mirror of
git://f0xx.org/ac/ac-deploy
synced 2026-08-12 18:12:19 +03:00
12545813ab
Use ac_crash_sess shared session, allow password reset without auth_request, update grafana.ini template and alert rules. Co-authored-by: Cursor <cursoragent@cursor.com>
97 lines
2.3 KiB
INI
97 lines
2.3 KiB
INI
# Grafana config — cast04
|
||
# Served at: https://apps.f0xx.org/app/androidcast_project/monitor/
|
||
# Auth: nginx auth_request validates PHP session → X-WEBAUTH-USER header → Grafana auth proxy
|
||
|
||
[DEFAULT]
|
||
|
||
[paths]
|
||
data = /var/lib/grafana
|
||
logs = /var/log/grafana
|
||
plugins = /var/lib/grafana/plugins
|
||
provisioning = /etc/grafana/provisioning
|
||
|
||
[server]
|
||
protocol = http
|
||
http_addr = 0.0.0.0
|
||
http_port = 3000
|
||
domain = apps.f0xx.org
|
||
root_url = https://apps.f0xx.org/app/androidcast_project/monitor/
|
||
serve_from_sub_path = true
|
||
enable_gzip = true
|
||
|
||
[database]
|
||
type = sqlite3
|
||
path = grafana.db
|
||
|
||
[session]
|
||
provider = file
|
||
|
||
[analytics]
|
||
reporting_enabled = false
|
||
check_for_updates = true
|
||
|
||
[security]
|
||
# Change after first login; used for direct access bypassing the PHP session
|
||
admin_user = admin
|
||
admin_password = acMonitor2026!
|
||
secret_key = acMonitorSecret2026changeme
|
||
disable_initial_admin_creation = false
|
||
allow_embedding = true
|
||
|
||
[users]
|
||
allow_sign_up = false
|
||
allow_org_create = false
|
||
auto_assign_org = true
|
||
auto_assign_org_role = Viewer
|
||
default_theme = dark
|
||
|
||
# ── Auth proxy (PHP session integration) ────────────────────────────────────
|
||
# nginx validates the PHP session cookie and sets X-WEBAUTH-USER if valid.
|
||
# Grafana trusts this header and auto-creates/logs in the user.
|
||
[auth.proxy]
|
||
enabled = true
|
||
header_name = X-WEBAUTH-USER
|
||
header_property = username
|
||
auto_sign_up = true
|
||
enable_login_token = true
|
||
# Trust X-WEBAUTH-USER only from cluster BE nginx (cast01–03):
|
||
whitelist = 10.7.16.236,10.7.16.237,10.7.16.238
|
||
# Sync roles from header (optional, set X-WEBAUTH-ROLE in nginx if needed):
|
||
# headers = Role:X-WEBAUTH-ROLE
|
||
|
||
[auth.anonymous]
|
||
enabled = false
|
||
|
||
[auth.basic]
|
||
# Keep enabled for direct admin access (curl / provisioning scripts)
|
||
enabled = true
|
||
|
||
[smtp]
|
||
enabled = true
|
||
host = smtp.gmail.com:587
|
||
user = @MSMTP_USER@
|
||
password = @MSMTP_PASS@
|
||
from_address = @MSMTP_FROM@
|
||
from_name = Android Cast Monitoring
|
||
startTLS_policy = MandatoryStartTLS
|
||
|
||
[log]
|
||
mode = file
|
||
level = info
|
||
|
||
[log.file]
|
||
log_rotate = true
|
||
max_lines = 1000000
|
||
max_size_shift = 28
|
||
daily_rotate = true
|
||
max_days = 7
|
||
|
||
[alerting]
|
||
enabled = false # Using Prometheus Alertmanager, not Grafana's legacy alerting
|
||
|
||
[unified_alerting]
|
||
enabled = false # Unified alerting also off; Alertmanager is the source of truth
|
||
|
||
[feature_toggles]
|
||
enable =
|