# grafana — dashboards / SCADA UI
# Networks: app (for nginx reverse-proxy) + data (for influxdb queries)

services:
  grafana:
    image: grafana/grafana-oss:11.3.0
    restart: unless-stopped
    networks: [app, data]
    volumes:
      - grafana-data:/var/lib/grafana
      - ./config/provisioning:/etc/grafana/provisioning:ro
    environment:
      GF_SECURITY_ADMIN_USER: ${GRAFANA_ADMIN_USER}
      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_ADMIN_PASSWORD}
      GF_SERVER_ROOT_URL: ${GRAFANA_ROOT_URL:-}
    # TODO: Keycloak OIDC auth, datasource provisioning, plugin pins

networks:
  app:
  data:

volumes:
  grafana-data: