docker-compose.yaml aktualisiert

docker-compose.yaml

@@ -4,22 +4,41 @@ services:
   grafana:
     image: grafana/grafana:latest
     container_name: grafana
-    ports:
-      - "3000:3000"
+    # Port 3000 ist optional, da Traefik den Traffic intern leitet
+    #ports:
+#      - "3000:3000" 
     volumes:
       - /mnt/docker/grafana:/var/lib/grafana
     environment:
-      - GF_SERVER_ROOT_URL=http://<DEINE_GRAFANA_IP>:3000 
+      # Die externe URL über deinen Reverse Proxy
+      - GF_SERVER_ROOT_URL=https://grafana.ljh31.de 
+      
       # --- Keycloak / OAuth Konfiguration ---
       - GF_AUTH_GENERIC_OAUTH_ENABLED=true
       - GF_AUTH_GENERIC_OAUTH_NAME=Keycloak
       - GF_AUTH_GENERIC_OAUTH_ALLOW_SIGN_UP=true
       - GF_AUTH_GENERIC_OAUTH_CLIENT_ID=grafana
-      - GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET=DEIN_KOPIERTER_SECRET_AUS_KEYCLOAK
-      # Die URLs hängen von deiner Keycloak-Version ab (meistens /auth/ oder direkt /realms/)
-      - GF_AUTH_GENERIC_OAUTH_AUTH_URL=http://<KEYCLOAK_IP>:8080/realms/<DEIN_REALM>/protocol/openid-connect/auth
-      - GF_AUTH_GENERIC_OAUTH_TOKEN_URL=http://<KEYCLOAK_IP>:8080/realms/<DEIN_REALM>/protocol/openid-connect/token
-      - GF_AUTH_GENERIC_OAUTH_API_URL=http://<KEYCLOAK_IP>:8080/realms/<DEIN_REALM>/protocol/openid-connect/userinfo
-      # Mapping: Welches Keycloak-Feld wird als Name/Email in Grafana genutzt?
+      - GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET=3fS4ekbEC4RC0XndJQ1y6B8YJ4wvWFDc
+      # URLs zu deinem Keycloak-Server unter deiner Domain
+      - GF_AUTH_GENERIC_OAUTH_AUTH_URL=https://iam.ljh31.de/realms/<DEIN_REALM>/protocol/openid-connect/auth
+      - GF_AUTH_GENERIC_OAUTH_TOKEN_URL=https://iam.ljh31.de/realms/<DEIN_REALM>/protocol/openid-connect/token
+      - GF_AUTH_GENERIC_OAUTH_API_URL=https://iam.ljh31.de/realms/<DEIN_REALM>/protocol/openid-connect/userinfo
       - GF_AUTH_GENERIC_OAUTH_SCOPE=openid profile email
-    restart: unless-stopped
+    
+    networks:
+      - traefik_network
+
+    labels:
+      - "traefik.enable=true"
+      # Routing über deine Domain ljh31.de
+      - "traefik.http.routers.grafana.rule=Host(`grafana.ljh31.de`)"
+      - "traefik.http.routers.grafana.entrypoints=websecure"
+      - "traefik.http.routers.grafana.tls=true"
+      - "traefik.http.routers.grafana.tls.certresolver=myresolver" # Prüfe deinen Resolver-Namen!
+      - "traefik.http.services.grafana.loadbalancer.server.port=3000"
+
+    restart: unless-stopped
+
+networks:
+  traefik_network:
+    external: true