{ config, ... }:
{

  services.nginx.virtualHosts.${config.services.grafana.settings.server.domain} = {
    extraConfig = ''
      allow ${config.tinc.private.subnet};
      deny all;
    '';
    locations."/" = {
      proxyPass = "http://localhost:${toString config.services.grafana.settings.server.http_port}";
      proxyWebsockets = true;
    };
  };

  healthchecks.http.grafana = {
    url = "grafana.${config.networking.hostName}.private";
  };

  services.grafana = {
    enable = true;
    settings = {
      server = {
        domain = "grafana.${config.networking.hostName}.private";
        http_port = 2342;
        http_addr = "127.0.0.1";
      };
      users.default_theme = "light";
      "auth.anonymous" = {
        enabled = true;
        org_name = "Chungus";
        org_role = "Viewer";
        hide_version = true;
      };
    };
  };

}