grafana: enable HTTP/2 in nginx

roles/grafana/files/Ubuntu-18-override.conf

@@ -0,0 +1,10 @@
+[Service]
+SystemCallFilter=
+SystemCallFilter=~@privileged
+SystemCallFilter=~@resources
+
+ProcSubset=
+ProtectClock=
+ProtectHostname=
+ProtectKernelLogs=
+ProtectProc=

roles/grafana/tasks/Ubuntu-18.yaml

@@ -0,0 +1,19 @@
+---
+- name: create grafana-server.service.d
+  file:
+    path: /etc/systemd/system/grafana-server.service.d
+    owner: root
+    group: root
+    mode: 0755
+    state: directory
+
+- name: configure systemd override
+  copy:
+    src: Ubuntu-18-override.conf
+    dest: /etc/systemd/system/grafana-server.service.d/10-override.conf
+    owner: root
+    group: root
+    mode: 0644
+  notify:
+    - grafana daemon-reload
+    - restart grafana

roles/grafana/tasks/main.yaml

@@ -4,7 +4,7 @@
   vars:
     possible_files:
       files:
-        - "{{ ansible_distribution }}-{{ ansible_distribution_version }}.yaml"
+        - "{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.yaml"
         - "{{ ansible_distribution }}.yaml"
         - "{{ ansible_os_family }}.yaml"
         - "default.yaml"
@@ -16,8 +16,17 @@
   vars:
     possible_files:
       files:
-        - "{{ ansible_distribution }}-{{ ansible_distribution_version }}.yaml"
+        - "{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.yaml"
         - "{{ ansible_distribution }}.yaml"
+        - "default.yaml"
+      paths:
+        - tasks
+
+- name: include os family specific tasks
+  include_tasks: "{{ lookup('first_found', possible_files) }}"
+  vars:
+    possible_files:
+      files:
         - "{{ ansible_os_family }}.yaml"
         - "default.yaml"
       paths:

roles/grafana/templates/nginx.conf.j2

@@ -32,9 +32,9 @@ server {
 {% if grafana_ssl_enabled is defined and
       grafana_ssl_enabled %}
 server {
-    listen 443 ssl;
+    listen 443 ssl http2;
 {% if ansible_all_ipv6_addresses | length %}
-    listen [::]:443 ssl;
+    listen [::]:443 ssl http2;
 {% endif %}
     server_name {{ grafana_domain }};
 
@@ -51,6 +51,8 @@ server {
     ssl_dhparam {{ grafana_ssl_dhparam }};
 {% endif %}
 
+    proxy_set_header Host $http_host;
+
     location /login {
         limit_req zone=req_grafana_login burst=10;
         proxy_pass http://grafana_backend;