From 12545813ab1e8ab8301ba9d4747f358f1eb1a7d7 Mon Sep 17 00:00:00 2001 From: Anton Afanasyeu Date: Fri, 7 Aug 2026 22:16:03 +0200 Subject: [PATCH] Monitor: Grafana auth proxy session fix and nginx login bypass. Use ac_crash_sess shared session, allow password reset without auth_request, update grafana.ini template and alert rules. Co-authored-by: Cursor --- monitoring/README.md | 4 +- monitoring/artc0/grafana-auth-check.php | 43 ++++++------------- monitoring/cast04/grafana.ini | 9 +++- monitoring/cast04/rules/node_alerts.yml | 8 ++-- .../backend/public/api/grafana-auth-check.php | 35 +++++++++++++++ sim/cluster0/nginx/apps-port80.conf | 24 ++++++++++- 6 files changed, 84 insertions(+), 39 deletions(-) create mode 100644 sim/cluster0/lab-seeds/backend/public/api/grafana-auth-check.php diff --git a/monitoring/README.md b/monitoring/README.md index f0be5a1..a101cb5 100644 --- a/monitoring/README.md +++ b/monitoring/README.md @@ -32,7 +32,7 @@ | `/etc/prometheus/rules/node_alerts.yml` | HW/OS alert rules (10 rules) | | `/etc/prometheus/rules/service_alerts.yml` | Service/HTTP/DB alert rules (10 rules) | | `/etc/alertmanager/alertmanager.yml` | Alert routing (email + Telegram stub) | -| `/etc/grafana/grafana.ini` | Grafana config (subpath, auth proxy) | +| `/etc/grafana.ini` | Grafana config (subpath, auth proxy) — Alpine OpenRC path | | `/var/lib/grafana/provisioning/` | Auto-provisioned datasource + dashboards dir | | `/etc/conf.d/grafana` | Grafana runtime overrides (bind address, provisioning path) | @@ -80,7 +80,7 @@ done |--------|---------|----------| | CPU | >85% for 10m | >95% for 5m | | RAM free | <15% for 5m | <5% for 2m | -| Disk free | <20% for 15m | <10% for 10m | +| Disk free | <7% for 15m | <5% for 10m | | Load (per vCPU) | >1.5× for 5m | >3.0× for 5m | | HTTP probe | >5s for 5m | down >3m | | SSL cert | <14 days | <7 days | diff --git a/monitoring/artc0/grafana-auth-check.php b/monitoring/artc0/grafana-auth-check.php index d923b2e..f366558 100644 --- a/monitoring/artc0/grafana-auth-check.php +++ b/monitoring/artc0/grafana-auth-check.php @@ -1,52 +1,35 @@ '/app/androidcast_project/', - 'secure' => isset($_SERVER['HTTPS']), - 'httponly' => true, - 'samesite' => 'Lax', - ]); - session_start(); -} +platform_start_session('ac_crash_sess', '/app/androidcast_project'); -// Check if user is logged in — Auth.php stores array in $_SESSION['user'] -// with at least { 'id' => int, 'username' => string, ... } $user = $_SESSION['user'] ?? null; -if (empty($user) || empty($user['id'])) { +if (empty($user['id'])) { http_response_code(401); exit; } -// Require full login (not just 2FA pending) -if (isset($user['pending_2fa']) && $user['pending_2fa']) { +if (!empty($user['pending_2fa'])) { http_response_code(401); exit; } -$username = (string)($user['username'] ?? $user['email'] ?? 'user_' . $user['id']); - -// Sanitize — Grafana username must be a valid identifier -$grafana_user = preg_replace('/[^a-zA-Z0-9._@-]/', '_', $username); +$username = (string) ($user['username'] ?? $user['email'] ?? 'user_' . $user['id']); +$grafanaUser = preg_replace('/[^a-zA-Z0-9._@-]/', '_', $username); http_response_code(200); -header('X-WEBAUTH-USER: ' . $grafana_user); +header('X-WEBAUTH-USER: ' . $grafanaUser); header('Content-Type: text/plain'); echo 'ok'; diff --git a/monitoring/cast04/grafana.ini b/monitoring/cast04/grafana.ini index d5156fe..73587a6 100644 --- a/monitoring/cast04/grafana.ini +++ b/monitoring/cast04/grafana.ini @@ -53,6 +53,7 @@ enabled = true header_name = X-WEBAUTH-USER header_property = username auto_sign_up = true +enable_login_token = true # Trust X-WEBAUTH-USER only from cluster BE nginx (cast01–03): whitelist = 10.7.16.236,10.7.16.237,10.7.16.238 # Sync roles from header (optional, set X-WEBAUTH-ROLE in nginx if needed): @@ -66,7 +67,13 @@ enabled = false enabled = true [smtp] -enabled = false # Grafana own SMTP not needed; alertmanager handles mail +enabled = true +host = smtp.gmail.com:587 +user = @MSMTP_USER@ +password = @MSMTP_PASS@ +from_address = @MSMTP_FROM@ +from_name = Android Cast Monitoring +startTLS_policy = MandatoryStartTLS [log] mode = file diff --git a/monitoring/cast04/rules/node_alerts.yml b/monitoring/cast04/rules/node_alerts.yml index f2feac8..57bec50 100644 --- a/monitoring/cast04/rules/node_alerts.yml +++ b/monitoring/cast04/rules/node_alerts.yml @@ -61,24 +61,24 @@ groups: - alert: LowDiskWarning expr: > (node_filesystem_avail_bytes{fstype!~"tmpfs|devtmpfs|overlay"} / - node_filesystem_size_bytes{fstype!~"tmpfs|devtmpfs|overlay"}) * 100 < 20 + node_filesystem_size_bytes{fstype!~"tmpfs|devtmpfs|overlay"}) * 100 < 7 for: 15m labels: severity: warning annotations: summary: "Low disk on {{ $labels.instance }} mountpoint {{ $labels.mountpoint }}" - description: "Free disk is {{ $value | printf \"%.1f\" }}% on {{ $labels.instance }}:{{ $labels.mountpoint }} (threshold: 20%)." + description: "Free disk is {{ $value | printf \"%.1f\" }}% on {{ $labels.instance }}:{{ $labels.mountpoint }} (threshold: 7%)." - alert: LowDiskCritical expr: > (node_filesystem_avail_bytes{fstype!~"tmpfs|devtmpfs|overlay"} / - node_filesystem_size_bytes{fstype!~"tmpfs|devtmpfs|overlay"}) * 100 < 10 + node_filesystem_size_bytes{fstype!~"tmpfs|devtmpfs|overlay"}) * 100 < 5 for: 10m labels: severity: critical annotations: summary: "Critical disk on {{ $labels.instance }}:{{ $labels.mountpoint }}" - description: "Free disk is {{ $value | printf \"%.1f\" }}% (threshold: 10%) on {{ $labels.instance }}:{{ $labels.mountpoint }}." + description: "Free disk is {{ $value | printf \"%.1f\" }}% (threshold: 5%) on {{ $labels.instance }}:{{ $labels.mountpoint }}." # ── load ──────────────────────────────────────────────────────────────── - alert: HighLoadWarning diff --git a/sim/cluster0/lab-seeds/backend/public/api/grafana-auth-check.php b/sim/cluster0/lab-seeds/backend/public/api/grafana-auth-check.php new file mode 100644 index 0000000..f366558 --- /dev/null +++ b/sim/cluster0/lab-seeds/backend/public/api/grafana-auth-check.php @@ -0,0 +1,35 @@ +