Change metadata of doc topics (#27943)
* Changes. to metadata in Manage users * changes to install section * Added titile * More changes. * Updated administration folder metadata, moved 2 files from installation folder. * Added links to Administration landing page, other metadata changes worked out. * Updated alerting section metadata. * Updated metadata of Auth section. Broke index and created separate Grafana Authentication section. * Added correct weight. * Updated metadata for the Best practices section. * Updated metadata in templates, broke Overview topic. * Updated subment Variable types metadata * Fixed yaml file and H1 description of Variables syntax topic. * Couple more metadata changes. * Added aliases files, as suggested by Diana.
This commit is contained in:
achatterjee-grafana
@@ -7,10 +7,12 @@ aliases = ["/docs/grafana/latest/installation/installation/", "/docs/grafana/v2.
|
||||
[menu.docs]
|
||||
name = "Installation"
|
||||
identifier = "installation"
|
||||
weight = 200
|
||||
weight = 30
|
||||
+++
|
||||
|
||||
## Install Grafana
|
||||
# Install Grafana
|
||||
|
||||
This section discusses the hardware and software requirements as well as the process of installing Grafana on different operating systems. This section has the following topics:
|
||||
|
||||
- [Requirements]({{< relref "requirements" >}})
|
||||
- [Install on Debian or Ubuntu]({{< relref "debian" >}})
|
||||
@@ -18,4 +20,3 @@ weight = 200
|
||||
- [Install on macOS]({{< relref "mac" >}})
|
||||
- [Install on Windows]({{< relref "windows" >}})
|
||||
- [Run Docker image]({{< relref "docker" >}})
|
||||
- [Nightly Builds](https://grafana.com/grafana/download)
|
||||
|
||||
@@ -1,100 +0,0 @@
|
||||
+++
|
||||
title = "Configure Grafana Docker image"
|
||||
description = "Guide for configuring the Grafana Docker image"
|
||||
keywords = ["grafana", "configuration", "documentation", "docker"]
|
||||
type = "docs"
|
||||
[menu.docs]
|
||||
name = "Configure Grafana Docker image"
|
||||
identifier = "docker"
|
||||
parent = "administration"
|
||||
weight = 650
|
||||
+++
|
||||
|
||||
# Configure a Grafana Docker image
|
||||
|
||||
If you are running Grafana in a Docker image, then you configure Grafana using [environment variables]({{< relref "../administration/configuration.md#configure-with-environment-variables" >}}) rather than directly editing the configuration file. If you want to save your data, then you also need to designate persistent storage or bind mounts for the Grafana container.
|
||||
|
||||
## Save your Grafana data
|
||||
|
||||
If you do not designate a location for information storage, then all your Grafana data disappears as soon as you stop your image. To save your data, you need to set up persistent storage or bind mounts for your container.
|
||||
|
||||
### Run Grafana container with persistent storage (recommended)
|
||||
|
||||
```bash
|
||||
# create a persistent volume for your data in /var/lib/grafana (database and plugins)
|
||||
docker volume create grafana-storage
|
||||
|
||||
# start grafana
|
||||
docker run -d -p 3000:3000 --name=grafana -v grafana-storage:/var/lib/grafana grafana/grafana
|
||||
```
|
||||
|
||||
### Run Grafana container using bind mounts
|
||||
|
||||
You may want to run Grafana in Docker but use folders on your host for the database or configuration. When doing so, it becomes important to start the container with a user that is able to access and write to the folder you map into the container.
|
||||
|
||||
```bash
|
||||
mkdir data # creates a folder for your data
|
||||
ID=$(id -u) # saves your user id in the ID variable
|
||||
|
||||
# starts grafana with your user id and using the data folder
|
||||
docker run -d --user $ID --volume "$PWD/data:/var/lib/grafana" -p 3000:3000 grafana/grafana:5.1.0
|
||||
```
|
||||
|
||||
## Default paths
|
||||
|
||||
The following settings are hard-coded when launching the Grafana Docker container and can only be overridden using environment variables, not in `conf/grafana.ini`.
|
||||
|
||||
Setting | Default value
|
||||
----------------------|---------------------------
|
||||
GF_PATHS_CONFIG | /etc/grafana/grafana.ini
|
||||
GF_PATHS_DATA | /var/lib/grafana
|
||||
GF_PATHS_HOME | /usr/share/grafana
|
||||
GF_PATHS_LOGS | /var/log/grafana
|
||||
GF_PATHS_PLUGINS | /var/lib/grafana/plugins
|
||||
GF_PATHS_PROVISIONING | /etc/grafana/provisioning
|
||||
|
||||
## Logging
|
||||
|
||||
Logs in the Docker container go to standard out by default, as is common in the Docker world. Change this by setting a different [log mode]({{< relref "../administration/configuration.md#mode" >}}).
|
||||
|
||||
Example:
|
||||
|
||||
```bash
|
||||
# Run Grafana while logging to both standard out and /var/log/grafana/grafana.log
|
||||
docker run -p 3000:3000 -e "GF_LOG_MODE=console file" grafana/grafana
|
||||
```
|
||||
|
||||
## Configure Grafana with Docker Secrets
|
||||
|
||||
> Only available in Grafana v5.2 and later.
|
||||
|
||||
It's possible to supply Grafana with configuration through files. This works well with [Docker Secrets](https://docs.docker.com/engine/swarm/secrets/) as the secrets by default gets mapped into `/run/secrets/<name of secret>` of the container.
