Emi Griffith
7e8a484ad5
- Grafana served at dashboard.thermograph.org (the record now points at beta) - Google OAuth (OIDC) login, env-gated (OAUTH_ENABLED + GOOGLE_CLIENT_ID/SECRET); allow_sign_up=false so access is locked to pre-provisioned accounts, with a break-glass local admin fallback - README: Google Cloud OAuth client setup with the redirect URIs for both Grafana and Forgejo, plus the Forgejo add-oauth command
15 lines
566 B
Text
15 lines
566 B
Text
# Append to beta's /etc/caddy/Caddyfile (beta is the monitoring host), then
|
|
# `systemctl reload caddy`. Grafana publishes to 127.0.0.1:3000; this fronts it
|
|
# with TLS, same pattern as beta's other site blocks. Login is Google SSO (with a
|
|
# break-glass local admin); Loki (the log store, on 10.10.0.2:3100) is NOT proxied
|
|
# here and stays mesh-only.
|
|
#
|
|
# dashboard.thermograph.org's A record must already point at beta (75.119.132.91).
|
|
|
|
dashboard.thermograph.org {
|
|
encode zstd gzip
|
|
reverse_proxy 127.0.0.1:3000
|
|
log {
|
|
output file /var/log/caddy/dashboard.log
|
|
}
|
|
}
|