-- name: Fail if Prometheus not enabled
-  ansible.builtin.fail:
-    msg: >
-      You need to enable `matrix_prometheus_enabled` to use Prometheus as data source for Grafana.
-  when: "not matrix_prometheus_enabled"
-
-- name: (Deprecation) Catch and report renamed settings
-  ansible.builtin.fail:
-    msg: >-
-      Your configuration contains a variable, which now has a different name.
-      Please change your configuration to rename the variable (`{{ item.old }}` -> `{{ item.new }}`).
-  when: "item.old in vars"
-  with_items:
-    - {'old': 'matrix_grafana_dashboard_download_urls_all', 'new': 'matrix_grafana_dashboard_download_urls'}
diff --git a/roles/custom/matrix-grafana/templates/dashboards.yaml.j2 b/roles/custom/matrix-grafana/templates/dashboards.yaml.j2
deleted file mode 100644
index aae42ba2..00000000
--- a/roles/custom/matrix-grafana/templates/dashboards.yaml.j2
+++ /dev/null
@@ -1,9 +0,0 @@
-apiVersion: 1
-
-providers:
-  - name: {{ matrix_server_fqn_matrix }} - Dashboards
-    folder: '' # The folder where to place the dashboards
-    type: file
-    allowUiUpdates: true
-    options:
-      path: /etc/grafana/dashboards
diff --git a/roles/custom/matrix-grafana/templates/datasources.yaml.j2 b/roles/custom/matrix-grafana/templates/datasources.yaml.j2
deleted file mode 100644
index 6ccbe374..00000000
--- a/roles/custom/matrix-grafana/templates/datasources.yaml.j2
+++ /dev/null
@@ -1,8 +0,0 @@
-apiVersion: 1
-
-datasources:
-  - name: {{ matrix_server_fqn_matrix }} - Prometheus
-    type: prometheus
-    # Access mode - proxy (server in the UI) or direct (browser in the UI).
-    access: proxy
-    url: http://matrix-prometheus:9090
diff --git a/roles/custom/matrix-grafana/templates/grafana.ini.j2 b/roles/custom/matrix-grafana/templates/grafana.ini.j2
deleted file mode 100644
index ac609f91..00000000
--- a/roles/custom/matrix-grafana/templates/grafana.ini.j2
+++ /dev/null
@@ -1,29 +0,0 @@
-[server]
-root_url = "https://{{ matrix_server_fqn_grafana }}"
-
-[security]
-# default admin user, created on startup
-admin_user = "{{ matrix_grafana_default_admin_user }}"
-
-# default admin password, can be changed before first start of grafana, or in profile settings
-admin_password = """{{ matrix_grafana_default_admin_password }}"""
-
-# specify content_security_policy to add the Content-Security-Policy header to your requests
-content_security_policy = "{{ matrix_grafana_content_security_policy }}"
-
-# specify content security policy template to customized template
-{% if matrix_grafana_content_security_policy_customized %}
-content_security_policy_template = """{{ matrix_grafana_content_security_policy_template }}"""
-{% endif %}
-
-allow_embedding = {{ matrix_grafana_allow_embedding }}
-
-[auth.anonymous]
-# enable anonymous access
-enabled = {{ matrix_grafana_anonymous_access }}
-
-# specify organization name that should be used for unauthenticated users
-org_name = "{{ matrix_grafana_anonymous_access_org_name }}"
-
-[dashboards]
-default_home_dashboard_path = {{ matrix_grafana_default_home_dashboard_path }}
diff --git a/roles/custom/matrix-grafana/templates/systemd/matrix-grafana.service.j2 b/roles/custom/matrix-grafana/templates/systemd/matrix-grafana.service.j2
deleted file mode 100644
index fd48b01e..00000000
--- a/roles/custom/matrix-grafana/templates/systemd/matrix-grafana.service.j2
+++ /dev/null
@@ -1,43 +0,0 @@
-#jinja2: lstrip_blocks: "True"
-[Unit]
-Description=matrix-grafana
-{% for service in matrix_grafana_systemd_required_services_list %}
-Requires={{ service }}
-After={{ service }}
-{% endfor %}
-{% for service in matrix_grafana_systemd_wanted_services_list %}
-Wants={{ service }}
-{% endfor %}
-DefaultDependencies=no
-
-[Service]
-Type=simple
-Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}"
-ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} kill matrix-grafana 2>/dev/null || true'
-ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-grafana 2>/dev/null || true'
-
-
-ExecStart={{ devture_systemd_docker_base_host_command_docker }} run --rm --name matrix-grafana \
-			--log-driver=none \
-			--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
-			--cap-drop=ALL \
-			--read-only \
-			--network={{ matrix_docker_network }} \
-			{% if matrix_grafana_container_http_host_bind_port %}
-			-p {{ matrix_grafana_container_http_host_bind_port }}:3000 \
-			{% endif %}
-			-v {{ matrix_grafana_config_path }}:/etc/grafana:z \
-			-v {{ matrix_grafana_data_path }}:/var/lib/grafana:z \
-			{% for arg in matrix_grafana_container_extra_arguments %}
-			{{ arg }} \
-			{% endfor %}
-			{{ matrix_grafana_docker_image }}
-
-ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} kill matrix-grafana 2>/dev/null || true'
-ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-grafana 2>/dev/null || true'
-Restart=always
-RestartSec=30
-SyslogIdentifier=matrix-grafana
-
-[Install]
-WantedBy=multi-user.target
diff --git a/roles/custom/matrix-nginx-proxy/defaults/main.yml b/roles/custom/matrix-nginx-proxy/defaults/main.yml
index 2b3d1eb1..38afb3c4 100644
--- a/roles/custom/matrix-nginx-proxy/defaults/main.yml
+++ b/roles/custom/matrix-nginx-proxy/defaults/main.yml
@@ -86,11 +86,6 @@ matrix_nginx_proxy_container_labels_traefik_proxy_jitsi_hostname: "{{ matrix_ser
 matrix_nginx_proxy_container_labels_traefik_proxy_jitsi_tls: "{{ matrix_nginx_proxy_container_labels_traefik_entrypoints != 'web' }}"
 matrix_nginx_proxy_container_labels_traefik_proxy_jitsi_rule: "Host(`{{ matrix_nginx_proxy_container_labels_traefik_proxy_jitsi_hostname }}`)"
 
