Grafana Multi-Location

# ─── GVC and locations ────────────────────────────────────────────────────────
# Lives under `global` so the postgres-multi-location subchart — and its own etcd
# subchart, two levels down — get the same GVC and locations automatically.
# Never maintain two location lists.

global:
  gvc:
    # This chart CREATES this GVC. It must NOT already exist: Helm adopts a GVC
    # that does, and `helm uninstall` then DELETES it and everything in it.
    name: grafana-multi-location-gvc
    # Minimum 2 locations. The database tier needs 3 for automatic failover and
    # 5 to survive losing two — see the survival table in the README.
    # `replicas` here is DATABASE members per location. Grafana's own count per
    # location is the top-level `replicas` below.
    locations:
      - name: aws-us-east-1
        replicas: 1
      - name: aws-eu-central-1
        replicas: 1
      - name: aws-us-west-2
        replicas: 1

# ─── Grafana UI tier ──────────────────────────────────────────────────────────
image: grafana/grafana:13.1.3

replicas: 1 # Grafana UI instances PER LOCATION; scale freely, alerting is a separate workload

resources:
  maxCpu: 1000m
  maxMemory: 1Gi
  minCpu: 500m
  minMemory: 512Mi

database:
  maxOpenConn: 10 # per instance; (replicas × locations + 1) × this must stay under 80

# ─── Alerting ─────────────────────────────────────────────────────────────────
# Alert rules are evaluated by a SEPARATE single-replica workload that runs only
# in this location and is never exposed publicly. Nothing dedupes two evaluators
# here: Grafana's memberlist alerting HA gossips over UDP, which is unavailable
# between workloads on this platform. (Grafana also supports a Redis-backed
# alerting HA path, which WOULD work here — it is deferred to a later version
# because it needs a stretched Redis tier, not because it is impossible.)
# A replica failure self-heals; losing this whole LOCATION stops evaluation until
# you point this elsewhere and upgrade. The UI tier is unaffected either way.
alerting:
  location: aws-us-east-1 # must be one of global.gvc.locations; "" = no evaluator workload, alerting disabled
  resources:
    maxCpu: 1000m
    maxMemory: 1Gi
    minCpu: 500m
    minMemory: 512Mi

# ─── Admin Bootstrap & Encryption (prerequisite secrets) ──────────────────────
# BOTH secrets must EXIST BEFORE INSTALL — opaque, encoding: plain (see README).
# The admin login is on the public internet when publicAccess.enabled is true,
# so its password never transits values or the Helm release.
admin:
  user: admin # initial admin login name (not sensitive)
  # The password applies only when the admin account is FIRST created; on later
  # boots Grafana ignores it (change it in the UI instead).
  applyPassword: true # set false after your first login to stop referencing the password secret
  passwordSecretName: my-grafana-ml-admin-password # opaque secret holding the first-boot admin password
  # DIFFERENT LIFECYCLE — permanent. Read on EVERY boot by EVERY instance to
  # decrypt datasource credentials stored in the shared database: never delete
  # it, never rotate it.
  secretKeySecretName: my-grafana-ml-secret-key # opaque secret holding the encryption key

# ─── Datasources as Code (optional) ───────────────────────────────────────────
# Grafana datasource provisioning entries, passed through verbatim. Every
# instance of both workloads applies the same file on boot.
datasources:
  definitions: []
  # - name: Prometheus
  #   type: prometheus
  #   access: proxy
  #   url: http://RELEASE-prometheus.GVC.cpln.local:9095
  #   isDefault: true
  # - name: AppDB
  #   type: postgres
  #   url: my-db-host:5432
  #   user: grafana_reader
  #   jsonData: { database: appdb, sslmode: disable }
  #   secureJsonData:
  #     password: $PG_PASSWORD # interpolated from credentialSecrets below

  # The credentials Grafana authenticates TO each datasource with. `definitions`
  # renders into a plaintext provisioning file, so put the password in a
  # pre-created dictionary secret and write $KEY above. Every $KEY needs an entry
  # here, and the secrets MUST EXIST BEFORE INSTALL.
  credentialSecrets: []
  # - name: my-grafana-ml-ds-credentials
  #   keys: [PG_PASSWORD]

