make grafana read-only

[michalkucharczyk]

Hardening grafana to be publicly exposed.

• added docker-compose.yml.remote which is currently used on jamtoaster-084 machine to run tart + db + grafana, so the file is tracked. File was added as is in ce0eeb0.
• claude proposed for hardening grafana can be viewed in this 04be52f
• added some claude-generated guideline for caddy configration,

[michalkucharczyk]

Quick summary of changed options (thank you claude):
Identity

• GF_SERVER_ROOT_URL — the public base URL Grafana uses when building absolute links (share URLs, redirects). Should now be https://monitoring.jamtoaster.network/.
• GF_SECURITY_ADMIN_USER — login name of the built-in admin.
• GF_SECURITY_ADMIN_PASSWORD — its password. The :? makes Compose refuse to start if unset. Both of these apply only when the admin user is first created.

Keep anonymous visitors read-only

• GF_USERS_ALLOW_SIGN_UP=false — no self-registration from the login page.
• GF_USERS_ALLOW_ORG_CREATE=false — users can't create new organizations.
• GF_USERS_VIEWERS_CAN_EDIT=false — the important one. If true, Viewers get Explore plus temporary panel edits. It's deprecated upstream, so pinning it guards against the default shifting.

Shrink the attack surface

• GF_EXPLORE_ENABLED=false — turns off the ad-hoc query UI server-wide.
• GF_SNAPSHOTS_EXTERNAL_ENABLED=false — stops "publish snapshot", which uploads dashboard data to a third-party public host.

Stop outbound calls

• GF_ANALYTICS_REPORTING_ENABLED=false — no usage telemetry to stats.grafana.org.
• GF_ANALYTICS_CHECK_FOR_UPDATES=false — no version/plugin update checks against grafana.com.
• GF_SECURITY_DISABLE_GRAVATAR=true — no avatar fetches from gravatar.com, which leak an email hash per user.

Browser security headers

• GF_SECURITY_STRICT_TRANSPORT_SECURITY=true — HSTS: tells browsers to only ever use HTTPS for the domain.
• GF_SECURITY_CONTENT_SECURITY_POLICY=true — CSP: restricts where scripts and resources may load from, mitigating XSS.

[s0me0ne-unkn0wn]

LGTM 👍