r/grafana

▲ 19 r/grafana

2026 state of the art self-hosted Grafana stack ?

Hi everyone !

Traveler from the past here, who needs a serious update.

I use the Grafana stack to monitor some Linux servers and VMs, but only really basic metrics and logs today.

Everything is based on node_exporter, prometheus (on each host), fluent-bit, Loki, and Grafana.

I finally have time to rebuild properly the monitoring/observability infrastructure, but I'm quite lost on how the components interact with each other.

Here is what I want to monitor :

  • Debian/Ubuntu/Proxmox/Windows Servers servers and VM (routing/firewalling/VPN is done on a Debian dedicated server with nftables)
  • Caddy web servers
  • MariaDB/PostGresql/Interbase/MongoDB databases
  • Rust/PHP/Java backends

Everything is self-hosted inside the company, and my current Grafana infrastructure is self-hosted too.

From my understanding, Alloy replaces node_exporter, Grafana, and Fluent-bit ?

What I have today :

[On each host] Node + Prometheus + Fluentbit -------> Centralized Grafana + Loki

What I'm understanding would be better :

[On each host] Alloy + Windows_exporter on Windows -------> Centralized+replicated storage (InfluxDB ? Mimir ?) -----> Centralized Grafana + Loki

Is it OK ? Am I missing something ?

reddit.com
u/barthvonries — 6 days ago

Looking for beta testers: I wrote a free app that pushes notifications to your phone and is compatible with Alertmanager

TL;DR

Handler is an alert notification app for phones: supporting Alertmanager and plain webhooks in, push notifications with ack, quiet hours, and per-priority sounds. Open beta means I'm looking for people who wants to test it, give their feedback and if they wany to stay I'm going to give lifetime free access according to their needs.

Hi everyone!

I want to show you an app I have been building for the last few months.

Features

  • Apple: Time Sensitive notifications. Apple Critical Alerts that bypass phone silent mode (currently wainting for entitle);
  • Apple: Enhanced Notifications (more detail on long press, Ack without opening the app);
  • Emergency/Critical alerts retry every minute until you Ack them;
  • Separate notification channels and sounds per priority;
  • Weekly quiet-hours schedule (notifications still arrive; sound stays off unless bypass rules say otherwise);
  • Notification list with swipe to Ack, filters, and search;
  • Active alerts list (no resolve yet), filters, search;
  • Alert detail with history of actions and identical alerts merging;
  • Global mute (snooze);
  • Per-priority sounds and volumes that can override the system default;
  • Channels to separate environments. Two built-in types today:
    • Universal: webhook with severity, labels, and related fields;
    • Alertmanager: groups, severity, labels, fingerprint, resolve;
    • More to come, if you need anything say so on Discord.

A few words about me

Day to day, for 8 years I have been the only DevOps in a small company, running 10+ dedicated servers, dozens of VMs, and a few hundred Kubernetes pods for client software.

For 4 years I have also been building a garage homelab. I love self-hosted culture.

I built Handler from mistakes, experience, and my own needs. Existing tools did not match what I wanted on a lock screen when something was on fire.

Architecture

The problem is not exotic, so the design stays simple.

  • Application logic is separate from notification sending. Workers use two queues (inbound and outbound) so accept and deliver do not share one bottleneck.
  • The stack is not locked to one cloud. Docker, Kubernetes, or on-prem are all in scope. For hosted beta I run a scalable AWS setup because I treat delivery as critical infrastructure: alerts are useless if they never reach engineers. A Community Edition for everyone is on the roadmap.
  • Backend is Go and stays light. On my machines, notification logic processing on that path is under about 40ms.
  • I started mobile with React Native, then rewrote to native Kotlin and Swift for reliability. That delayed the public release a bit.

Security

  • This app was built with good security practices in mind (full encryption in transit and at rest). The pipeline includes advanced tests and vulnerability monitors. For several months I tested the app myself and ran pen-tests.
  • This is not end-to-end encryption at the moment (that’s on the roadmap as alternative mode), because the app implements features (e.g. merging identical alerts into a shared history) so the processing is needed.

Mission

I wanted something that can cut through the noise of chat apps. Slack and Discord webhooks are fine for chat; they are a weak pager. I had that problem myself. Market options felt unsupported, buggy, or outdated, so I built Handler.

There is a Free tier on purpose. I want this usable for people who need it, including homelab. Over time I want a Community Edition people can run themselves, and a community that argues about how it should work.

Why not self-hosted? (for now)

That was the original plan.

Real push with the app closed needs FCM and APNs. Both expect private credentials in a backend that can send. I will not casually share those secrets with every random instance.

I do not have a clean answer yet. That bothers me, because I live in the self-hosted world every day.

Compromise for now: hosted Free tier, and a roadmap toward a Community Edition (open source, self-host ready). Longer term I am thinking about releasing mobile sources so someone can ship their own app pointed at their own backend (that still means Apple and Google developer accounts).

Discord is open if you want to discuss about a secure open design.

