fix: disable Grafana enforce_domain to allow LAN proxy access

With enforce_domain = true, Grafana redirects any request not matching the configured domain (hosea.shire-zebra.ts.net) back to that hostname. Since the nginx proxy serves Grafana at grafana.thehellings.lan, every proxied request gets redirected to the Tailscale address, making the proxy useless for non-Tailscale clients. The domain setting is still correct for cookie scoping; enforce_domain is only needed if direct port access is a concern, which is mitigated by the firewall (port 3001 is not open on the LAN).
2026-03-25 17:40:38 -05:00
parent ffff7e9683
commit 053e383046
1 changed files with 1 additions and 1 deletions
@@ -135,7 +135,7 @@ in
        security.secret_key = "$__file{${config.age.secrets.grafana-secret-key.path}}";
        server = {
          domain = "${config.networking.hostName}.shire-zebra.ts.net";
-          enforce_domain = true;
+          enforce_domain = false;
          http_addr = "0.0.0.0";
          enable_gzip = true;
          http_port = 3001;