Application architecture
A React and TypeScript frontend calls a loopback Node.js backend. The backend queries Grafana Cloud using server-side credentials. Public and owner APIs are distinct.
Query catalog
The initial investigation library imports 39 existing local-server and NutsNews dashboards, comprising 291 metric panels. Queries remain server-side and are selected by catalog identifier. Public metrics use a smaller explicit allowlist without internal labels.
Query bounds
Supported ranges are one hour, six hours, one day, and seven days. Charts are downsampled to a bounded number of points. Source calls have timeouts, concurrency limits, caching, and bounded series counts.
Deployment
The portal listens on loopback port 4310 under systemd. Cloudflare Tunnel publishes the browser hostname.
Source selection
Local-host dashboards are scoped to the adopted local instance. Usage and quota panels query the dedicated Grafana usage datasource rather than the application metrics datasource. This prevents misleading cross-host charts and empty quota panels.
Direct Google authentication
The web OAuth client allows https://observe.ramideltoro.com/auth/google/callback. GitHub supplies AUTH_GOOGLE_ID, AUTH_GOOGLE_SECRET, SESSION_SECRET and OWNER_EMAILS in the private runtime environment. The authorization-code flow uses state, PKCE and nonce. Only verified allowlisted Google emails receive a 12-hour Secure, HttpOnly, SameSite=Lax cookie. Expired sessions restart sign-in and preserve the diagnostics tab. Use Sign out to clear the browser session.