add wip role for superset

playbooks/georchestra.yml

@@ -5,6 +5,7 @@
   become: true
   roles:
     - { role: georchestra, tags: georchestra }
+    - { role: superset, tags: superset, when: superset.enabled }
     - { role: elastic.elasticsearch, tags: es }
     - { role: geerlingguy.kibana, tags: kibana }
   vars:
@@ -246,6 +247,12 @@
     gateway:
       enabled: false
       port: 8980
+    superset:
+      enabled: true
+      secretkey: CHANGEME
+      urlprefix: dashboards # XXX rebuild superset-frontend assets if changed
+      port: 9080 # gunicorn port
+      vhostport: 9180 # required for extra vhost doing the X-Forwarded-Prefix dance
   tasks:
     - name: reconfigure Kibana after geerlingguy.kibana
       copy:

roles/georchestra/templates/security-proxy/targets-mapping.properties.j2

@@ -12,3 +12,6 @@ mviewer=http://localhost:{{ mviewer.port }}/
 {% if mviewerstudio.enabled %}
 mviewerstudio=http://localhost:{{ mviewerstudio.port }}/
 {% endif %}
+{% if superset.enabled %}
+{{ superset.urlprefix }}=http://localhost:{{ superset.vhostport }}/{{ superset.urlprefix }}/
+{% endif %}

roles/nginx/templates/vhost.j2

@@ -129,3 +129,25 @@ server {
 		}
 	}
 }
+{% if superset.enabled %}
+
+server {
+	listen 127.0.0.1:{{ superset.vhostport }};
+	server_name localhost_superset;
+	# superset with prefix..
+	location /{{ superset.urlprefix }}/ {
+		# The trailing '/' is key both in the location argument
+		# argument on the line above and the proxy_pass line below so that nginx strips
+		# the prefix before forwarding it to the application server.
+		proxy_pass	http://localhost:{{ superset.port }}/;
+		proxy_set_header Host $http_host; # {{ georchestra.fqdn }}; ?
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Proto $scheme;
+		proxy_set_header X-Forwarded-Prefix  "/{{ superset.urlprefix }}";
+		proxy_http_version 1.1;
+		port_in_redirect off;
+		proxy_connect_timeout 300;
+	}
+}
+{% endif %}

roles/superset/tasks/database.yml

@@ -0,0 +1,27 @@
+- name: Create database schema
+  community.postgresql.postgresql_schema:
+    name: superset
+    owner: "{{ georchestra.db.user }}"
+    database: "{{ georchestra.db.name }}"
+
+- name: List existing database tables
+  command: psql -d {{ georchestra.db.name }} -t -c "select * from pg_tables where schemaname='superset';"
+  register: sset_table_exists
+
+- name: Initialize superset database schema
+  command: /srv/apps/superset/venv/bin/superset db upgrade
+  environment:
+    FLASK_APP: superset
+    SUPERSET_CONFIG_PATH: /srv/apps/superset/superset_config.py
+  when: sset_table_exists.stdout is defined and 'ab_user' not in sset_table_exists.stdout
+
+- name: List existing superset roles
+  command: psql -d {{ georchestra.db.name }} -t -c "select * from superset.ab_role;"
+  register: sset_role_exists
+
+- name: Initialize superset database content
+  command: /srv/apps/superset/venv/bin/superset init
+  environment:
+    FLASK_APP: superset
+    SUPERSET_CONFIG_PATH: /srv/apps/superset/superset_config.py
+  when: sset_role_exists.stdout is defined and 'Alpha' not in sset_role_exists.stdout

