feat: Tempo 3, Access-gated Grafana, and a logs dashboard#7
Merged
Conversation
Per the official monolithic migration: ingester and compactor blocks removed (live-store/backend-worker handle both), local-blocks processor dropped, traces_storage removed; block retention (7d) moves under overrides.defaults.compaction. Boot-tested standalone, then verified in place against the live stack: existing 2.x blocks readable, traces queryable, span metrics regenerating. Dependabot's Tempo major-version ignore is removed now the migration is done.
Email one-time-PIN at the edge for the public Grafana hostname, allowed addresses via the grafana_allowed_emails variable. The OTLP hostname stays outside Access — machines authenticate with the bearer token. Validated against the provider v5 schema.
Logs Overview covers the OTLP log path (volume by service and level, error tail, live tail — verified against live data); Stack Health gains an Active Alerts table (Watchdog excluded, it fires by design) and becomes Grafana's home dashboard so operators land on stack state instead of the welcome page.
The .env.example equivalent for infra/: the four input variables (account_id, zone_id, domain, grafana_allowed_emails) with a note that the API token comes from CLOUDFLARE_API_TOKEN, not tfvars. Un-ignore *.tfvars.example so it's tracked while real tfvars stay ignored.
Defines jargon on first use (OTLP, RED, exemplars, cardinality, dead man's switch), breaks up dense sentences, and keeps the technical detail. No factual changes.
pyproject.toml replaces requirements.txt (Dependabot's pip ecosystem reads it too), the image builds on the uv base, and the container was verified to build and start. CHANGELOG's Unreleased section becomes 0.2.0 ahead of tagging.
… least one email is set
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Builds on the reliability work: completes the one deferred upgrade, closes the last open door on the public edge, and adds the dashboard the stack was missing.
infra/alongside the tunnel and DNS. The OTLP endpoint stays outside Access, machines authenticate with the bearer token instead.infra/terraform.tfvars.exampleso the infra inputs are as discoverable as .env.example.uv+ Python 3.14 with apyproject.toml(Dependabot watches it), image verified to build and boot.Everything was checked against the running stack, not just in config.
just checkandjust infra-validatepass.