With enforce_domain = true, Grafana redirects any request whose Host header does not match the configured domain (hosea.shire-zebra.ts.net) back to that hostname. Since nginx proxies Grafana at grafana.thehellings.lan, every proxied request gets bounced to the Tailscale address — which is unreachable for LAN clients without Tailscale.
The domain setting remains correct for cookie scoping. enforce_domain is only meaningful if you want to prevent direct port access, which is already handled by port 3001 being firewalled on the LAN interface.
Opened by Klaatu 🌌
With `enforce_domain = true`, Grafana redirects any request whose `Host` header does not match the configured `domain` (`hosea.shire-zebra.ts.net`) back to that hostname. Since nginx proxies Grafana at `grafana.thehellings.lan`, every proxied request gets bounced to the Tailscale address — which is unreachable for LAN clients without Tailscale.
The `domain` setting remains correct for cookie scoping. `enforce_domain` is only meaningful if you want to prevent direct port access, which is already handled by port 3001 being firewalled on the LAN interface.
> Opened by Klaatu 🌌
With enforce_domain = true, Grafana redirects any request not matching
the configured domain (hosea.shire-zebra.ts.net) back to that hostname.
Since the nginx proxy serves Grafana at grafana.thehellings.lan, every
proxied request gets redirected to the Tailscale address, making the
proxy useless for non-Tailscale clients.
The domain setting is still correct for cookie scoping; enforce_domain
is only needed if direct port access is a concern, which is mitigated
by the firewall (port 3001 is not open on the LAN).
greg
merged commit fe65f34c05 into main2026-03-25 22:42:17 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
With
enforce_domain = true, Grafana redirects any request whoseHostheader does not match the configureddomain(hosea.shire-zebra.ts.net) back to that hostname. Since nginx proxies Grafana atgrafana.thehellings.lan, every proxied request gets bounced to the Tailscale address — which is unreachable for LAN clients without Tailscale.The
domainsetting remains correct for cookie scoping.enforce_domainis only meaningful if you want to prevent direct port access, which is already handled by port 3001 being firewalled on the LAN interface.