From b6af390581a2cce6d69e19b57036d6aa5626e4fc Mon Sep 17 00:00:00 2001
From: iris <iris@hyperhive.local>
Date: Mon, 9 Nov 2026 21:06:07 +0100
Subject: [PATCH] grafana: the data-transferred-by-domain panel steps at 5
 minutes and draws bars

Squid logs a tunnel's bytes once, when it closes, so a large download was
one point in a small bucket and read as instantaneous. The panel now has a
5 minute minimum interval and bars, so that point is a visible bar. The
module-eval check pins both.
---
 nix/host-modules/swarm-grafana/dashboards/egress.json | 10 ++++++----
 nix/module-eval/grafana.nix                           |  6 ++++++
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/nix/host-modules/swarm-grafana/dashboards/egress.json b/nix/host-modules/swarm-grafana/dashboards/egress.json
index 94b91ce2d..5f073670d 100644
--- a/nix/host-modules/swarm-grafana/dashboards/egress.json
+++ b/nix/host-modules/swarm-grafana/dashboards/egress.json
@@ -1589,7 +1589,7 @@
         "spec": {
           "id": 21,
           "title": "Data transferred by domain over time",
-          "description": "Bytes per top-10 domain, rest as other. A tunnel is logged at close, so long ones spike.",
+          "description": "Bytes per top-10 domain, rest as other, in 5 minute bars. A tunnel counts when it closes.",
           "links": [],
           "data": {
             "kind": "QueryGroup",
@@ -1637,7 +1637,9 @@
                 }
               ],
               "transformations": [],
-              "queryOptions": {}
+              "queryOptions": {
+                "interval": "5m"
+              }
             }
           },
           "vizConfig": {
@@ -1663,9 +1665,9 @@
                     "mode": "palette-classic"
                   },
                   "custom": {
-                    "drawStyle": "line",
+                    "drawStyle": "bars",
                     "lineWidth": 1,
-                    "fillOpacity": 10,
+                    "fillOpacity": 60,
                     "showPoints": "never",
                     "spanNulls": false,
                     "axisSoftMin": 0
diff --git a/nix/module-eval/grafana.nix b/nix/module-eval/grafana.nix
index ce4a19c0d..e88bd01d8 100644
--- a/nix/module-eval/grafana.nix
+++ b/nix/module-eval/grafana.nix
@@ -713,6 +713,12 @@ let
           && (lib.head xf).spec.options.value == "__name__"
           && (lib.head xf).spec.options.join != [ ]
         ) (lib.filter (e: e.spec.vizConfig.group == "table") (lib.attrValues board.spec.elements))
+        # Squid logs a tunnel's bytes once, when it closes, so a large download is
+        # one point. The by-domain panel steps no finer than 5 minutes and draws
+        # bars, so that point is a visible bar rather than a sliver.
+        && board.spec.elements."panel-21".spec.data.spec.queryOptions.interval == "5m"
+        &&
+          board.spec.elements."panel-21".spec.vizConfig.spec.fieldConfig.defaults.custom.drawStyle == "bars"
         && lib.hasInfix "logformat would_deny would_deny user=%[un method=%rm host=%>rd port=%>rP result=" squid
         && lib.hasInfix "access_log syslog:daemon.info squid !manager" squid;
     }