Statistics with Grafana/Prometheus with sensor based on Overleaf instance statistics- #178

tools/reference_stack_compose/grafana/.gitignore

@@ -0,0 +1 @@
+grafana-data

tools/reference_stack_compose/grafana/compose.yaml

@@ -0,0 +1,54 @@
+services:
+  grafana:
+    image: ${GRAFANA_IMAGE:-grafana/grafana-oss:11.6.0}
+    container_name: grafana
+    hostname: grafana
+    restart: unless-stopped
+    environment:
+      GF_SECURITY_ADMIN_USER: ${GRAFANA_ADMIN_USER}
+      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_ADMIN_PASSWORD}
+      # Admin ACCOUNT EMAIL — reuses the Overleaf admin mailbox (line ~61 of
+      # .env). NOTE: like the password, this env is honored ONLY when Grafana
+      # CREATES the admin user (fresh grafana-data); it never rewrites an
+      # existing user row. Default (Grafana shipped default) is
+      # admin@localhost — see MONITORING.md for the reset-mail gotcha.
+      GF_SECURITY_ADMIN_EMAIL: ${OVERLEAF_ADMIN_EMAIL:-overleaf@uni-bremen.de}
+      GF_ANALYTICS_REPORTING_ENABLED: "false"
+      GF_USERS_SIGNUP_ENABLED: "false"
+      # SMTP — reuses the stack's Overleaf relay settings (OVERLEAF_EMAIL_* in
+      # .env / env.sample): single source of truth, no Grafana-specific mail vars.
+      # GF_SMTP_FROM_NAME is the only grafana-local piece (display label).
+      GF_SMTP_ENABLED: "true"
+      GF_SMTP_HOST: ${OVERLEAF_EMAIL_SMTP_HOST}:${OVERLEAF_EMAIL_SMTP_PORT}
+      GF_SMTP_USER: ${OVERLEAF_EMAIL_SMTP_USER}
+      GF_SMTP_PASSWORD: ${OVERLEAF_EMAIL_PASSWORD}
+      GF_SMTP_FROM_ADDRESS: ${OVERLEAF_EMAIL_FROM_ADDRESS}
+      GF_SMTP_FROM_NAME: "Overleaf Monitoring"
+      GF_SMTP_SKIP_VERIFY: "false"
+      # AJ-3 style subpath serving (owner 2026-10-08, reference toolkit):
+      # URLs/route generation relative to the /grafana/ root
+      GF_SERVER_ROOT_URL: "${GRAFANA_ROOT_URL:-https://psintern.neuro.uni-bremen.de/grafana/}"
+      GF_SERVER_SERVE_FROM_SUB_PATH: "true"
+      # x-frame-options deny -> sameorigin (iframe embedding from the same
+      # origin stays possible; the fine-grained allowlist is the CSP below)
+      GF_SECURITY_ALLOW_EMBEDDING: "true"
+      GF_SECURITY_CSP_FRAME_ANCESTORS: "'self'"
+    volumes:
+      - ./provisioning:/etc/grafana/provisioning
+      - ./dashboards:/var/lib/grafana/dashboards
+      - ./grafana-data:/var/lib/grafana
+    expose:
+      - "3000"   # nginx is the sole facade (see nginx/nginx.conf location /grafana/)
+    healthcheck:
+      # grafana-oss ships wget (verified on the reference stack)
+      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:3000/api/health"]
+      interval: 15s
+      timeout: 5s
+      retries: 8
+      start_period: 30s
+    networks:
+      - overleaf-network
+
+networks:
+  overleaf-network:
+    external: true

tools/reference_stack_compose/grafana/provisioning/dashboards/ollitex.yml

@@ -0,0 +1,14 @@
+# file-based dashboard provider (shared/deterministic: no in-UI editing
+# required; dashboards ship with this compose tree) — reference:
+# build-images/grafana/provisioning/dashboards/ollitex.yml
+apiVersion: 1
+providers:
+  - name: overleaf
+    folder: Overleaf
+    type: file
+    disableDeletion: false
+    updateIntervalSeconds: 30
+    allowUiUpdates: true
+    options:
+      path: /var/lib/grafana/dashboards
+      foldersFromFilesStructure: false

tools/reference_stack_compose/grafana/provisioning/datasources/prometheus.yml

@@ -0,0 +1,12 @@
+# D22-style shared datasource provisioning (reference: build-images/grafana):
+# pinned uid so every dashboard JSON can hard-reference it; url points at
+# this stack's prometheus container name.
+apiVersion: 1
+datasources:
+  - name: Prometheus
+    uid: prometheus
+    type: prometheus
+    access: proxy
+    url: http://prometheus:9090
+    isDefault: true
+    editable: false