fix(infra): clickjacking header + Grafana dashboard usability pass

supernaut kommenterad

2026-07-09 11:50:27 +00:00

Ägare

X-Frame-Options: DENY on the shared security headers. Units/thresholds/descriptions/legends/rows/refresh across all 5 dashboards (queries unchanged). Bumps lefthook + prettier-ignores the exported dashboard JSON. Already deployed to prod (caddy + monitoring); PR is the review/merge record.

supernaut lade till 4 incheckningar

2026-07-09 11:50:27 +00:00

build: bump lefthook & update prettier ignore 77762ebbef

fix(caddy): add X-Frame-Options DENY to shared security headers b315076580

gitborg-web declares `frame-ancestors 'none'` in its CSP, but Astro delivers
that CSP via a <meta> tag and browsers ignore frame-ancestors when it isn't a
real HTTP header — so clickjacking protection was effectively absent. Caddy
wasn't setting X-Frame-Options either. Add it to the shared security_headers
snippet so all four hosts (web portal, Forgejo, Kanidm) deny framing at the edge.

Needs an ansible apply of the caddy role to take effect.

fix(monitoring): units, thresholds & refresh on the overview dashboard 087fdfda80

The overview dashboard's top stats and two timeseries rendered as bare numbers
with no colour or units. Fill them in (values grounded in the actual config):

- Endpoints up: short + red/yellow/green thresholds, green at 6 (the number of
  blackbox probe targets)
- Min cert days: unit "d" + 14/30-day warn/ok thresholds (mirrors the endpoints
  dashboard)
- Backup age: unit "h" + 26h warn / 50h critical (the backup runs daily at 03:30,
  so >26h = a missed run, >50h = two)
- Disk used %: unit "percent", 0-100
- Memory available: unit "bytes"
- dashboard: graphTooltip shared-crosshair + refresh 1m (consistency with peers)

Descriptions added to the four affected stats. Needs an ansible apply of the
monitoring role to reach Grafana (provisioned, allowUiUpdates:false).

fix(monitoring): usability & consistency pass across all dashboards 51a2444594

Make every dashboard observability-ready and human-readable:
- units on every panel (bytes/Bps/s/percent/percentunit/reqps/d/h/m), min:0 on
  non-negative metrics
- thresholds + value mappings + background colour on health/up/state stats;
  warn/crit steps on age/expiry/usage stats
- a concise operator description on every panel (what it shows, what healthy
  looks like, related alert where relevant)
- timeseries: table legend with last/max, multi-series tooltip; stepAfter on
  up/down series
- log panels: newest-first, wrapped, log details enabled
- panels grouped under rows; stable panel ids; refresh 1m + shared crosshair
  across all five

Queries (expr/refId) are unchanged — presentation only. Needs an ansible apply
of the monitoring role to reach Grafana (provisioned, allowUiUpdates:false).

supernaut sammanfogade incheckning d96c74f0e8 till main

2026-07-09 11:52:03 +00:00

supernaut tog bort grenen fix/caddy-frame-options

2026-07-09 11:52:03 +00:00

supernaut refererade denna ändringsförfrågan från en incheckning

2026-07-09 11:52:04 +00:00

fix(infra): clickjacking header + Grafana dashboard usability pass (#29)

supernaut refererade denna ändringsförfrågan från en incheckning

2026-07-30 20:45:11 +00:00

fix(kanidm): remove the silently-discarded service-accounts block; correct the claim

supernaut refererade till denna ändringsförfrågan

2026-07-30 20:45:31 +00:00