Running Grafana behind a reverse proxy

TutorialsRun Grafana behind a reverse proxy

It should be straight forward to get Grafana up and running behind a reverse proxy. But here are some things that you might run into.

Links and redirects will not be rendered correctly unless you set the server.domain setting.

[server]
domain = foo.bar

To use sub path ex http://foo.bar/grafana make sure to include /grafana in the end of root_url. Otherwise Grafana will not behave correctly. See example below.

Examples

Here are some example configurations for running Grafana behind a reverse proxy.

Grafana configuration (ex http://foo.bar)

[server]
domain = foo.bar

Nginx configuration

Nginx is a high performance load balancer, web server and reverse proxy: https://www.nginx.com/

Nginx configuration with HTTP and Reverse Proxy enabled

server {
  listen 80;
  root /usr/share/nginx/html;
  index index.html index.htm;

  location / {
   proxy_pass http://localhost:3000/;
  }
}

Grafana configuration with hosting HTTPS in Nginx (ex https://foo.bar)

[server]
domain = foo.bar
root_url = https://foo.bar

Nginx configuration with HTTPS, Reverse Proxy, HTTP to HTTPS redirect and URL re-writes enabled

Instead of http://foo.bar:3000/?orgId=1, this configuration will redirect all HTTP requests to HTTPS and re-write the URL so that port 3000 isn’t visible and will result in https://foo.bar/?orgId=1

server {
  listen 80;
  server_name foo.bar;
  return 301 https://foo.bar$request_uri;
}

server {
  listen 443 ssl http2;
  server_name foo.bar;
  root /usr/share/nginx/html;
  index index.html index.htm;
  ssl_certificate /etc/nginx/certs/foo_bar.crt;
  ssl_certificate_key /etc/nginx/certs/foo_bar_decrypted.key;
  ssl_protocols TLSv1.2;
  ssl_ciphers HIGH:!aNULL:!MD5;

  location / {
   rewrite /(.*) /$1  break;
   proxy_pass http://localhost:3000/;
   proxy_redirect off;
   proxy_set_header Host $host;
  }
}

Examples with sub path (ex http://foo.bar/grafana)

Grafana configuration with sub path

[server]
domain = foo.bar
root_url = %(protocol)s://%(domain)s/grafana/

Nginx configuration with sub path

server {
  listen 80;
  root /usr/share/nginx/www;
  index index.html index.htm;

  location /grafana/ {
   proxy_pass http://localhost:3000/;
  }
}

HAProxy configuration with sub path

frontend http-in
  bind *:80
  use_backend grafana_backend if { path /grafana } or { path_beg /grafana/ }

backend grafana_backend
  # Requires haproxy >= 1.6
  http-request set-path %[path,regsub(^/grafana/?,/)]

  # Works for haproxy < 1.6
  # reqrep ^([^\ ]*\ /)grafana[/]?(.*) \1\2

  server grafana localhost:3000

IIS URL Rewrite Rule (Windows) with Subpath

IIS requires that the URL Rewrite module is installed.

Given:

  • subpath grafana
  • Grafana installed on http://localhost:3000
  • server config:

    [server]
    domain = localhost:8080
    root_url = %(protocol)s://%(domain)s/grafana/
    

    Create an Inbound Rule for the parent website (localhost:8080 in this example) in IIS Manager with the following settings:

    • pattern: grafana(/)?(.*)
    • check the Ignore case checkbox
    • rewrite URL set to http://localhost:3000/{R:2}
    • check the Append query string checkbox
    • check the Stop processing of subsequent rules checkbox

    This is the rewrite rule that is generated in the web.config:

    <rewrite>
      <rules>
          <rule name="Grafana" enabled="true" stopProcessing="true">
              <match url="grafana(/)?(.*)" />
              <action type="Rewrite" url="http://localhost:3000/{R:2}" logRewrittenUrl="false" />
          </rule>
      </rules>
    </rewrite>
    

See the tutorial on IIS URL Rewrites for more in-depth instructions.