d138f00a20
Some checks failed
Sync infra to hosts / sync-beta (push) Has been skipped
Sync infra to hosts / sync-prod (push) Has been skipped
Sync infra to hosts / sync-dev (push) Failing after 6s
secrets-guard / encrypted (push) Successful in 6s
shell-lint / shellcheck (push) Successful in 13s
Validate observability stack / validate (push) Successful in 17s
PR build (required check) / changes (pull_request) Successful in 6s
secrets-guard / encrypted (pull_request) Successful in 5s
PR build (required check) / build-backend (pull_request) Has been skipped
shell-lint / shellcheck (pull_request) Successful in 6s
PR build (required check) / build-frontend (pull_request) Has been skipped
PR build (required check) / validate-observability (pull_request) Successful in 18s
PR build (required check) / gate (pull_request) Successful in 2s
34 lines
1.8 KiB
Text
34 lines
1.8 KiB
Text
# Copy to .env on the monitoring host (vps1) before `docker compose up`.
|
|
# .env is gitignored — never commit real secrets.
|
|
#
|
|
# vps1 is NOT the beta environment — that runs on vps2 now, as its own Swarm
|
|
# stack. Don't confuse the two when reading older docs that say "beta" here.
|
|
|
|
# The public hostname vps1's Caddy serves Grafana at (see caddy-grafana.conf).
|
|
GRAFANA_DOMAIN=dashboard.thermograph.org
|
|
|
|
# Break-glass local admin (Google SSO below is the primary login). Keep this
|
|
# strong; it's the fallback if OAuth ever breaks.
|
|
GF_ADMIN_USER=admin
|
|
GF_SECURITY_ADMIN_PASSWORD=change-me-to-something-strong
|
|
|
|
# --- Google SSO ------------------------------------------------------------------
|
|
# Create a Google Cloud "OAuth 2.0 Client ID" (type: Web application) and set:
|
|
# Authorized redirect URI: https://dashboard.thermograph.org/login/google
|
|
# Then paste the client id/secret here and flip OAUTH_ENABLED=true.
|
|
# Login is locked to pre-provisioned accounts (allow_sign_up=false) — provision
|
|
# your email as an admin (see README) so only you can sign in.
|
|
OAUTH_ENABLED=false
|
|
GOOGLE_CLIENT_ID=
|
|
GOOGLE_CLIENT_SECRET=
|
|
|
|
# --- Alerting (Discord) ----------------------------------------------------------
|
|
# Where every alert in grafana/provisioning/alerting/ is delivered: a webhook on
|
|
# the private #ops-alerts channel (Owners category) of the Thermograph.org
|
|
# Discord. NOT email — vps1's Grafana relays SMTP through vps2's Postfix, so
|
|
# email alerts die exactly when prod (on vps2) does.
|
|
#
|
|
# To mint one: Discord -> #ops-alerts -> Edit Channel -> Integrations ->
|
|
# Webhooks -> New Webhook -> Copy Webhook URL. Treat it like a password; anyone
|
|
# with it can post to the channel. Grafana refuses to start without it.
|
|
DISCORD_ALERT_WEBHOOK_URL=https://discord.com/api/webhooks/<id>/<token>
|