Add grafana datasource provisioning and update workflow docs

- Configure grafana to use provisioned datasources instead of UI config
- Add prometheus datasource template managed by ansible
- Create minimal grafana.ini with custom provisioning path
- Move ansible_managed to group_vars (fixes deprecation warning)
- Add Remote Hosts and Git Workflow sections to CLAUDE.md
- Document feature branch workflow with tea CLI for PRs

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.claude/settings.local.json

@@ -1,7 +1,8 @@
 {
   "permissions": {
     "allow": [
-      "Bash(mcquack --help:*)"
+      "Bash(mcquack --help:*)",
+      "Bash(tea help:*)"
     ]
   }
 }

CLAUDE.md

@@ -20,6 +20,43 @@ You are encouraged to explore the zk, follow links, and propose updates to it as
 4. Use `brew services` or Launch Agents to control services on macos hosts.
 5. Test all changes before applying them - ie with ansible, use a --check --diff run.
 
+## Remote Hosts
+
+This repo is typically edited from a workstation (e.g., gilbert), but services run on remote hosts in the tailnet. Use SSH to explore or check state on remote machines:
+
+```bash
+# Explore config paths on indri
+ssh indri 'ls -la /opt/homebrew/etc/grafana/'
+
+# Check service status
+ssh indri 'brew services list'
+```
+
+Key hosts:
+- **indri** - Mac Mini M1 running services (prometheus, grafana, kiwix, forgejo, borgmatic)
+- **sifaka** - Synology NAS (backup target)
+
+## Git Workflow
+
+Use feature branches for all changes. Do not commit directly to main.
+
+```bash
+# Create a feature branch
+git checkout -b feature/description-of-change
+
+# Make changes, then commit
+git add -A
+git commit -m "Description of change"
+
+# Push and create PR using tea CLI
+git push -u origin feature/description-of-change
+tea pr create --title "Description of change" --description "Details..."
+```
+
+PRs are reviewed and merged via the Forgejo web UI at https://forge.tail8d86e.ts.net.
+
+After creating a PR, run `open <pr-url>` to open it in the browser (Claude Code's UI will prompt for permission).
+
 ## Ansible
 
 Run playbooks from the `ansible/` directory.

ansible/group_vars/all.yml

@@ -0,0 +1,2 @@
+---
+ansible_managed: "Managed by ansible - do not edit. Source: ssh://forgejo@forge.tail8d86e.ts.net/eblume/blumeops.git"

ansible/roles/grafana/tasks/main.yml

@@ -4,6 +4,30 @@
     name: grafana
     state: present
 
+- name: Create grafana provisioning directories
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    mode: '0755'
+  loop:
+    - /opt/homebrew/etc/grafana/provisioning
+    - /opt/homebrew/etc/grafana/provisioning/datasources
+    - /opt/homebrew/etc/grafana/provisioning/dashboards
+
+- name: Configure grafana.ini
+  ansible.builtin.template:
+    src: grafana.ini.j2
+    dest: /opt/homebrew/etc/grafana/grafana.ini
+    mode: '0644'
+  notify: restart grafana
+
+- name: Deploy grafana datasources config
+  ansible.builtin.template:
+    src: datasources.yaml.j2
+    dest: /opt/homebrew/etc/grafana/provisioning/datasources/datasources.yaml
+    mode: '0644'
+  notify: restart grafana
+
 - name: Ensure grafana service is started
   ansible.builtin.command: brew services start grafana
   register: brew_start

ansible/roles/grafana/templates/datasources.yaml.j2

@@ -0,0 +1,12 @@
+# {{ ansible_managed }}
+apiVersion: 1
+
+datasources:
+  - name: Prometheus
+    type: prometheus
+    access: proxy
+    orgId: 1
+    uid: prometheus
+    url: http://localhost:9090
+    isDefault: true
+    editable: false

ansible/roles/grafana/templates/grafana.ini.j2

@@ -0,0 +1,7 @@
+# {{ ansible_managed }}
+#
+# Minimal grafana config - only non-default values.
+# See /opt/homebrew/opt/grafana/share/grafana/conf/defaults.ini for all options.
+
+[paths]
+provisioning = /opt/homebrew/etc/grafana/provisioning