|
||||
|
||||
You can do this with any of the configuration options in conf/grafana.ini by setting `GF_<SectionName>_<KeyName>__FILE` to the path of the file holding the secret.
|
||||
|
||||
For example, you could set the admin password this way:
|
||||
|
||||
- Admin password secret: `/run/secrets/admin_password`
|
||||
- Environment variable: `GF_SECURITY_ADMIN_PASSWORD__FILE=/run/secrets/admin_password`
|
||||
|
||||
## Configure AWS credentials for CloudWatch Support
|
||||
|
||||
```bash
|
||||
docker run -d \
|
||||
-p 3000:3000 \
|
||||
--name=grafana \
|
||||
-e "GF_AWS_PROFILES=default" \
|
||||
-e "GF_AWS_default_ACCESS_KEY_ID=YOUR_ACCESS_KEY" \
|
||||
-e "GF_AWS_default_SECRET_ACCESS_KEY=YOUR_SECRET_KEY" \
|
||||
-e "GF_AWS_default_REGION=us-east-1" \
|
||||
grafana/grafana
|
||||
```
|
||||
|
||||
You may also specify multiple profiles to `GF_AWS_PROFILES` (e.g.
|
||||
`GF_AWS_PROFILES=default another`).
|
||||
|
||||
Supported variables:
|
||||
|
||||
- `GF_AWS_${profile}_ACCESS_KEY_ID`: AWS access key ID (required).
|
||||
- `GF_AWS_${profile}_SECRET_ACCESS_KEY`: AWS secret access key (required).
|
||||
- `GF_AWS_${profile}_REGION`: AWS region (optional).
|
||||
@@ -221,7 +221,7 @@ Refer to the [Getting Started]({{< relref "../getting-started/getting-started/"
|
||||
|
||||
## Configure Docker image
|
||||
|
||||
Refer to [Configure a Grafana Docker image]({{< relref "configure-docker.md" >}}) page for details on options for customizing your environment, logging, database, and so on.
|
||||
Refer to [Configure a Grafana Docker image]({{< relref "../administration/configure-docker.md" >}}) page for details on options for customizing your environment, logging, database, and so on.
|
||||
|
||||
## Configure Grafana
|
||||
|
||||
|
||||
@@ -1,42 +0,0 @@
|
||||
+++
|
||||
title = "Security"
|
||||
description = "Security Docs"
|
||||
keywords = ["grafana", "security", "documentation"]
|
||||
type = "docs"
|
||||
[menu.docs]
|
||||
name = "Security"
|
||||
identifier = "security"
|
||||
parent = "admin"
|
||||
weight = 2
|
||||
+++
|
||||
|
||||
# Security
|
||||
|
||||
If you run non-Grafana web services on your Grafana server or within its local network, then they might be vulnerable to exploitation through the Grafana data source proxy or other methods.
|
||||
|
||||
To prevent this type of exploitation from happening, we recommend that you apply one or more of the precautions listed below.
|
||||
|
||||
## Limit IP addresses/hostnames for data source URL
|
||||
|
||||
You can configure Grafana to only allow certain IP addresses or hostnames to be used as data source URLs and proxied through the Grafana data source proxy. Refer to [data_source_proxy_whitelist]({{< relref "../administration/configuration/#data-source-proxy-whitelist" >}}) for usage instructions.
|
||||
|
||||
## Firewall rules
|
||||
|
||||
Configure a firewall to restrict Grafana from making network requests to sensitive internal web services.
|
||||
|
||||
There are many firewall tools available, refer to the documentation for your specific security tool. For example, Linux users can use [iptables](https://en.wikipedia.org/wiki/Iptables).
|
||||
|
||||
## Proxy server
|
||||
|
||||
Require all network requests being made by Grafana to go through a proxy server.
|
||||
|
||||
## Limit Viewer query permissions
|
||||
|
||||
Users with the Viewer role can enter *any possible query* in *any* of the data sources available in the **organization**, not just the queries that are defined on the dashboards for which the user has Viewer permissions.
|
||||
|
||||
**For example:** In a Grafana instance with one data source, one dashboard, and one panel that has one query defined, you might assume that a Viewer can only see the result of the query defined in that panel. Actually, the Viewer has access to send any query to the data source. With a command-line tool like curl (there are lots of tools for this), the Viewer can make their own query to the data source and potentially access sensitive data.
|
||||
|
||||
To address this vulnerability, you can restrict data source query access in the following ways:
|
||||
|
||||
- Create multiple data sources with some restrictions added in data source config that restrict access (like database name or credentials). Then use the [Data Source Permissions]({{< relref "../permissions/datasource_permissions.md" >}}) Enterprise feature to restrict user access to the data source in Grafana.
|
||||
- Create a separate Grafana organization, and in that organization, create a separate data source. Make sure the data source has some option/user/credentials setting that limits access to a subset of the data. Not all data sources have an option to limit access.
|
||||
@@ -7,7 +7,7 @@ type = "docs"
|
||||
name = "Upgrade Grafana"
|
||||
identifier = "upgrading"
|
||||
parent = "installation"
|
||||
weight = 800
|
||||
weight = 700
|
||||
+++
|
||||
|
||||
# Upgrade Grafana
|
||||
|
||||
Reference in New Issue
Block a user