# Burrow Grafana API Control Plane

This OpenTofu stack creates Grafana folders and dashboards through the official
`grafana/grafana` provider.

This is not a Grafana deployment mechanism. NixOS owns the Grafana service,
authentication, data sources, and boot-time provisioning.

## Run

Use the repository wrapper so the OpenTofu runtime comes from Nix:

```sh
Scripts/grafana-tofu.sh init -backend-config=backend.hcl
Scripts/grafana-tofu.sh plan -var-file=terraform.tfvars
```

For a local syntax check without remote state:

```sh
Scripts/grafana-tofu.sh init -backend=false
Scripts/grafana-tofu.sh validate
```

Manual Forgejo runs use `.forgejo/workflows/infra-opentofu.yml`. Plan, apply,
and import modes need `GRAFANA_AUTH` or a decrypted admin password so the
Grafana provider can reach the API.

## Adoption

The default stack manages the checked-in dashboards:

```text
services/grafana/dashboards/burrow-overview.json
services/grafana/dashboards/headscale.json
services/grafana/dashboards/observability.json
```

Import existing production objects before enabling apply:

```sh
Scripts/grafana-tofu.sh import 'grafana_folder.folders["burrow"]' 'burrow'
Scripts/grafana-tofu.sh import 'grafana_dashboard.dashboards["burrow-overview"]' 'burrow-overview'
Scripts/grafana-tofu.sh import 'grafana_dashboard.dashboards["burrow-headscale"]' 'burrow-headscale'
Scripts/grafana-tofu.sh import 'grafana_dashboard.dashboards["burrow-observability"]' 'burrow-observability'
```