LGTM Stack

`hub`: this stack serves every organization of the hub it is installed beside; sign-in uses the environment's `zitadel` installation and `hubOrgs`; Grafana organizations and datasources are provisioned by that hub's orchestrator. `dedicated`: this stack serves the single organization that owns the installation; the managing hub issues the OAuth client and gateway identity and Grafana is provisioned statically.

Root hostname for the stack, without a scheme. Loki, Mimir and Grafana are exposed as `loki.`, `mimir.` and `grafana.` under it.

Base URL of the Ryvn hub API (for example `https://api.<hub-domain>`) the auth-proxy authorizes tenant requests against. Required in `hub` mode, where it is the API of the hub this stack is installed beside. In `dedicated` mode leave it blank to use the managing hub's API; set it only to authorize against a different hub API URL.

Name remote collectors use to address this stack, in either provisioning mode. Leave blank to use `<installation name>-<hosting environment name>`. Must be a valid label value: at most 63 characters of letters, digits, `-`, `_` or `.`, starting and ending with a letter or digit. A generated default that is too long is rejected rather than shortened; set the name explicitly in that case.

Applies to `dedicated` mode only; in `hub` mode Grafana is always published at `grafana.<domain>` because the `zitadel` installation registers that callback. Public publishes Grafana at `grafana.<domain>` on the ingress class below. Private publishes it on the `internal-nginx` ingress class under the environment's internal domain, reachable only from inside the network; hub sign-in stays enabled either way.

Maps hub (Zitadel) organization ids to Grafana organization ids. Members of a hub organization sign in to Grafana as Editors of the mapped Grafana organization. The Grafana organizations and their Loki/Mimir datasources are created by the hub's orchestrator; look up the ids under Server admin → Organizations. Example: `"298765826054437928": "2"`.

Create Ingress resources for Loki, Mimir and Grafana.

Publish Loki, Mimir and Grafana through Ryvn Routes (ryvn-routes) on the managed gateway.

IngressClass that publishes the Loki, Mimir and Grafana hostnames. The default matches the internet-facing ingress-nginx installed by the platform blueprints.

cert-manager ClusterIssuer that signs the TLS certificates for the public hostnames. The default matches the issuer installed by the platform blueprints.

Sizing profile for the Loki, Mimir and Grafana services. Small suits a hub with a handful of workload environments; medium is sized for production hubs.

Value of the `ryvn.app/node-group-name` label of the node pool that runs Loki and Mimir (for example `observability`). Leave blank to schedule on any node.

Storage class for the Loki and Mimir persistent volumes (ingester write-ahead logs, compactor and store-gateway scratch, alertmanager state; durable data lives in the buckets). Grafana recommends SSD-backed disks for ingesters. Empty uses the cluster default. Changing it later recreates those volumes.

Days the Loki compactor keeps log chunks before deleting them.

Days the Mimir compactor keeps metric blocks before deleting them.

Point Grafana at a Postgres database you manage instead of provisioning a dedicated one with this installation.

Postgres connection URL (`postgres://user:password@host:5432/grafana?sslmode=require`) for Grafana when using an external database.

Generated once for the built-in Grafana `admin` user and retained across upgrades.

Used in `dedicated` mode only. Generated once; Grafana's Loki and Mimir datasources present it to the auth-proxy as the Basic auth password of user `grafana`.

Applies to `dedicated` mode only. Name shown for Grafana organization 1, applied after every install and upgrade. Leave blank to use the id of the organization that owns this installation.

Protects the buckets and the Grafana database from accidental destruction. Disable before tearing down the stack.

Name remote collectors use to address this stack.

Base URL remote collectors push logs to.

Base URL remote collectors push metrics to.

Public Loki endpoint behind the auth-proxy. Set it as the platform blueprint's `lokiUrl` input in each workload environment whose collector should ship here.

Public Mimir endpoint behind the auth-proxy. Set it as the platform blueprint's `mimirUrl` input in each workload environment whose collector should ship here.

Grafana URL on the public domain, or on the environment's internal domain when a dedicated stack's Grafana exposure is private. In hub mode it must match the `grafanaUrl` input of the zitadel installation so the OAuth redirect is accepted.

Object storage bucket holding Loki chunks and ruler state.

Object storage bucket holding Mimir blocks, ruler and alertmanager state.

Password for the built-in Grafana `admin` user.