xengi/infra
Watch
0
1
Fork
You've already forked infra
 0
Code Pull requests Activity Actions

use grafana socket

Browse source
This commit is contained in:
XenGi 2026-08-03 11:35:08 +02:00
commit 5487171476
Signed by: xengi
SSH key fingerprint: SHA256:jxWM2RTHvxxcncXycwwWkP7HCWb4VREN05UGJTbIPZg
1 changed files with 39 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

66
hosts/monitoring/grafana.nix
View file

@ -3,6 +3,9 @@
# Dashboards: # Dashboards:
# - Synapse: https://github.com/element-hq/synapse/tree/master/contrib/grafana # - Synapse: https://github.com/element-hq/synapse/tree/master/contrib/grafana
let
fqdn = "monitoring.${config.networking.domain}";
in
{ {
imports = [ imports = [
../../services/nginx.nix ../../services/nginx.nix
@ -13,7 +16,13 @@
grafana = { grafana = {
enable = true; enable = true;
settings = { settings = {
server.http_addr = "::1"; server = {
domain = fqdn;
enable_gzip = true;
enforce_domain = true;
root_url = "https://${fqdn}:443/";
protocol = "socket";
};
database = { database = {
type = "postgres"; type = "postgres";
name = "grafana"; name = "grafana";
@ -26,6 +35,13 @@
admin_user = "xengi"; admin_user = "xengi";
admin_password = "$__file{${config.age.secrets.grafana_admin_password.path}}"; admin_password = "$__file{${config.age.secrets.grafana_admin_password.path}}";
admin_email = "cccb-grafana@xengi.de"; admin_email = "cccb-grafana@xengi.de";
cookie_samesite = "strict";
cookie_secure = true;
disable_gravatar = true;
#strict_transport_security = true;
#strict_transport_security_preload = true;
#strict_transport_security_subdomains = true;
#x_xss_protection = true;
}; };
analytics = { analytics = {
reporting_enabled = false; reporting_enabled = false;
@ -49,32 +65,28 @@
}; };
}; };
nginx = { nginx.virtualHosts."monitoring.${config.networking.domain}" = {
upstreams."grafana".servers."[${config.services.grafana.settings.server.http_addr}]:${toString config.services.grafana.settings.server.http_port}" = default = true;
{ }; quic = true;
virtualHosts."monitoring.${config.networking.domain}" = { kTLS = true;
default = true; forceSSL = true;
quic = true; enableACME = true;
kTLS = true; #extraConfig = ''
forceSSL = true; # map $http_upgrade $connection_upgrade {
enableACME = true; # default upgrade;
#extraConfig = '' # \'\' close;
# map $http_upgrade $connection_upgrade { # }
# default upgrade; #'';
# \'\' close; locations = {
# } "/" = {
#''; basicAuthFile = config.age.secrets.grafana_basic_auth.path;
locations = { proxyPass = "http://unix:/run/grafana/grafana.sock";
"/" = { recommendedProxySettings = true;
basicAuthFile = config.age.secrets.grafana_basic_auth.path; };
proxyPass = "http://grafana"; "/api/live/" = {
recommendedProxySettings = true; proxyPass = "http://unix:/run/grafana/grafana.sock";
}; recommendedProxySettings = true;
"/api/live/" = { proxyWebsockets = true;
proxyPass = "http://grafana";
recommendedProxySettings = true;
proxyWebsockets = true;
};
}; };
}; };
}; };