Erich Blume
db0512b5d4
## Doc review (5 stalest, all never-reviewed) Each card was verified against live state (ArgoCD app list/health, manifests, 1Password item fields, Mealie API probe) and stamped `last-reviewed: 2026-06-09`. | Card | Findings fixed | |------|----------------| | `reference/services/argocd.md` | Added Authentik SSO (public PKCE client, `--sso` login, admins→role:admin RBAC); documented dual-cluster management (minikube + ringtail k3s at `ringtail.tail8d86e.ts.net:6443`); corrected sync policy — the `apps` root is **manual**, not automated | | `reference/services/authentik.md` | Blueprint list grown from 5 to 10 files; OIDC client table now lists all 8 clients with types; secrets table updated to `postgresql-*` fields and per-client secrets | | `reference/services/grafana.md` | TeslaMate datasource moved to `pg.ops.eblu.me:5434` (ringtail); dashboard inventory refreshed (20 provisioned ConfigMaps); TeslaMate dashboards documented as init-container fetch from forge mirror at pinned tag; SSO role mapping wording corrected (Admin only for `admins` group) | | `reference/infrastructure/unifi.md` | UnPoller image is now locally built (`registry.ops.eblu.me/blumeops/unpoller`); verified namespace/port | | `how-to/mealie/plan-a-meal.md` | Procedure verified; **found the stored API token (`op://blumeops/mealie/credential`) returns 401** — operational fix in progress, doc content unchanged | ## AGENTS.md - **Scaled back the ai-docs rule** (per discussion): agents now start by finding and reading relevant docs; `mise run ai-docs` (~130K tokens now) and `ai-sources` become opt-in bulk loads. `agent-change-process.md` updated to match. The `ai-docs` mise task itself is kept for now — happy to retire it in a follow-up if desired. - **Documented the heph CLI** task workflow (list/show/context/log read paths; done/drop/skip/log/edit/task write paths) so future sessions can read and manipulate Blumeops tasks without rediscovery. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Reviewed-on: #373
66 lines
2.6 KiB
Markdown
66 lines
2.6 KiB
Markdown
---
|
|
title: Grafana
|
|
modified: 2026-06-09
|
|
last-reviewed: 2026-06-09
|
|
tags:
|
|
- service
|
|
- observability
|
|
---
|
|
|
|
# Grafana
|
|
|
|
Dashboards and visualization for BlumeOps observability.
|
|
|
|
## Quick Reference
|
|
|
|
| Property | Value |
|
|
|----------|-------|
|
|
| **URL** | https://grafana.ops.eblu.me |
|
|
| **Tailscale URL** | https://grafana.tail8d86e.ts.net |
|
|
| **Namespace** | `monitoring` |
|
|
| **Deployment** | Kustomize (`argocd/manifests/grafana/`) |
|
|
| **Image** | `registry.ops.eblu.me/blumeops/grafana` |
|
|
| **Sidecar Image** | `registry.ops.eblu.me/blumeops/grafana-sidecar` |
|
|
|
|
## Authentication
|
|
|
|
Grafana supports two login methods:
|
|
|
|
- **SSO via [[authentik]]** — OIDC login through Authentik (`auth.generic_oauth`). Members of the Authentik `admins` group get the Admin role; everyone else gets Viewer (`role_attribute_path` in `grafana.ini`).
|
|
- **Local admin** — break-glass login using the password from 1Password ("Grafana (blumeops)"). Always available if Authentik is down.
|
|
|
|
The OIDC client secret is injected via [[external-secrets]] (`grafana-authentik-oauth` secret in monitoring namespace).
|
|
|
|
## Datasources
|
|
|
|
| Name | Type | Target |
|
|
|------|------|--------|
|
|
| Prometheus | prometheus | `prometheus.monitoring.svc.cluster.local:9090` |
|
|
| Loki | loki | `loki.monitoring.svc.cluster.local:3100` |
|
|
| Tempo | tempo | `tempo.monitoring.svc.cluster.local:3200` |
|
|
| TeslaMate | postgres | `pg.ops.eblu.me:5434` (TeslaMate's database on [[ringtail]], via Caddy L4) |
|
|
|
|
## Dashboard Provisioning
|
|
|
|
Dashboards are ConfigMaps with label `grafana_dashboard: "1"`.
|
|
|
|
Location: `argocd/manifests/grafana-config/dashboards/`
|
|
|
|
Optional annotation: `grafana_folder: "FolderName"`
|
|
|
|
## Key Dashboards
|
|
|
|
Provisioned dashboards live in `argocd/manifests/grafana-config/dashboards/` (one ConfigMap per dashboard). Coverage as of 2026-06: alerts, borgmatic, CV APM, devpi, docs APM, fly.io proxy, forgejo, frigate, jellyfin, kubernetes, loki, macOS (indri host), postgresql, ringtail, shower APM, sifaka disks, snowflake proxy, tempo, transmission, zot.
|
|
|
|
TeslaMate's dashboards are not in the repo — an init container fetches them from the forge mirror at a pinned tag (`TESLAMATE_VERSION` in `argocd/manifests/grafana/deployment.yaml`).
|
|
|
|
## Related
|
|
|
|
- [[build-grafana-images]] - Home-built container images (Grafana + sidecar)
|
|
- [[kustomize-grafana-deployment]] - Kustomize manifest structure
|
|
- [[authentik]] - OIDC identity provider for SSO
|
|
- [[migrate-grafana-to-authentik]] - How SSO was migrated from Dex to Authentik
|
|
- [[prometheus]] - Metrics datasource
|
|
- [[loki]] - Logs datasource
|
|
- [[tempo]] - Traces datasource
|
|
- [[alloy|Alloy]] - Data collector
|