feat: reach Grafana the way pgadmin is reached

[cnmaia]

A /grafana route, so it is reachable the way pgadmin is rather than through an SSH tunnel.

Grafana keeps binding 127.0.0.1 only. nginx stays the single way in.

The detail that makes it work

proxy_pass http://127.0.0.1:3001; carries no path of its own. The compose already sets GF_SERVER_SERVE_FROM_SUB_PATH=true with a root URL ending in /grafana/, so Grafana expects the prefix to arrive intact. Adding a path to proxy_pass would strip it and Grafana would redirect in a loop.

Grafana Live is websockets and gets its own block with the upgrade headers.

Before this goes live

The admin password had not actually changed, and that was worth catching before the route existed rather than after:

GF_SECURITY_ADMIN_PASSWORD in the env file	present
The same variable inside the container	absent
admin/admin against the API	accepted

Two causes, stacked. docker restart does not re-read env_file — variables are fixed when the container is created. And GF_SECURITY_ADMIN_PASSWORD only applies when the admin user is first created, so even recreating the container would have left the old password in the existing volume.

Now, after recreating the volume:

GF_SECURITY_ADMIN_PASSWORD in container: 1
admin/admin against the API:             rejected

Datasources came back on their own — they are provisioned from files, which is why losing the volume cost nothing.

Also fixes a broken verification step

The two-instances runbook told you to count /api/v1/health-check/ in the container logs. That path is deliberately excluded from the access log, so it returns zero however well the upstream is balancing — which reads exactly like a failed change, and did.

It now counts a path that is logged, and says why an even split of the Archivist's collocation/pending proves nothing here: that traffic goes through the gatekeeper network alias with no nginx involved.

With the corrected check, against the route you already applied:

20 requests to https://datamap.pcs.usp.br/api/openapi.json
datamap_gatekeeper       10
datamap_gatekeeper_b     10

Applying it

Same manual steps as before — docs/runbooks/two-instances.md, steps 2 to 5. The backup you took stays valid.

One thing worth doing in the same pass: pgadmin is already public through this file, and the trap above — a password that looks set and is not — applies to it just as well.

🤖 Generated with Claude Code

https://claude.ai/code/session_01EQda9NZvkbStEeNU54Tqgh