From 0566b501bde19ccf1954a5f8b37a60bc5a4fa49a Mon Sep 17 00:00:00 2001
From: atlas <atlas@hyperhive.local>
Date: Sun, 8 Nov 2026 10:47:36 +0100
Subject: [PATCH] egress dashboard: data transferred by domain over time

---
 .../swarm-grafana/dashboards/egress.json      | 106 ++++++++++++++++++
 1 file changed, 106 insertions(+)

diff --git a/nix/host-modules/swarm-grafana/dashboards/egress.json b/nix/host-modules/swarm-grafana/dashboards/egress.json
index c5447d8c..94b91ce2 100644
--- a/nix/host-modules/swarm-grafana/dashboards/egress.json
+++ b/nix/host-modules/swarm-grafana/dashboards/egress.json
@@ -1583,6 +1583,99 @@
             }
           }
         }
+      },
+      "panel-21": {
+        "kind": "Panel",
+        "spec": {
+          "id": 21,
+          "title": "Data transferred by domain over time",
+          "description": "Bytes per top-10 domain, rest as other. A tunnel is logged at close, so long ones spike.",
+          "links": [],
+          "data": {
+            "kind": "QueryGroup",
+            "spec": {
+              "queries": [
+                {
+                  "kind": "PanelQuery",
+                  "spec": {
+                    "query": {
+                      "kind": "DataQuery",
+                      "group": "victoriametrics-logs-datasource",
+                      "version": "v0",
+                      "datasource": {
+                        "name": "@logsDatasourceUid@"
+                      },
+                      "spec": {
+                        "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter dest:in(_time:$__range _SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | stats by (dest) sum(bytes) as b | sort by (b) desc | limit 10 | fields dest) | stats by (dest) sum(bytes) as bytes",
+                        "queryType": "statsRange",
+                        "legendFormat": "{{dest}}"
+                      }
+                    },
+                    "refId": "A",
+                    "hidden": false
+                  }
+                },
+                {
+                  "kind": "PanelQuery",
+                  "spec": {
+                    "query": {
+                      "kind": "DataQuery",
+                      "group": "victoriametrics-logs-datasource",
+                      "version": "v0",
+                      "datasource": {
+                        "name": "@logsDatasourceUid@"
+                      },
+                      "spec": {
+                        "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter dest:!in(_time:$__range _SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | stats by (dest) sum(bytes) as b | sort by (b) desc | limit 10 | fields dest) | stats sum(bytes) as bytes",
+                        "queryType": "statsRange",
+                        "legendFormat": "other"
+                      }
+                    },
+                    "refId": "B",
+                    "hidden": false
+                  }
+                }
+              ],
+              "transformations": [],
+              "queryOptions": {}
+            }
+          },
+          "vizConfig": {
+            "kind": "VizConfig",
+            "group": "timeseries",
+            "version": "",
+            "spec": {
+              "options": {
+                "legend": {
+                  "displayMode": "list",
+                  "placement": "bottom",
+                  "showLegend": true
+                },
+                "tooltip": {
+                  "mode": "multi",
+                  "sort": "desc"
+                }
+              },
+              "fieldConfig": {
+                "defaults": {
+                  "unit": "bytes",
+                  "color": {
+                    "mode": "palette-classic"
+                  },
+                  "custom": {
+                    "drawStyle": "line",
+                    "lineWidth": 1,
+                    "fillOpacity": 10,
+                    "showPoints": "never",
+                    "spanNulls": false,
+                    "axisSoftMin": 0
+                  }
+                },
+                "overrides": []
+              }
+            }
+          }
+        }
       }
     },
     "layout": {
@@ -1720,6 +1813,19 @@
                         "x": 0,
                         "y": 21,
                         "width": 24,
+                        "height": 9,
+                        "element": {
+                          "kind": "ElementReference",
+                          "name": "panel-21"
+                        }
+                      }
+                    },
+                    {
+                      "kind": "GridLayoutItem",
+                      "spec": {
+                        "x": 0,
+                        "y": 30,
+                        "width": 24,
                         "height": 12,
                         "element": {
                           "kind": "ElementReference",