# Append to beta's /etc/caddy/Caddyfile (beta is the monitoring host), then
# `systemctl reload caddy`. Grafana publishes to 127.0.0.1:3000; this fronts it
# with TLS, same pattern as beta's other site blocks. Grafana owns its own login,
# so the UI is safe to expose publicly — but Loki (the log store, on
# 10.10.0.2:3100) is NOT proxied here and stays mesh-only.
#
# Point grafana.thermograph.org's A record at beta (75.119.132.91) first.

grafana.thermograph.org {
	encode zstd gzip
	reverse_proxy 127.0.0.1:3000
	log {
		output file /var/log/caddy/grafana.log
	}
}