thermograph/observability/caddy-grafana.conf

# Append to beta's /etc/caddy/Caddyfile (beta is the monitoring host), then
# `systemctl reload caddy`. Grafana publishes to 127.0.0.1:3000; this fronts it
# with TLS, same pattern as beta's other site blocks. Login is Google SSO (with a
# break-glass local admin); Loki (the log store, on 10.10.0.2:3100) is NOT proxied
# here and stays mesh-only.
#
# dashboard.thermograph.org's A record must already point at beta (75.119.132.91).

dashboard.thermograph.org {
	encode zstd gzip
	reverse_proxy 127.0.0.1:3000
	log {
		output file /var/log/caddy/dashboard.log
	}
}