Make grafana viewable

core/Dockerfile.emap-portal

@@ -4,7 +4,7 @@ RUN apt update && \
     apt clean
 COPY core/emap-portal/nginx.conf /etc/nginx/
 COPY core/emap-portal/conf.d/ /etc/nginx/conf.d/
-COPY core/emap-portal/www/* /usr/share/nginx/html/
+COPY --chmod=644 core/emap-portal/www/ /usr/share/nginx/html/
 RUN --mount=type=secret,id=portal-build-secrets \
     . /run/secrets/portal-build-secrets && \
     htpasswd -b -B -c /etc/nginx/conf.d/htpasswd "$PORTAL_USERNAME" "$PORTAL_PASSWORD"

core/docker-compose.yml

@@ -87,6 +87,9 @@ services:
         - portal-build-secrets
     env_file:
       - ../../config/portal-config-envs
+    networks:
+      - default
+      - emap-portal-grafana
     ports:
       - "${PORTAL_PORT}:80"
 
@@ -99,3 +102,8 @@ secrets:
   portal-build-secrets:
     file: ../../config/portal-config-envs
 
+
+networks:
+  # connect the emap-portal to external grafana without going via the host interface
+  emap-portal-grafana:
+    external: true

core/emap-portal/conf.d/default.conf

@@ -8,6 +8,8 @@ server {
     auth_basic           "Administrator’s Area";
     auth_basic_user_file conf.d/htpasswd;
 
+    # don't cache failed DNS indefinitely
+    resolver 127.0.0.11 valid=10s;
 
     access_log  /var/log/nginx/host.access.log  main;
 
@@ -24,17 +26,40 @@ server {
         root   /usr/share/nginx/html;
         include conf.d/shared/shared_location_config.conf;
     }
+    # Using intermediate variables for the proxy_pass directives forces
+    # late resolution of the hostname, so the portal still comes up if
+    # the upstream container(s) are down.
+    # But using variables leads to the unintuitive behaviour described
+    # here: https://trac.nginx.org/nginx/ticket/803
 
     location /glowroot/ {
         include conf.d/shared/shared_location_config.conf;
-        proxy_pass   http://glowroot-central:4000/;
+        set $glowroot_upstream http://glowroot-central:4000;
+        # A proxy_pass using a variable can't strip the location prefix, so do it
+        # with a rewrite (which keeps the query string) instead.
+        rewrite ^/glowroot/(.*)$ /$1 break;
+        proxy_pass   $glowroot_upstream;
         sub_filter 'href="/' 'href="/glowroot/';
         sub_filter 'src="/' 'src="/glowroot/';
     }
 
     location /streamlit/ {
         include conf.d/shared/shared_location_config.conf;
-        proxy_pass   http://streamlit:8501/streamlit/;
+        set $streamlit_upstream http://streamlit:8501;
+        # No path is specified after the variable, so that the original request path
+        # (which already starts with /streamlit/) is forwarded unchanged.
+        proxy_pass   $streamlit_upstream;
+        proxy_buffering off;
+
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+    location /local-grafana/ {
+        include conf.d/shared/shared_location_config.conf;
+        # emap-portal and waveform-controller's lgtm service must be
+        # on the same docker network, which must be manually created.
+        set $grafana_upstream http://lgtm:3000;
+        proxy_pass   $grafana_upstream;
         proxy_buffering off;
 
         proxy_set_header Upgrade $http_upgrade;

core/emap-portal/www/index.html

@@ -11,6 +11,7 @@
     <li><a href="/streamlit">streamlit</a>
     <!-- experimental - still accessible directly so don't forget to keep auth enabled in the apps themselves! -->
     <li><a href="/glowroot">Glowroot</a> (experimental)
+    <li><a href="/local-grafana">Grafana (local to this Emap instance)</a> This is a stopgap until GAE-level LGTM gets deployed
 </ul>
 
 </body>

docs/dev/deployment.md

@@ -241,6 +241,10 @@ See Slab for the
 [required chmod/chown/setfacl trick](https://uclh.slab.com/posts/shared-virtual-python-environments-with-uv-u7pa2fv4#hpkxd-per-gae-setup-tasks)
 if you did this.
 
+### Create docker network
+
+`docker network create emap-portal-grafana`
+
 ### Bringing up an instance
 ```bash
 emap docker up -d