# Grafana

Grafana visualizes the metrics that Prometheus collects from every service. It runs on Dankclaw and is reachable at `grafana.franksdank.cloud` (via Caddy, behind the Anubis challenge + embedded-outpost gate; login happens inside Grafana via the Authentik OAuth2 button).

**Host:** Dankclaw — **Hostname:** `grafana.franksdank.cloud` — **Port:** 3002 (internal) — **Docs:** https://grafana.com/docs

## Facts

| Item | Value |
|------|-------|
| Image | `docker.io/grafana/grafana:latest` |
| Port | 3002 (host) → 3000 (container) |
| Data volume | dashboards, users, datasource config |
| Datasource | Prometheus (on the same host) |
| Provisioning | dashboards in `/etc/grafana/provisioning/dashboards` |

## Configuration

```yaml
environment:
  GF_SECURITY_ADMIN_USER: "${GRAFANA_ADMIN_USER}"
  GF_SECURITY_ADMIN_PASSWORD: "${GRAFANA_ADMIN_PASSWORD}"
  GF_SERVER_ROOT_URL: "https://grafana.franksdank.cloud"
volumes:
  - /opt/grafana/data:/var/lib/grafana
  - /opt/grafana/provisioning:/etc/grafana/provisioning:ro
```

## Datasource

Point Grafana at the Prometheus service by name (`http://prometheus:9090`) on the shared podman network.

## Healthcheck

Grafana responds on `/api/health` with 200 and `"database":"ok"`.

## Gotchas

- Change the default admin credentials at first boot (env or UI).
- Dashboards provisioned as YAML survive container recreation; UI-created ones live in the data volume — back it up.
- **Auth = OAuth2 relying-party, not auth_proxy.** The embedded outpost carries
  no provider token (`token=None`), so no identity header ever reaches Grafana;
  RP mode is topology-independent. The full verified contract (provider pk 9,
  client_id `grafana-21ca190cde75d60f`, global authorize/token/userinfo paths,
  Basic client auth, form-encoded token body, and the fork's userinfo-claims
  bug that leaves identity at the `sub` hash only) is in
  [[Authentik]] → "OAuth2 relying-party quirks". Consequences for Grafana:
  users auto-upsert as Viewer with `login = <sub hex>`; no email/groups/role
  claims reach Grafana until the evaluator bug is fixed — do not write role
  mappings that depend on those claims. The local admin account stays the only
  Admin.

## See Also

- [[Dankclaw Stack]]
- [[Prometheus]] — the datasource
- [[Observability]] — the whole stack