thermograph/observability/caddy-grafana.conf

# Append to vps1's /etc/caddy/Caddyfile (vps1 is the monitoring host — NOT the
# beta environment, which runs on vps2 now), then `systemctl reload caddy`.
# Grafana publishes to 127.0.0.1:3000; this fronts it with TLS, same pattern as
# vps1's other site blocks. Login is Google SSO (with a break-glass local
# admin); Loki (the log store, on 10.10.0.2:3100) is NOT proxied here and stays
# mesh-only.
#
# dashboard.thermograph.org's A record must already point at vps1 (75.119.132.91).

dashboard.thermograph.org {
	encode zstd gzip
	reverse_proxy 127.0.0.1:3000
	log {
		output file /var/log/caddy/dashboard.log
	}
}