xengi/infra
Watch
0
1
Fork
You've already forked infra
 0
Code Pull requests Activity Actions 1

use grafana socket

Browse source
This commit is contained in:
XenGi 2026-08-03 11:35:08 +02:00
commit 5487171476
Signed by: xengi
SSH key fingerprint: SHA256:jxWM2RTHvxxcncXycwwWkP7HCWb4VREN05UGJTbIPZg
1 changed files with 39 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

66
hosts/monitoring/grafana.nix
View file

@ -3,6 +3,9 @@
# Dashboards:
# - Synapse: https://github.com/element-hq/synapse/tree/master/contrib/grafana
let
fqdn = "monitoring.${config.networking.domain}";
in
{
imports = [
../../services/nginx.nix
@ -13,7 +16,13 @@
grafana = {
enable = true;
settings = {
server.http_addr = "::1";
server = {
domain = fqdn;
enable_gzip = true;
enforce_domain = true;
root_url = "https://${fqdn}:443/";
protocol = "socket";
};
database = {
type = "postgres";
name = "grafana";
@ -26,6 +35,13 @@
admin_user = "xengi";
admin_password = "$__file{${config.age.secrets.grafana_admin_password.path}}";
admin_email = "cccb-grafana@xengi.de";
cookie_samesite = "strict";
cookie_secure = true;
disable_gravatar = true;
#strict_transport_security = true;
#strict_transport_security_preload = true;
#strict_transport_security_subdomains = true;
#x_xss_protection = true;
};
analytics = {
reporting_enabled = false;
@ -49,32 +65,28 @@
};
};
nginx = {
upstreams."grafana".servers."[${config.services.grafana.settings.server.http_addr}]:${toString config.services.grafana.settings.server.http_port}" =
{ };
virtualHosts."monitoring.${config.networking.domain}" = {
default = true;
quic = true;
kTLS = true;
forceSSL = true;
enableACME = true;
#extraConfig = ''
# map $http_upgrade $connection_upgrade {
# default upgrade;
# \'\' close;
# }
#'';
locations = {
"/" = {
basicAuthFile = config.age.secrets.grafana_basic_auth.path;
proxyPass = "http://grafana";
recommendedProxySettings = true;
};
"/api/live/" = {
proxyPass = "http://grafana";
recommendedProxySettings = true;
proxyWebsockets = true;
};
nginx.virtualHosts."monitoring.${config.networking.domain}" = {
default = true;
quic = true;
kTLS = true;
forceSSL = true;
enableACME = true;
#extraConfig = ''
# map $http_upgrade $connection_upgrade {
# default upgrade;
# \'\' close;
# }
#'';
locations = {
"/" = {
basicAuthFile = config.age.secrets.grafana_basic_auth.path;
proxyPass = "http://unix:/run/grafana/grafana.sock";
recommendedProxySettings = true;
};
"/api/live/" = {
proxyPass = "http://unix:/run/grafana/grafana.sock";
recommendedProxySettings = true;
proxyWebsockets = true;
};
};
};