roles/superset/tasks/main.yml

@@ -0,0 +1,93 @@
+---
+- name: Install debian dependencies
+  tags: superset/apt
+  ansible.builtin.apt:
+    name:
+      - build-essential
+      - libssl-dev
+      - libffi-dev
+      - libsasl2-dev
+      - libldap2-dev
+      - python3-dev
+      - python3-pip
+      - python3-pil
+      - python3-gevent
+      - python3-psycopg2
+      - python3-virtualenv
+
+- name: Install superset via pip
+  tags: superset/pip
+  ansible.builtin.pip:
+    name: git+https://github.com/martyngigg/superset@9b77478#egg=apache-superset
+    virtualenv: /srv/apps/superset/venv
+    virtualenv_site_packages: true
+
+- name: Fetch compiled assets
+  tags: superset/assets
+  ansible.builtin.get_url:
+    url: https://packages.georchestra.org/bot/wars/superset/superset-assets-dashboard-9b77478.tgz
+    dest: /tmp/superset-assets-dashboard-9b77478.tgz
+
+- name: Unarchive assets
+  tags: superset/assets
+  ansible.builtin.unarchive:
+    src: /tmp/superset-assets-dashboard-9b77478.tgz
+    dest: /srv/apps/superset/venv/lib/python3.11/site-packages/superset/static/
+    remote_src: true
+
+- name: Create a georchestra group
+  tags: superset/user
+  ansible.builtin.group:
+    name: georchestra
+
+- name: Create user for superset
+  tags: superset/user
+  ansible.builtin.user:
+    name: superset
+    group: georchestra
+
+- name: Create superset-owned subdirs
+  tags: superset/dirs
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: superset
+    group: georchestra
+  with_items:
+    - "{{ logs_basedir }}/superset"
+    - /srv/data/superset
+
+- name: Deploy superset config
+  tags: superset/config
+  ansible.builtin.template:
+    owner: superset
+    group: postgres
+    mode: "0440"
+    src: superset_config.py.j2
+    dest: /srv/apps/superset/superset_config.py
+
+- name: Initialize database
+  tags: superset/db
+  become: true
+  become_user: postgres
+  ansible.builtin.import_tasks: database.yml
+
+- name: Template superset systemd unit
+  tags: superset/systemd
+  ansible.builtin.template:
+    src: superset.service.j2
+    dest: /etc/systemd/system/superset.service
+
+- name: Reload systemd
+  tags: superset/systemd
+  ansible.builtin.systemd:
+    enabled: true
+    daemon-reload: true
+    name: superset.service
+
+- name: Start superset
+  tags: superset/systemd
+  ansible.builtin.service:
+    name: superset
+    enabled: yes
+    state: started

roles/superset/templates/superset.service.j2

@@ -0,0 +1,23 @@
+[Unit]
+Description=superset
+After=network.target
+
+[Service]
+User=superset
+Environment="LOG_LEVEL=INFO"
+WorkingDirectory=/srv/apps/superset/
+ExecStart=/srv/apps/superset/venv/bin/gunicorn \
+      -w 10 \
+      -k gevent \
+      --worker-connections 1000 \
+      --timeout 120 \
+      --limit-request-line 0 \
+      --limit-request-field_size 0 \
+      -b 127.0.0.1:{{ superset.port}} \
+      --access-logfile {{ logs_basedir }}/superset/access.log \
+      --log-level info \
+      --error-logfile {{ logs_basedir }}/superset/error.log \
+      "superset.app:create_app()"
+
+ [Install]
+ WantedBy=multi-user.target

roles/superset/templates/superset_config.py.j2

@@ -0,0 +1,14 @@
+# create superset-specific tables in the superset schema
+SQLALCHEMY_DATABASE_URI='postgresql://{{ georchestra.db.user }}:{{ georchestra.db.pass }}@localhost/{{ georchestra.db.name }}?options=-c%20search_path=superset'
+SECRET_KEY="{{ superset.secretkey }}"
+# https://superset.apache.org/docs/faq#does-superset-collect-any-telemetry-data
+SCARF_ANALYTICS=False
+# upload folders, owned by superset user
+UPLOAD_FOLDER = "/srv/data/superset/uploads/"
+IMG_UPLOAD_FOLDER = "/srv/data/superset/uploads/"
+
+BASE_PATH = "/{{ superset.urlprefix }}"
+STATIC_ASSETS_PREFIX = BASE_PATH
+APP_ICON = BASE_PATH + "/static/assets/images/superset-logo-horiz.png"
+ENABLE_PROXY_FIX = True
+PROXY_FIX_CONFIG = {"x_for": 1, "x_proto": 1, "x_host": 1, "x_port": 0, "x_prefix": 1}