# ─── SMTP for Alert Emails (optional) ─────────────────────────────────────────
# The alerting workload is what actually sends.
smtp:
  enabled: false
  host: smtp.example.com:587 # host:port
  user: "" # empty = unauthenticated SMTP. IF YOU SET THIS, the relay MUST offer
  # STARTTLS or TLS: Grafana refuses to send credentials over an unencrypted
  # connection ("failed to send email: unencrypted connection") and every
  # notification is then lost, with the only signal a log line in the
  # alerting workload. Hosted relays (SES, SendGrid, Mailgun, M365, Gmail)
  # are fine; a plain in-GVC relay is not — leave this empty for those.
  passwordSecretName: "" # opaque secret (encoding: plain) with the SMTP password; create BEFORE install
  fromAddress: grafana@example.com
  fromName: Grafana

# ─── Access ───────────────────────────────────────────────────────────────────
# Applies to the UI tier. The alerting workload is NEVER public; it honours
# internalAccess only, so you can reach it in-GVC to manage silences.
publicAccess:
  enabled: true # UI on the canonical *.cpln.app HTTPS endpoint

internalAccess:
  type: same-gvc # options: none, same-gvc, same-org, workload-list
  workloads: [] # used with workload-list
  # workloads:
  #   - //gvc/GVC_NAME/workload/WORKLOAD_NAME

# ─── App Database (subchart: postgres-multi-location) ─────────────────────────
# One Patroni cluster stretched across the same locations: a single primary,
# async replicas elsewhere, automatic promotion in a surviving location.
# Grafana has no read/write splitting, so EVERY query goes to the primary —
# put it where most of your users are.
postgresML:
  postgres:
    # REQUIRED PREREQUISITE SECRET — CREATE IT BEFORE YOU INSTALL.
    # A `dictionary` secret holding exactly `username`, `password` and
    # `database`. If it does not exist the deployment wedges waiting on it.
    credentialsSecretName: my-grafana-ml-db-credentials

  # Preferred location for the database primary. Keep it aligned with
  # alerting.location so the hot path has no cross-region hop.
  primaryLocation: aws-us-east-1

  resources:
    minCpu: 500m
    minMemory: 1Gi
    maxCpu: 1
    maxMemory: 2Gi

  volumeset:
    capacity: 10 # initial capacity in GiB per member (minimum is 10)

  proxy:
    minReplicas: 2 # HAProxy leader-routing tier, per location
    maxReplicas: 2

  backup: # optional database backups — see Storage setup in the README
    enabled: false
    mode: logical # logical or wal-g
    location: aws-us-east-1 # logical mode only: the ONE location the nightly job runs in
    resources:
      cpu: 100m
      # 512Mi, matching postgres-multi-location's own default. At 128Mi the GCP
      # path OOMs with NO log output: logical jobs merely report `failed` and the
      # wal-g sidecar loops on OOMKilled while WAL archives with no base backup.
      # Do not lower this without re-testing the GCS path.
      memory: 512Mi
    logical:
      image: ghcr.io/controlplane-com/backup-images/postgres-backup:17.1.0
      schedule: "0 2 * * *"
    walg:
      intervalSeconds: 21600
    provider: aws # options: aws, gcp, minio
    aws:
      bucket: my-grafana-ml-bucket
      region: us-east-1
      cloudAccountName: my-s3-cloud-account
      policyName: my-grafana-ml-backup-policy
      prefix: grafana/backups
    gcp:
      bucket: my-grafana-ml-bucket
      cloudAccountName: my-gcs-cloud-account
      prefix: grafana/backups
    minio:
      endpoint: http://my-minio-workload:9000
      bucket: my-grafana-ml-bucket
      credentialsSecretName: my-grafana-ml-minio-credentials
      prefix: grafana/backups

datasources:
  definitions:
    - name: AppDB
      type: postgres
      url: my-db-host:5432
      user: grafana_reader
      jsonData: { database: appdb, sslmode: disable }
      secureJsonData:
        password: $PG_PASSWORD
  credentialSecrets:
    - name: my-grafana-ml-ds-credentials
      keys: [PG_PASSWORD]