eblume/blumeops
1
1
Fork 0
Code Issues Pull requests Projects Releases 83 Packages Wiki Activity Actions
blumeops/docs/reference/services/grafana.md
Erich Blume db0512b5d4 Doc review: 5 stalest cards; scale back ai-docs rule; document heph CLI (#373) 
## Doc review (5 stalest, all never-reviewed)

Each card was verified against live state (ArgoCD app list/health, manifests, 1Password item fields, Mealie API probe) and stamped `last-reviewed: 2026-06-09`.

| Card | Findings fixed |
|------|----------------|
| `reference/services/argocd.md` | Added Authentik SSO (public PKCE client, `--sso` login, admins→role:admin RBAC); documented dual-cluster management (minikube + ringtail k3s at `ringtail.tail8d86e.ts.net:6443`); corrected sync policy — the `apps` root is **manual**, not automated |
| `reference/services/authentik.md` | Blueprint list grown from 5 to 10 files; OIDC client table now lists all 8 clients with types; secrets table updated to `postgresql-*` fields and per-client secrets |
| `reference/services/grafana.md` | TeslaMate datasource moved to `pg.ops.eblu.me:5434` (ringtail); dashboard inventory refreshed (20 provisioned ConfigMaps); TeslaMate dashboards documented as init-container fetch from forge mirror at pinned tag; SSO role mapping wording corrected (Admin only for `admins` group) |
| `reference/infrastructure/unifi.md` | UnPoller image is now locally built (`registry.ops.eblu.me/blumeops/unpoller`); verified namespace/port |
| `how-to/mealie/plan-a-meal.md` | Procedure verified; **found the stored API token (`op://blumeops/mealie/credential`) returns 401** — operational fix in progress, doc content unchanged |

## AGENTS.md

- **Scaled back the ai-docs rule** (per discussion): agents now start by finding and reading relevant docs; `mise run ai-docs` (~130K tokens now) and `ai-sources` become opt-in bulk loads. `agent-change-process.md` updated to match. The `ai-docs` mise task itself is kept for now — happy to retire it in a follow-up if desired.
- **Documented the heph CLI** task workflow (list/show/context/log read paths; done/drop/skip/log/edit/task write paths) so future sessions can read and manipulate Blumeops tasks without rediscovery.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Reviewed-on: #373
2026-06-09 16:05:01 -07:00

2.6 KiB
Raw Blame History

title modified last-reviewed tags
Grafana 2026-06-09 2026-06-09
service
observability

Grafana

Dashboards and visualization for BlumeOps observability.

Quick Reference

Property Value
URL https://grafana.ops.eblu.me
Tailscale URL https://grafana.tail8d86e.ts.net
Namespace monitoring
Deployment Kustomize (argocd/manifests/grafana/)
Image registry.ops.eblu.me/blumeops/grafana
Sidecar Image registry.ops.eblu.me/blumeops/grafana-sidecar

Authentication

Grafana supports two login methods:

  • SSO via authentik — OIDC login through Authentik (auth.generic_oauth). Members of the Authentik admins group get the Admin role; everyone else gets Viewer (role_attribute_path in grafana.ini).
  • Local admin — break-glass login using the password from 1Password ("Grafana (blumeops)"). Always available if Authentik is down.

The OIDC client secret is injected via external-secrets (grafana-authentik-oauth secret in monitoring namespace).

Datasources

Name Type Target
Prometheus prometheus prometheus.monitoring.svc.cluster.local:9090
Loki loki loki.monitoring.svc.cluster.local:3100
Tempo tempo tempo.monitoring.svc.cluster.local:3200
TeslaMate postgres pg.ops.eblu.me:5434 (TeslaMate's database on ringtail, via Caddy L4)

Dashboard Provisioning

Dashboards are ConfigMaps with label grafana_dashboard: "1".

Location: argocd/manifests/grafana-config/dashboards/

Optional annotation: grafana_folder: "FolderName"

Key Dashboards

Provisioned dashboards live in argocd/manifests/grafana-config/dashboards/ (one ConfigMap per dashboard). Coverage as of 2026-06: alerts, borgmatic, CV APM, devpi, docs APM, fly.io proxy, forgejo, frigate, jellyfin, kubernetes, loki, macOS (indri host), postgresql, ringtail, shower APM, sifaka disks, snowflake proxy, tempo, transmission, zot.

TeslaMate's dashboards are not in the repo — an init container fetches them from the forge mirror at a pinned tag (TESLAMATE_VERSION in argocd/manifests/grafana/deployment.yaml).

Related