grafana — reports.embeddedera.com (read-only reporting over the ERP)¶
grafana/grafana-oss:13.0.2, service grafana at the end of the torrentvpn compose file, bound to
127.0.0.1:3000 only; public through tunnel plex behind the Access app "EmbeddedEra Reports".
Identity: [auth.proxy] on Cf-Access-Authenticated-User-Email, whitelist = 127.0.0.1, 172.18.0.1
(the tunnel's requests arrive from the docker gateway, not loopback — that cost an hour). Login form
disabled; new people auto-sign-up as Viewer. Local admin password in ~/.config/reports/env
(GF_SECURITY_ADMIN_PASSWORD; compose must NOT interpolate it with ${…}, which reads the host env
and silently produced the default admin/admin). Reset with
docker exec grafana grafana cli --homepath /usr/share/grafana --config /etc/grafana/grafana.ini admin reset-admin-password …;
five wrong basic-auth tries lock the account for ~5 min.
Data: Postgres role reports_ro (SELECT only, proven: DELETE denied) on database inventree, and
database reports (owner reports_rw) holding audit_runs / audit_checks, appended by sop-audit
on every run. Datasources and dashboards are provisioned from files (~/torrentvpn/grafana/):
provisioning/, dashboards/<Folder>/*.json (folders from the file structure, not editable in the UI —
a dashboard is a document, edit the JSON and it reloads within 30 s). Datasource gotcha: the Postgres plugin in Grafana 13 reads the database name from jsonData.database, not the top-level database: — with the latter every panel shows "no default database configured" while the API query path still works. Data dir grafana/data/ — add to
the nightly backup if dashboards ever get edited in the UI (they should not). Plan: reporting.
Access (2026-09-12): folders Operations / Business / Quality / People / System / Finance; who sees which comes from reports: in departments.yml via ~/.local/bin/reports-sync (hourly cron + on every onboard change). Folder permissions are fully replaced by the sync, so never rely on the default Viewer role — a person with no team sees an empty Grafana.
Landing pages (2026-09-14): nobody lands on Grafana's stock welcome page any more. Two extra
dashboards: dashboards/start-here.json (uid ee-start, root folder, links only, no queries, so it is
safe as the org default for anyone with no team) and dashboards/System/home.json (uid ee-home,
System folder = Administration only: the headline number from every report — audit grade/fails/warns,
open/overdue/unassigned tasks, open orders, invoiced this month, parts, stock, open POs and builds —
each tile linking to its source). Who lands where is HOME_BY_TEAM in reports-sync (Administration →
ee-home, Engineering → ee-tasks, Production/Purchasing → ee-stock, Sales/Finance → ee-sales), applied
through /api/teams/{id}/preferences and /api/org/preferences; a person in two teams gets whichever
Grafana resolves first, so keep every candidate inside their folder access. Verified from loopback with
the Cf-Access-Authenticated-User-Email header as each real identity, not just as admin.