diff --git a/.claude/settings.local.json b/.claude/settings.local.json
index e5b556a..bf43197 100644
--- a/.claude/settings.local.json
+++ b/.claude/settings.local.json
@@ -1,7 +1,8 @@
 {
   "permissions": {
     "allow": [
-      "Bash(mcquack --help:*)"
+      "Bash(mcquack --help:*)",
+      "Bash(tea help:*)"
     ]
   }
 }
diff --git a/CLAUDE.md b/CLAUDE.md
index 4f6065b..cd1db59 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -20,6 +20,43 @@ You are encouraged to explore the zk, follow links, and propose updates to it as
 4. Use `brew services` or Launch Agents to control services on macos hosts.
 5. Test all changes before applying them - ie with ansible, use a --check --diff run.
 
+## Remote Hosts
+
+This repo is typically edited from a workstation (e.g., gilbert), but services run on remote hosts in the tailnet. Use SSH to explore or check state on remote machines:
+
+```bash
+# Explore config paths on indri
+ssh indri 'ls -la /opt/homebrew/etc/grafana/'
+
+# Check service status
+ssh indri 'brew services list'
+```
+
+Key hosts:
+- **indri** - Mac Mini M1 running services (prometheus, grafana, kiwix, forgejo, borgmatic)
+- **sifaka** - Synology NAS (backup target)
+
+## Git Workflow
+
+Use feature branches for all changes. Do not commit directly to main.
+
+```bash
+# Create a feature branch
+git checkout -b feature/description-of-change
+
+# Make changes, then commit
+git add -A
+git commit -m "Description of change"
+
+# Push and create PR using tea CLI
+git push -u origin feature/description-of-change
+tea pr create --title "Description of change" --description "Details..."
+```
+
+PRs are reviewed and merged via the Forgejo web UI at https://forge.tail8d86e.ts.net.
+
+After creating a PR, run `open <pr-url>` to open it in the browser (Claude Code's UI will prompt for permission).
+
 ## Ansible
 
 Run playbooks from the `ansible/` directory.
diff --git a/ansible/group_vars/all.yml b/ansible/group_vars/all.yml
new file mode 100644
index 0000000..4559aef
--- /dev/null
+++ b/ansible/group_vars/all.yml
@@ -0,0 +1,2 @@
+---
+ansible_managed: "Managed by ansible - do not edit. Source: ssh://forgejo@forge.tail8d86e.ts.net/eblume/blumeops.git"
diff --git a/ansible/roles/grafana/tasks/main.yml b/ansible/roles/grafana/tasks/main.yml
index 3339aee..78c726a 100644
--- a/ansible/roles/grafana/tasks/main.yml
+++ b/ansible/roles/grafana/tasks/main.yml
@@ -4,6 +4,30 @@
     name: grafana
     state: present
 
+- name: Create grafana provisioning directories
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    mode: '0755'
+  loop:
+    - /opt/homebrew/etc/grafana/provisioning
+    - /opt/homebrew/etc/grafana/provisioning/datasources
+    - /opt/homebrew/etc/grafana/provisioning/dashboards
+
+- name: Configure grafana.ini
+  ansible.builtin.template:
+    src: grafana.ini.j2
+    dest: /opt/homebrew/etc/grafana/grafana.ini
+    mode: '0644'
+  notify: restart grafana
+
+- name: Deploy grafana datasources config
+  ansible.builtin.template:
+    src: datasources.yaml.j2
+    dest: /opt/homebrew/etc/grafana/provisioning/datasources/datasources.yaml
+    mode: '0644'
+  notify: restart grafana
+
 - name: Ensure grafana service is started
   ansible.builtin.command: brew services start grafana
   register: brew_start
diff --git a/ansible/roles/grafana/templates/datasources.yaml.j2 b/ansible/roles/grafana/templates/datasources.yaml.j2
new file mode 100644
index 0000000..017d331
--- /dev/null
+++ b/ansible/roles/grafana/templates/datasources.yaml.j2
@@ -0,0 +1,12 @@
+# {{ ansible_managed }}
+apiVersion: 1
+
+datasources:
+  - name: Prometheus
+    type: prometheus
+    access: proxy
+    orgId: 1
+    uid: prometheus
+    url: http://localhost:9090
+    isDefault: true
+    editable: false
diff --git a/ansible/roles/grafana/templates/grafana.ini.j2 b/ansible/roles/grafana/templates/grafana.ini.j2
new file mode 100644
index 0000000..252d177
--- /dev/null
+++ b/ansible/roles/grafana/templates/grafana.ini.j2
@@ -0,0 +1,7 @@
+# {{ ansible_managed }}
+#
+# Minimal grafana config - only non-default values.
+# See /opt/homebrew/opt/grafana/share/grafana/conf/defaults.ini for all options.
+
+[paths]
+provisioning = /opt/homebrew/etc/grafana/provisioning