added 'monitoring' path - ask devs why it's there

monitoring/artc0/nginx-monitor-location.conf

@@ -0,0 +1,77 @@
+# Grafana monitoring proxy — add inside the `server { listen 80; }` block in apps.conf
+# Place BEFORE the generic  location /app/androidcast_project/  block.
+#
+# Access flow:
+#   Browser → FE nginx (TLS) → artc0 BE nginx :80 → cast04:3000 (Grafana)
+#   auth_request validates PHP session on each request.
+# ─────────────────────────────────────────────────────────────────────────────
+
+    # ── Internal auth_request endpoint (not directly accessible) ────────────
+    location = /app/androidcast_project/api/grafana-auth-check.php {
+        internal;
+        include        fastcgi_params;
+        fastcgi_pass   unix:/run/php-fpm.socket;
+        fastcgi_param  SCRIPT_FILENAME /var/www/localhost/htdocs/apps/app/androidcast_project/api/grafana-auth-check.php;
+        fastcgi_param  SCRIPT_NAME     /app/androidcast_project/api/grafana-auth-check.php;
+        fastcgi_param  REQUEST_URI     $request_uri;
+        # Forward the original session cookie so the PHP script can read it
+        fastcgi_param  HTTP_COOKIE     $http_cookie;
+    }
+
+    # ── Redirect bare paths to trailing slash ────────────────────────────────
+    location = /app/androidcast_project/monitor {
+        return 301 /app/androidcast_project/monitor/;
+    }
+
+    location = /app/androidcast_project/alertmanager {
+        return 301 /app/androidcast_project/alertmanager/;
+    }
+
+    # ── Alertmanager UI at cast04:9093 via auth_request ──────────────────────
+    location /app/androidcast_project/alertmanager/ {
+        auth_request /app/androidcast_project/api/grafana-auth-check.php;
+        auth_request_set $grafana_user $upstream_http_x_webauth_user;
+        error_page 401 = @monitor_login_redirect;
+
+        proxy_pass         http://10.7.16.239:9093/;
+        proxy_set_header   Host              $http_host;
+        proxy_set_header   X-Real-IP         $remote_addr;
+        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
+        proxy_set_header   X-Forwarded-Proto $scheme;
+
+        proxy_http_version 1.1;
+        proxy_read_timeout 120;
+        proxy_send_timeout 120;
+    }
+
+    # ── Grafana at cast04:3000 via auth_request ───────────────────────────────
+    location /app/androidcast_project/monitor/ {
+        # Validate PHP session before allowing through
+        auth_request /app/androidcast_project/api/grafana-auth-check.php;
+
+        # Capture username from auth response header and forward to Grafana
+        auth_request_set $grafana_user $upstream_http_x_webauth_user;
+
+        # Redirect to login if not authenticated
+        error_page 401 = @monitor_login_redirect;
+
+        proxy_pass         http://10.7.16.239:3000/;
+        proxy_set_header   Host              $http_host;
+        proxy_set_header   X-Real-IP         $remote_addr;
+        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
+        proxy_set_header   X-Forwarded-Proto $scheme;
+        # Pass authenticated user to Grafana auth proxy
+        proxy_set_header   X-WEBAUTH-USER    $grafana_user;
+
+        proxy_http_version 1.1;
+        proxy_read_timeout 300;
+        proxy_send_timeout 300;
+        # WebSocket support (Grafana live)
+        proxy_set_header   Upgrade    $http_upgrade;
+        proxy_set_header   Connection $connection_upgrade;
+    }
+
+    # ── Login redirect for unauthenticated monitor access ────────────────────
+    location @monitor_login_redirect {
+        return 302 /app/androidcast_project/login?redirect=$request_uri;
+    }