nils/mg4
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Dashboards in Grafana; clean up after the Next.js app

Browse Source 
- k8s/grafana.yaml: Grafana 13.2.3 with a 1Gi PVC, sign-up and
  anonymous access off. The InfluxDB datasource (URL and token from the
  environment) and three dashboards — Live, Consumption, Charging — are
  provisioned from k8s/grafana/ via kustomize-generated ConfigMaps.
- server.yaml for the Go server (port 8080, UID 65532, smaller limits),
  image tag 2.0.0. The NetworkPolicy now admits Grafana to InfluxDB.
- ingress.yaml: IngressRoutes for car.stinnesbeck.com and Grafana
  (placeholder host car-grafana.stinnesbeck.com) with tls: {}, using
  Traefik's default certificate; the cert-manager Certificate is gone.
- secrets.example.yaml: drops the dashboard secrets, adds grafana-admin.
- AGENTS.md loses its Next.js block; SPECS.md describes the new setup.

The removal of web/ (the Next.js app) and of the stale .next/ cache
upstream had committed already landed in 51e6f6f, which was staged
together with the Go server by mistake.

Checked end to end in podman (Go server + InfluxDB 2.7.12 + Grafana
13.2.3): all 25 dashboard queries return the expected data, and the
dashboards were rendered with headless Chromium. Manifests validated
offline with kustomize and kubeconform. Nothing applied to a cluster.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki
This commit is contained in:
nils
2026-10-17 15:18:09 +02:00
co-authored by Claude Opus 5.5
parent 51e6f6fd48
commit 5473ab1c2b
14 changed files with 1842 additions and 139 deletions
Download Patch File Download Diff File Expand all files Collapse all files
k8s/README.md
+23 -22
View File
@@ -1,28 +1,30 @@
# Kubernetes manifests — car.stinnesbeck.com
Plain manifests for the car server and its InfluxDB 2. They are only files: nothing here is
applied automatically. Apply them yourself.
Plain manifests for the car server, InfluxDB 2 and Grafana. They are only files: nothing here
is applied automatically. Apply them yourself.
| File | What |
|---|---|
| `namespace.yaml` | Namespace `mg4` |
| `influxdb.yaml` | InfluxDB 2.7.12 StatefulSet (10Gi PVC, default storage class), cluster-internal Service, NetworkPolicy allowing only the server |
| `server.yaml` | Server Deployment (1 replica, non-root, read-only root filesystem) and Service |
| `ingress.yaml` | cert-manager `Certificate` from `letsencrypt-prod`, Traefik `IngressRoute` on `websecure` |
| `secrets.example.yaml` | **Template** for the two Secrets; not in `kustomization.yaml` |
| `kustomization.yaml` | Everything except the Secrets; pins the server image tag |
| `influxdb.yaml` | InfluxDB 2.7.12 StatefulSet (10Gi PVC, default storage class), cluster-internal Service, NetworkPolicy admitting only the server and Grafana |
| `server.yaml` | Go server Deployment (1 replica, non-root, read-only root filesystem) and Service |
| `grafana.yaml` | Grafana 13.2.3 Deployment (1Gi PVC), Service; datasource and dashboards provisioned |
| `grafana/` | The provisioned InfluxDB datasource and the MG4 dashboards (Live, Consumption, Charging) |
| `ingress.yaml` | Traefik `IngressRoute`s for car.stinnesbeck.com and Grafana, TLS from Traefik's default certificate |
| `secrets.example.yaml` | **Template** for the Secrets; not in `kustomization.yaml` |
| `kustomization.yaml` | Everything except the Secrets; pins the server image, generates the Grafana ConfigMaps |
## Before the first apply
1. **Check the ingress class** in `ingress.yaml`. It is set to `traefik-external` as a
placeholder; use the class of your public-facing Traefik.
1. **Check `ingress.yaml`:** the ingress class (placeholder `traefik-external` for the public
Traefik) and Grafana's host (placeholder `car-grafana.stinnesbeck.com`). Both hosts must be
covered by Traefik's default certificate.
2. **Create the Secrets.** Copy `secrets.example.yaml` outside the repository, replace every
`CHANGE-ME` (`openssl rand -hex 32` for tokens), then apply the copy:
`influxdb-auth` (InfluxDB admin password and token) and `mg4-server` (ingest token,
session secret, dashboard password, your ABRP API key and user token).
3. **Registry access.** If the `mg4-server` package on git.stinnesbeck.com is private, create
the `git-stinnesbeck-registry` pull secret (command in `secrets.example.yaml`); if it is
public, delete `imagePullSecrets` from `server.yaml`.
`CHANGE-ME` (`openssl rand -hex 32`), then apply the copy: `influxdb-auth`, `mg4-server`
(ingest token, your ABRP API key and user token) and `grafana-admin`.
3. **Registry access.** If the `mg4-server` package on git.stinnesbeck.com is private, create the
`git-stinnesbeck-registry` pull secret (command in `secrets.example.yaml`); if it is public,
delete `imagePullSecrets` from `server.yaml`.
## Apply
@@ -32,13 +34,12 @@ kubectl apply -f <your filled-in secrets file>
kubectl apply -k k8s/
```
The Let's Encrypt HTTP-01 challenge needs car.stinnesbeck.com to resolve to the public
Traefik before the certificate can be issued; check with `kubectl -n mg4 get certificate`.
## Notes
- InfluxDB's setup mode runs only on an empty volume. Changing `admin-token` in the Secret
later does not change the token inside InfluxDB.
- The server uses the InfluxDB admin token. A token scoped to the `mg4` bucket can replace it
later (`influx auth create --read-bucket … --write-bucket …`).
- InfluxDB's setup mode runs only on an empty volume. Changing `admin-token` in the Secret later
does not change the token inside InfluxDB.
- The server and Grafana use the InfluxDB admin token. A token scoped to the `mg4` bucket (read
for Grafana, read/write for the server) can replace it later.
- The dashboards are read-only in Grafana's UI. Change the JSON in `grafana/dashboards/`; the
ConfigMap name changes with its content, which rolls Grafana.
- To upgrade the server, push a new image tag and change `newTag` in `kustomization.yaml`.