# Grafana config — cast04
# Served at: https://apps.f0xx.org/app/androidcast_project/monitor/
# Auth: nginx auth_request validates PHP session → X-WEBAUTH-USER header → Grafana auth proxy

[DEFAULT]

[paths]
data = /var/lib/grafana
logs = /var/log/grafana
plugins = /var/lib/grafana/plugins
provisioning = /etc/grafana/provisioning

[server]
protocol = http
http_addr = 0.0.0.0
http_port = 3000
domain = apps.f0xx.org
root_url = https://apps.f0xx.org/app/androidcast_project/monitor/
serve_from_sub_path = true
enable_gzip = true

[database]
type = sqlite3
path = grafana.db

[session]
provider = file

[analytics]
reporting_enabled = false
check_for_updates = true

[security]
# Change after first login; used for direct access bypassing the PHP session
admin_user = admin
admin_password = acMonitor2026!
secret_key = acMonitorSecret2026changeme
disable_initial_admin_creation = false
allow_embedding = true

[users]
allow_sign_up = false
allow_org_create = false
auto_assign_org = true
auto_assign_org_role = Viewer
default_theme = dark

# ── Auth proxy (PHP session integration) ────────────────────────────────────
# nginx validates the PHP session cookie and sets X-WEBAUTH-USER if valid.
# Grafana trusts this header and auto-creates/logs in the user.
[auth.proxy]
enabled = true
header_name = X-WEBAUTH-USER
header_property = username
auto_sign_up = true
# Only trust the header from artc0 nginx (10.7.16.128):
whitelist = 10.7.16.128
# Sync roles from header (optional, set X-WEBAUTH-ROLE in nginx if needed):
# headers = Role:X-WEBAUTH-ROLE

[auth.anonymous]
enabled = false

[auth.basic]
# Keep enabled for direct admin access (curl / provisioning scripts)
enabled = true

[smtp]
enabled = false   # Grafana own SMTP not needed; alertmanager handles mail

[log]
mode = file
level = info

[log.file]
log_rotate = true
max_lines = 1000000
max_size_shift = 28
daily_rotate = true
max_days = 7

[alerting]
enabled = false   # Using Prometheus Alertmanager, not Grafana's legacy alerting

[unified_alerting]
enabled = false   # Unified alerting also off; Alertmanager is the source of truth

[feature_toggles]
enable =