-matrix_nginx_proxy_container_labels_traefik_proxy_grafana_enabled: false
-matrix_nginx_proxy_container_labels_traefik_proxy_grafana_hostname: "{{ matrix_server_fqn_grafana }}"
-matrix_nginx_proxy_container_labels_traefik_proxy_grafana_tls: "{{ matrix_nginx_proxy_container_labels_traefik_entrypoints != 'web' }}"
-matrix_nginx_proxy_container_labels_traefik_proxy_grafana_rule: "Host(`{{ matrix_nginx_proxy_container_labels_traefik_proxy_grafana_hostname }}`)"
-
 matrix_nginx_proxy_container_labels_traefik_proxy_sygnal_enabled: false
 matrix_nginx_proxy_container_labels_traefik_proxy_sygnal_hostname: "{{ matrix_server_fqn_sygnal }}"
 matrix_nginx_proxy_container_labels_traefik_proxy_sygnal_tls: "{{ matrix_nginx_proxy_container_labels_traefik_entrypoints != 'web' }}"
diff --git a/roles/custom/matrix-nginx-proxy/templates/labels.j2 b/roles/custom/matrix-nginx-proxy/templates/labels.j2
index 2676b061..4565da19 100644
--- a/roles/custom/matrix-nginx-proxy/templates/labels.j2
+++ b/roles/custom/matrix-nginx-proxy/templates/labels.j2
@@ -97,19 +97,6 @@ traefik.http.routers.matrix-nginx-proxy-jitsi.tls.certResolver={{ matrix_nginx_p
 traefik.http.routers.matrix-nginx-proxy-jitsi.entrypoints={{ matrix_nginx_proxy_container_labels_traefik_entrypoints }}
 {% endif %}
 
