Deploy the monitoring stack template with OpenTofu

Stand up Prometheus and Grafana on a private subnet using the validated OpenTofu template monitoring-stack. Prometheus stays on the private CIDR; Grafana gets one floating IP with a pre-provisioned Prometheus data source.

Prerequisites#

You need:

• A Quake AI account with application credentials
• OpenTofu 1.6.0 or later (installation guide)
• OpenStack credentials sourced into the shell (source openrc.sh). See the OpenStack CLI guide.
• An SSH key pair already uploaded to the project. See Add an SSH key.
• A copy of the monitoring-stack template from the template reference page
• Enough project quota for two m2a.large instances (defaults), two 20 GB boot volumes, a 100 GB Prometheus data volume, a 20 GB Grafana data volume, one router, one private network, and one floating IP

Step 1: Configure variables#

Copy terraform.tfvars.example to terraform.tfvars and set:

key_name                 = "YOUR_KEY_NAME"
grafana_admin_password   = "YOUR_STRONG_GRAFANA_PASSWORD"
admin_cidr               = "YOUR_PUBLIC_IP/32"

Replace YOUR_PUBLIC_IP/32 with the address you browse from so Grafana port 3000 and SSH are not open to the entire internet.

Defaults for flavors, volume sizes, retention, and network CIDR are documented on the Monitoring Stack (Prometheus + Grafana) reference page.

Step 2: Apply the template#

From the template directory, run:

tofu init
tofu plan
tofu apply

Type yes when prompted. Provisioning takes several minutes while cloud-init installs Prometheus and Grafana on each instance.

When the run finishes, note grafana_url and prometheus_private_ip from the outputs.

Step 3: Sign in to Grafana and confirm Prometheus#

SSH to Grafana through its floating IP and wait for cloud-init:

GRAFANA_HOST=$(tofu output -raw grafana_url | sed 's|http://||;s|:3000||')
ssh -i ~/.ssh/YOUR_KEY -o StrictHostKeyChecking=accept-new ubuntu@"${GRAFANA_HOST}" 'cloud-init status --wait'

Open grafana_url in your browser. Sign in with username admin and the grafana_admin_password value from terraform.tfvars.

Grafana ships with a provisioned Prometheus data source pointing at http://<prometheus_private_ip>:9090. Go to Connections > Data sources > Prometheus and select Save & test.

Check scrape targets from the Grafana instance:

PROM_IP=$(tofu output -raw prometheus_private_ip)
ssh -i ~/.ssh/YOUR_KEY ubuntu@"${GRAFANA_HOST}" \
  "curl -s http://${PROM_IP}:9090/api/v1/targets | python3 -m json.tool | head -40"

You should see at least the prometheus job scraping localhost:9090 with state up.

In Grafana, open Explore, select the Prometheus data source, and run up. A result with up{job="prometheus"} = 1 confirms metrics are flowing.

Next steps#

• Monitor your Quake AI workload with Prometheus and Grafana
• Ship application logs off your VMs
• Monitoring Stack template
• Three-Tier Application template

Clean up#

Run tofu destroy from the project directory when finished. Type yes to confirm. Verify in the Console that both instances and the floating IP are gone.