Add grafana docker network and restrict port binds

ansible/galaxy-requirements.yml

@@ -1,6 +1,7 @@
 collections:
   - ansible.posix
   - community.general
+  - community.docker
 
 roles:
   - src: geerlingguy.docker

ansible/host_vars/forrest.yml

@@ -1 +1,3 @@
 expose_ssh: true
+
+protected_ip: "{{ pve_hosts.forrest.internal_ip }}"

ansible/roles/forrest/files/docker-compose-grafana.yml

@@ -17,12 +17,14 @@ services:
       - GF_SMTP_PASSWORD={{ grafana_smtp_password }}
       - GF_SMTP_FROM_ADDRESS={{ grafana_from_email }}
       - GF_SMTP_FROM_NAME=grafana
-
     volumes:
       - "{{ app_data_dir }}/grafana:/var/lib/grafana"
+    networks:
+      - default
+      - grafana
     restart: unless-stopped
     ports:
-      - 3000:3000
+      - "{{ protected_ip }}:3000:3000"
     depends_on:
       - db
       - renderer
@@ -41,3 +43,8 @@ services:
     restart: unless-stopped
     environment:
       - BROWSER_TZ={{ TZ }}
+
+
+networks:
+  grafana:
+    external: true

ansible/roles/forrest/files/docker-compose-influxdb.yml

@@ -8,8 +8,9 @@ services:
       - /mnt/tank/dbs/influx/forrest:/var/lib/influxdb
     environment:
       - INFLUXDB_HTTP_AUTH_ENABLED=true
-    ports:
+    networks:
-      - 8086:8086
+      - default
+      - grafana
 
   chronograf:
     image: chronograf:1.8-alpine
@@ -21,4 +22,8 @@ services:
     volumes:
       - ./chronograf:/var/lib/chronograf
     ports:
-      - 8888:8888
+      - "{{ protected_ip }}:8888:8888"
+
+networks:
+  grafana:
+    external: true

ansible/roles/forrest/tasks/grafana.yml

@@ -1,3 +1,7 @@
+- name: Create network
+  docker_network:
+    name: grafana
+
 - name: Create grafana install directory
   file:
     path: /opt/grafana