-
-{% if matrix_nginx_proxy_container_labels_traefik_proxy_grafana_enabled %}
-# Grafana
-traefik.http.routers.matrix-nginx-proxy-grafana.rule={{ matrix_nginx_proxy_container_labels_traefik_proxy_grafana_rule }}
-traefik.http.routers.matrix-nginx-proxy-grafana.service=matrix-nginx-proxy-web
-traefik.http.routers.matrix-nginx-proxy-grafana.tls={{ matrix_nginx_proxy_container_labels_traefik_proxy_grafana_tls | to_json }}
-{% if matrix_nginx_proxy_container_labels_traefik_proxy_grafana_tls %}
-traefik.http.routers.matrix-nginx-proxy-grafana.tls.certResolver={{ matrix_nginx_proxy_container_labels_traefik_tls_certResolver }}
-{% endif %}
-traefik.http.routers.matrix-nginx-proxy-grafana.entrypoints={{ matrix_nginx_proxy_container_labels_traefik_entrypoints }}
-{% endif %}
-
-
 {% if matrix_nginx_proxy_container_labels_traefik_proxy_sygnal_enabled %}
 # Sygnal
 traefik.http.routers.matrix-nginx-proxy-sygnal.rule={{ matrix_nginx_proxy_container_labels_traefik_proxy_sygnal_rule }}
diff --git a/roles/custom/matrix-prometheus-nginxlog-exporter/tasks/setup_install.yml b/roles/custom/matrix-prometheus-nginxlog-exporter/tasks/setup_install.yml
index 9b2ac3e6..2835b2c9 100644
--- a/roles/custom/matrix-prometheus-nginxlog-exporter/tasks/setup_install.yml
+++ b/roles/custom/matrix-prometheus-nginxlog-exporter/tasks/setup_install.yml
@@ -33,11 +33,11 @@
 - name: Ensure grafana dashboard is installed
   ansible.builtin.template:
     src: "{{ role_path }}/templates/nginx-proxy.json"
-    dest: "{{ matrix_grafana_config_path }}/dashboards/"
+    dest: "{{ grafana_config_path }}/dashboards/"
     mode: 0644
     owner: "{{ matrix_user_username }}"
     group: "{{ matrix_user_groupname }}"
-  when: matrix_grafana_enabled
+  when: grafana_enabled
 
 - name: Ensure matrix-prometheus-nginxlog-exporter.service installed
   ansible.builtin.template:
diff --git a/roles/custom/matrix-prometheus-nginxlog-exporter/tasks/setup_uninstall.yml b/roles/custom/matrix-prometheus-nginxlog-exporter/tasks/setup_uninstall.yml
index c0d0a833..6fce44ae 100644
--- a/roles/custom/matrix-prometheus-nginxlog-exporter/tasks/setup_uninstall.yml
+++ b/roles/custom/matrix-prometheus-nginxlog-exporter/tasks/setup_uninstall.yml
@@ -35,5 +35,5 @@
 
     - name: Ensure matrix-prometheus-nginxlog-exporter grafana dashboard doesn't exist
       ansible.builtin.file:
-        path: "{{ matrix_grafana_config_path }}/dashboards/nginx-proxy.json"
+        path: "{{ grafana_config_path }}/dashboards/nginx-proxy.json"
         state: absent
diff --git a/roles/custom/matrix_playbook_migration/defaults/main.yml b/roles/custom/matrix_playbook_migration/defaults/main.yml
index 109ecd72..03867679 100644
--- a/roles/custom/matrix_playbook_migration/defaults/main.yml
+++ b/roles/custom/matrix_playbook_migration/defaults/main.yml
@@ -8,3 +8,6 @@ matrix_playbook_migration_matrix_prometheus_postgres_exporter_migration_validati
 
 # Controls if (`matrix_backup_borg` -> `backup_borg`) validation will run.
 matrix_playbook_migration_matrix_backup_borg_migration_validation_enabled: true
+
+# Controls if (`matrix_grafana` -> `grafana`) validation will run.
+matrix_playbook_migration_matrix_grafana_migration_validation_enabled: true
diff --git a/roles/custom/matrix_playbook_migration/tasks/validate_config.yml b/roles/custom/matrix_playbook_migration/tasks/validate_config.yml
index f588ed08..2ac04ece 100644
--- a/roles/custom/matrix_playbook_migration/tasks/validate_config.yml
+++ b/roles/custom/matrix_playbook_migration/tasks/validate_config.yml
@@ -95,3 +95,18 @@
           Please change your configuration (vars.yml) to rename all variables (`matrix_backup_borg_` -> `backup_borg_`).
           We found usage of the following variables: {{ matrix_playbook_migration_backup_borg_migration_vars.keys() | join(', ') }}
       when: "matrix_playbook_migration_backup_borg_migration_vars | length > 0"
+
+- when: matrix_playbook_migration_matrix_grafana_migration_validation_enabled | bool
+  block:
+    - ansible.builtin.set_fact:
+        matrix_playbook_migration_grafana_migration_vars: |-
+          {{ vars | dict2items | selectattr('key', 'match', 'matrix_grafana_.*') | list | items2dict }}
+
+    - name: (Deprecation) Catch and report matrix_grafana variables
+      ansible.builtin.fail:
+        msg: >-
+          The matrix-grafana role that used to be part of this playbook has been replaced by https://gitlab.com/etke.cc/roles/grafana.
+          The new role is compatible with the old one, but uses different names for its variables.
+          Please change your configuration (vars.yml) to rename all variables (`matrix_grafana_` -> `grafana_`).
+          We found usage of the following variables: {{ matrix_playbook_migration_grafana_migration_vars.keys() | join(', ') }}
+      when: "matrix_playbook_migration_grafana_migration_vars | length > 0"