Grafana Slice - Add Grafana metrics visualization service

[josecelano]

Parent Epic: #216 (Implement ReleaseCommand and RunCommand with vertical slices)

Overview

Add Grafana as a metrics visualization service for the Torrust Tracker deployment. This extends the docker-compose stack with a Grafana service that connects to Prometheus for displaying tracker metrics through dashboards.

Key Features:

• Enabled by default in generated templates (opt-out pattern)
• Requires Prometheus to be enabled (hard dependency with validation)
• Exposes UI on port 3100 (public access until HTTPS/proxy added in roadmap task 6)
• Includes firewall configuration for port access
• Provides sample dashboards from torrust-demo as examples

Specification

Complete specification: docs/issues/grafana-slice-release-run-commands.md

Implementation Plan

Phase 1: Environment Configuration & Validation (1-2 hours)

• Create GrafanaConfig domain model with Password type for admin_password
• Add grafana: Option<GrafanaConfig> to environment user inputs
• Implement Grafana-Prometheus dependency validation
• Add validation error with clear fix instructions

Phase 2: Docker Compose & Firewall Integration (2-3 hours)

• Add Grafana service to docker-compose template (conditional on config)
• Create environment variables context with Grafana credentials
• Create Ansible playbook for firewall configuration (configure-grafana-firewall.yml)
• Create ConfigureGrafanaFirewallStep and integrate into configure command
• Add ConfigureGrafanaFirewall to ConfigureStep enum

Phase 3: Testing & Verification (2-3 hours)

• Add E2E test configurations (with/without Grafana, validation error)
• Create GrafanaValidator with firewall verification
• Update E2E tests for Grafana scenarios
• Manual testing with full deployment workflow

Phase 4: Documentation (1-2 hours)

• Create ADR for Grafana integration pattern
• Update user guide with Grafana configuration
• Create docs/user-guide/services/grafana/ with sample dashboards
• Create manual verification guide

Acceptance Criteria

Functional Requirements

• Grafana service included in docker-compose when config present
• Validation fails if Grafana enabled but Prometheus disabled
• Port 3100 opened in firewall when Grafana enabled
• Grafana UI accessible externally from host machine
• Admin credentials work for login
• Grafana connects to Prometheus successfully

Testing Requirements

• Unit tests for domain model, validation, and firewall step
• E2E tests for all scenarios (enabled, disabled, validation error)
• Manual testing confirms deployment and external access

Quality Requirements

• Pre-commit checks pass: ./scripts/pre-commit.sh
  • No unused dependencies (cargo machete)
  • All linters pass (markdown, yaml, toml, clippy, rustfmt, shellcheck)
  • All unit tests pass (cargo test - 1500+ tests)
  • E2E tests pass (cargo run --bin e2e-deployment-workflow-tests)

Note for Contributors: These criteria define what the PR reviewer will check. Use this as your pre-review checklist before submitting the PR to minimize back-and-forth iterations.

Architecture

• DDD Layers: Infrastructure + Domain + Application
• New Modules:
  • src/domain/grafana/ - Configuration domain types
  • src/application/steps/configure_grafana_firewall.rs - Firewall step
  • src/application/command_handlers/create/config/validation/ - Dependency validation
• Templates: configure-grafana-firewall.yml.tera, docker-compose updates

Security Notes

• admin_password uses Password type from secrecy crate (automatic redaction, memory zeroing)
• Port 3100 exposure is temporary until HTTPS/reverse proxy (roadmap task 6)
• Default credentials ("admin"/"admin") must be changed in production

Related

• Parent: Implement ReleaseCommand and RunCommand with vertical slices #216 (Epic - Implement ReleaseCommand and RunCommand)
• Reference: torrust-demo - Sample dashboards
• Dependency: Prometheus slice (Prometheus Slice - Release and Run Commands #238) must be completed first