Expose Grafana with Nginx Reverse Proxy

README.md

Expose Grafana with Nginx Reverse Proxy

This documentation tested on Ubuntu 20.04 Server LTS.

Goals

• Make grafana can accessed to world with stack.bignetlab.com/grafana
• Expose with Nginx Reverse Proxy Technique.

Make Sure

• Make sure you have a Public IP.
  • You can try to use a VPN
• Make sure you have a Grafana
• Make sure you have a Nginx, apt install -y nginx

Configuration

• Configure nginx block

nano /etc/nginx/sites-enabled/default

server {
  listen 80 default_server;
  listen [::]:80 default_server;
  server_name stack.bignetlab.com www.stack.bignetlab.com;
  return 301 https://stack.bignetlab.com;
}

server {
        listen 80;
        listen 443 ssl http2;
        listen [::]:443 ssl http2;
        
        server_name stack.bignetlab.com www.stack.bignetlab.com;
        ssl_certificate /etc/ssl/certs/stack/stack.crt;
        ssl_certificate_key /etc/ssl/certs/stack/stack.key;
        ssl_protocols TLSv1.2 TLSv1.1 TLSv1;

location /grafana/ {
        proxy_buffering on;
        proxy_buffers 8 128k;
        proxy_buffer_size 128k;
        
        proxy_set_header   Host             $host;
        proxy_set_header   X-Real-IP        $remote_addr;
        proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
        
        proxy_pass http://192.168.17.139:3000/;
        proxy_redirect     default;				
        
        proxy_cache_key "$request_uri";
        proxy_cache_min_uses 1;			
        proxy_cache_valid 200 302 120s;
        proxy_cache_valid 404 1m;
        add_header X-Cache-Status $upstream_cache_status;
    }
}

• Restart nginx, with sudo service nginx reload
• Configure grafana.ini

nano /etc/grafana/grafana.ini

[server]
root_url = https://stack.bignetlab.com/grafana

• Restart Grafana, with sudo systemctl restart grafana-server.service
• Access on https://stack.bignetlab.com/grafana

Prometheus Behind Reverse Proxy

• For example, your prometheus run on 192.168.2.80:9091
• And you want to access on https://localhost:9091

nano /etc/nginx/sites-enabled/default

server {
    listen 9091;
    ssl on;

    ssl_certificate /etc/ssl/certs/prom/key.crt;
    ssl_certificate_key /etc/ssl/certs/prom/key.key;

location / {
    proxy_buffering on;
    proxy_buffers 8 128k;
    proxy_buffer_size 128k;
    
    proxy_set_header   Host             $host;
    proxy_set_header   X-Real-IP        $remote_addr;
    proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
    proxy_http_version 1.1;
    proxy_set_header Connection "";
    
    proxy_pass https://192.168.2.80:9091/;
    proxy_redirect     default;				
    
    proxy_cache_key "$request_uri";
    proxy_cache_min_uses 1;			
    proxy_cache_valid 200 302 120s;
    proxy_cache_valid 404 1m;
    add_header X-Cache-Status $upstream_cache_status;
    }
}