Grafana behind Traefik reverse proxy with TLS

Grafana Configuration
1

Hello all,
I have a problem getting Grafana to work behind Traefik with TLS being handled by Traefik. Grafana is configured to run on the default port 3000. Traefik is configured to redirect all connections on port 80 to 443. Connections to the grafana domain grafana.domain.lo get routed to port 3000 internally. Grafana docker-compose is configured as follows

  grafana:
    image: grafana/grafana:latest
    restart: unless-stopped
    container_name: grafana
    volumes:
      - grafana_data:/var/lib/grafana
    environment:
      - "GF_INSTALL_PLUGINS=grafana-clock-panel,grafana-simple-json-datasource,grafana-piechart-panel"
      - "GF_SERVER_ROOT_URL=https://grafana.${BASE_DOMAIN}:443"
      - "GF_SERVER_DOMAIN=grafana.${BASE_DOMAIN}"
      - ā€œGF_SECURITY_ADMIN_PASSWORD=adminā€
    networks:
      - backend-network
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=backend-network"
      - "traefik.http.routers.grafana.entrypoints=ssl"
      - "traefik.http.routers.grafana.tls=true"
      - "traefik.http.routers.grafana.rule=Host(`grafana.${BASE_DOMAIN}`)"
      - "traefik.http.routers.grafana.service=grafana-service"
      - "traefik.http.services.grafana-service.loadbalancer.server.port=3000"

Grafana works as far as getting to the login page. From there I canā€™t change the password. I get

msg="Request Completed" logger=context userId=1 orgId=1 uname=admin method=POST path=/api/user/password/reset status=400 remote_addr=192.168.0.112 time_ms=13 size=52 referer=https://grafana.domain.lo/login

What am I doing wrong? Why does Grafana think that changing the password was a bad request?

p.s. It also does not save any changes I make to the default dashboard.

1 Like
2

It took me ages to get Grafana working with Traefik (2.2.5) properly and there are still some issues. I think your problem could be this:

  • ā€œGF_SERVER_ROOT_URL=https://grafana.${BASE_DOMAIN}:443ā€

I donā€™t think it should have the 443 as part of the URL. My config (in grafana.ini file) is:

[server]
domain = ā€˜domain goes hereā€™
protocol = http
root_url = %(protocol)s://%(domain)s:/grafana/
serve_from_sub_path = true

The key is the sub path setting which tells Grafana to serve files (and save settings) behind the proxy.

I hope this may help, only just noticed your posting now.

3

My problem is the same as yours, have you solved it