From 893696ce8d2ce2e5b8f601450c0cd3b14c6071bc Mon Sep 17 00:00:00 2001
From: whitney <whitney.server@gmail.com>
Date: Wed, 4 Nov 2026 16:06:40 -0800
Subject: [PATCH] Add auth-protected prometheus ui

---
 games/minecraft/docker-compose.yml            |  6 +++---
 .../infrastructure/grafana/.env.example       |  9 ++++++++
 .../infrastructure/grafana/.gitignore         |  1 +
 .../infrastructure/grafana/README.md          |  3 +++
 .../infrastructure/grafana/docker-compose.yml | 21 ++++++++++++-------
 5 files changed, 30 insertions(+), 10 deletions(-)
 create mode 100644 software-development/infrastructure/grafana/.env.example
 create mode 100644 software-development/infrastructure/grafana/.gitignore

diff --git a/games/minecraft/docker-compose.yml b/games/minecraft/docker-compose.yml
index e90e2ad..d205eb7 100644
--- a/games/minecraft/docker-compose.yml
+++ b/games/minecraft/docker-compose.yml
@@ -2,7 +2,7 @@ networks:
   minecraft:
     driver: bridge
     name: minecraft
-  grafana:
+  metrics:
     external: true
   traefik:
     external: true
@@ -47,7 +47,7 @@ services:
     container_name: minecraft_creative
     restart: unless-stopped
     networks:
-      - grafana
+      - metrics
       - minecraft
     ports:
       - "25566:25565"
@@ -80,7 +80,7 @@ services:
     container_name: minecraft_2023
     networks:
       - traefik
-      - grafana
+      - metrics
       - minecraft
     ports:
       - "25565:25565"
diff --git a/software-development/infrastructure/grafana/.env.example b/software-development/infrastructure/grafana/.env.example
new file mode 100644
index 0000000..28f1638
--- /dev/null
+++ b/software-development/infrastructure/grafana/.env.example
@@ -0,0 +1,9 @@
+# Copy to .env and fill in. Docker Compose reads .env automatically.
+
+# Public hostname Traefik routes to the Prometheus UI
+PROMETHEUS_HOST=prometheus.whitney.rip
+
+# Basic auth for the Prometheus UI, in htpasswd format (user:bcrypt-hash).
+# Generate with: htpasswd -nbB admin 'your-password'
+# Keep the single quotes so Compose doesn't treat the $ in the hash as variables.
+PROMETHEUS_BASIC_AUTH='admin:$2y$05$replace_with_generated_hash'
diff --git a/software-development/infrastructure/grafana/.gitignore b/software-development/infrastructure/grafana/.gitignore
new file mode 100644
index 0000000..4c49bd7
--- /dev/null
+++ b/software-development/infrastructure/grafana/.gitignore
@@ -0,0 +1 @@
+.env
diff --git a/software-development/infrastructure/grafana/README.md b/software-development/infrastructure/grafana/README.md
index 541708d..7d40c3e 100644
--- a/software-development/infrastructure/grafana/README.md
+++ b/software-development/infrastructure/grafana/README.md
@@ -6,6 +6,9 @@
 Create/Fill in the following files in a `grafana` directory under this one using the templates.
 - `grafana.ini`
 - `prometheus.yml`
+- `.env` (copy from `.env.example`; holds the Prometheus hostname and basic auth hash for Traefik)
+
+Generate the basic auth value with `htpasswd -nbB admin 'your-password'` and paste it into `.env`, keeping the single quotes.
 
 ### Volumes
 Make sure that in additionto mounting the 2 files above to their respective containers, grafana container has the following mount:
diff --git a/software-development/infrastructure/grafana/docker-compose.yml b/software-development/infrastructure/grafana/docker-compose.yml
index 57cf169..81bcc08 100644
--- a/software-development/infrastructure/grafana/docker-compose.yml
+++ b/software-development/infrastructure/grafana/docker-compose.yml
@@ -1,7 +1,7 @@
 networks:
-  grafana:
+  metrics:
     driver: bridge
-    name: grafana
+    name: metrics
   traefik:
     external: true
   minecraft:
@@ -17,7 +17,7 @@ services:
     container_name: grafana
     restart: unless-stopped
     networks:
-      - grafana
+      - metrics
       - traefik
     volumes:
       - ./grafana.ini:/etc/grafana/grafana.ini
@@ -37,7 +37,7 @@ services:
     user: "1003:1005"
     restart: unless-stopped
     networks:
-      - grafana
+      - metrics
     pid: host
     command:
       - "--path.rootfs=/host"
@@ -53,8 +53,8 @@ services:
     container_name: prometheus
     restart: always
     networks:
-      - grafana
-      - minecraft
+      - metrics
+      - traefik
     volumes:
       - "./prometheus.yml:/etc/prometheus.yml"
       - prometheus_data:/prometheus
@@ -64,5 +64,12 @@ services:
       - "--web.console.libraries=/usr/share/prometheus/console_libraries"
       - "--web.console.templates=/usr/share/prometheus/consoles"
     labels:
-      - traefik.enable=false
+      - traefik.enable=true
+      - traefik.docker.network=traefik
+      - traefik.http.routers.prometheus.rule=Host(`${PROMETHEUS_HOST}`)
+      - traefik.http.routers.prometheus.tls=true
+      - traefik.http.routers.prometheus.tls.certresolver=lets-encrypt
+      - traefik.http.routers.prometheus.middlewares=prometheus-auth
+      - traefik.http.middlewares.prometheus-auth.basicauth.users=${PROMETHEUS_BASIC_AUTH}
+      - traefik.http.services.prometheus.loadbalancer.server.port=9090