Early adopters

A few dozen people who create an account, join Discord, and actively test for about a month, then want to stay: free lifetime access to a plan that fits what you need is granted. Details and signup live in the Discord pin.

My daily driver is Apple, so iOS is usually ahead. Android feedback is especially welcome.

Roadmap

  • Stronger integration and E2E tests before more features
  • Polishing and customization
  • Team features (shared channels across people and devices)
  • Community Edition for self-host
  • Other operating modes (including an E2E encryption mode that does not store or process encoded notification content)

Where was artificial intelligence used in this project?

I think that should be public.

I used agents for research, specs, and documentation updates; some help on UI (not my strongest area); and "prove me wrong" style conversations.

Architecture, lo-fi mockups, backend, mobile apps, and Terraform are mine, from my know-how.

A request to leave something behind

I’d love any feedback. I have never published anything like this before. Tell me what you think, and especially what to improve.

If this would be useful but you are not using it, say what is wrong or what is missing.

u/s1ncerite — 8 days ago
▲ 6 r/grafana+2 crossposts

I built a dashboard that checks 172 provider status feeds before I debug my own stack

I'm Kerolos, founder of OutageDeck.

The question I wanted to answer quickly was: is my app broken, or is AWS, Cloudflare, GitHub, OpenAI, Stripe, or another dependency reporting an incident?

I built OutageDeck to read and normalize the official status sources for 172 cloud and SaaS providers. It shows provider and service-level state, current incidents, source freshness, incident history, and 90-day uptime in one place.

What works today:

- check a whole dependency stack without creating an account

- free email alerts for up to five providers

- Slack, Teams, Discord, and webhook destinations on paid plans

- a keyless JSON API, RSS feeds, badges, CLI tools, and an MCP endpoint

- custom Statuspage or Instatus feeds on paid plans

What it deliberately does not do is pretend an official status feed is independent truth. Providers can acknowledge incidents late, so I think a serious production setup should use two signals: the vendor feed plus synthetic probes from your own regions and accounts.

You can try the stack checker here:

https://outagedeck.com/stack?utm_source=reddit&utm_medium=community&utm_campaign=sideproject_provider_monitoring

I would value blunt feedback from people who handle incidents. What would this need to do before you would keep it open or route its alerts into your on-call workflow?

u/Nervous-Honey-2695 — 10 days ago

TimeOverlay panel. line graph replacement

Ever wish you could add notes over your line graph or highlight a section of time and show how long your range selections it? well now you can with my new plugin (free as always)

displays a line graph from a data source and allow the user to select a range that displays the time selected and allows for the addition of notes. all are transparent/configurable.

https://github.com/digitalrcs/DigitalRCS-TimeOverlay-Panel

reddit.com
u/digitalrcs — 7 days ago
▲ 15 r/grafana+1 crossposts

authir — open-source cross-tenant read ACLs for Grafana Mimir, enforced by PromQL rewriting

We run a large multi-tenant Mimir, and kept hitting the same wall: tenant isolation is all-or-nothing. Tenant B either gets your whole TSDB or nothing. The moment one team needs to see a subset of another team's metrics, your options are duplicating samples into a shared tenant (not viable at volume) or handing over full access and hoping.

So I built authir (Authenticator for Mimir) — an auth gateway that deploys next to an existing mimir-distributed install and adds per-reader grants on top of Mimir's tenancy. Just released 1.0.0 under Apache-2.0.

How it works: the owning tenant grants a slice — metric-name prefixes, required label matchers (e.g. only series labelled user="<reader>"), optionally a label allowlist for responses. authir rewrites every PromQL query before it reaches the query-frontend so it physically cannot select outside the grant, re-parses the rewritten query and compares ASTs as a self-check, and filters responses as a second backstop. Deny by default, no negative rules — blocklists over PromQL are unenforceable, the spec has an appendix on why.

The part I'm happiest with: it works with plain Grafana datasources, no plugin. The token identifies who you are; the Basic-auth username names whose data you're asking for. One tenant, one token, two datasources — "my data" and "what team B shared with me".

Ops details, since that's who this is for: Helm chart that derives everything from your mimir-distributed release name and touches nothing of Mimir's (rollback = uninstall), hot config reload that fails unchanged on invalid config, JSON audit log answering "why did tenant A see this number" (optionally with per-query latency and time range), Prometheus metrics including token-expiry-as-a-timestamp so rotation is an alert instead of a 3am outage. Single static binary in a FROM scratch image, ~6 MB.

Honest limitations: cross-tenant is read-only; queries fan out to one target tenant at a time; metric patterns are prefixes, not regex (deliberately); fuzzing and differential testing against the Go PromQL parser are on the roadmap, round-trip verification is what's in place today. If your idea of fun is smuggling a selector past a query rewriter, the bypass test suite would love your ideas — that's genuinely the review I want.

Repo (code, Helm chart, full design spec): https://github.com/thewillyhuman/authir

reddit.com
u/thewillyhuman — 13 days ago