Adds protected Grafana and generated Grafana dashboard JSON

Author: nextinterfaces

Taskfile.yml

@@ -255,7 +255,8 @@ tasks:
       - kubectl --kubeconfig={{.KUBECONFIG}} rollout status deployment/grafana --timeout=120s
       - echo ""
       - echo "Grafana UI available at https://app.roussev.com/grafana"
-      - echo "Anonymous access enabled (no login required)"
+      - echo "Public viewing enabled (Viewer role)"
+      - echo "Admin login - admin/admin"
 
   deploy:observability:
     desc: Deploy full observability stack (Jaeger, Prometheus, Grafana)

apps/items-service/src/html.ts

@@ -47,7 +47,7 @@ export function getRootPageHtml(): string {
             <p><strong>Observability:</strong></p>
             <p><a href="/jaeger" target="_blank">Jaeger</a> - Distributed tracing</p>
             <p><a href="/prometheus" target="_blank">Prometheus</a> - Metrics collection</p>
-            <p><a href="https://app.roussev.com/grafana/d/a7333118-220b-4389-b277-3d79b0605970/items-service-dashboard?orgId=1" target="_blank">Grafana</a> - Metrics visualization</p>
+            <p><a href="https://app.roussev.com/grafana/d/items-service-metrics/items-service-metrics" target="_blank">Grafana</a> - Metrics dashboard</p>
             <p><a href="/items/metrics" target="_blank">Metrics Endpoint</a> - Raw Prometheus metrics</p>
 
             <p><strong>Documentation:</strong></p>

infra/k8s/local/grafana-local.yaml

@@ -126,12 +126,19 @@ spec:
         - containerPort: 3000
           name: http
         env:
+        # Anonymous access - read-only for public viewing
         - name: GF_AUTH_ANONYMOUS_ENABLED
           value: "true"
         - name: GF_AUTH_ANONYMOUS_ORG_ROLE
-          value: "Admin"
+          value: "Viewer"
+        # Keep login form enabled for admin access
         - name: GF_AUTH_DISABLE_LOGIN_FORM
-          value: "true"
+          value: "false"
+        # Admin credentials for editing dashboards
+        - name: GF_SECURITY_ADMIN_USER
+          value: "admin"
+        - name: GF_SECURITY_ADMIN_PASSWORD
+          value: "admin"
         - name: GF_SECURITY_ALLOW_EMBEDDING
           value: "true"
         volumeMounts: