Grafana turns the numbers Prometheus collects into graphs you can read at a glance. On LibrePortal it comes already connected to Prometheus, and apps that have a ready-made dashboard bring it with them.
On this page
At a glance#
- What it is
- Metrics Visualizer Monitoring
- Where it opens
- Web Interface
On its own port at
http://your-server:port, orgrafana.your-domainonce you have a domain - Updates
- Automatic A backup is taken first, and it rolls back if the update fails
- Backups
- Included Part of the daily backup when that's switched on
- Copies
- As many as you like Run several copies, each with its own data
- Needs
- prometheus
What it's good for#
Your server and its apps produce a steady stream of numbers: memory, CPU, how many DNS queries were blocked, how many people signed in. Prometheus collects them; Grafana is the window you look through. It draws them as dashboards of graphs and gauges, lets you look back over hours or weeks, and can warn you when something crosses a line you set.
It suits you if you like to know why the server felt slow on Tuesday, or want to watch a particular app closely. If all you want is to know whether each app is up or down, Uptime Kuma is simpler and does that on its own.
Before you install#
Grafana needs Prometheus, so LibrePortal won't install it until Prometheus is there. Install Prometheus first.
Signing in#
The account is called admin, and its password was generated for it. Grafana normally starts with admin/admin and a "change your password" prompt you can skip, so LibrePortal hands it the account and a generated password the very first time it starts instead. The password is in the Login Details shown when the install finishes; press Welcome on the app's page to see it again.
Grafana only reads that password when it first creates the account. If you change the password inside Grafana later, LibrePortal can't know, and the one on the Welcome dialog will be out of date. Keep a note of it yourself.
A Grafana installed with 0.4.6 or earlier
Older installs were left with admin/admin. After you update to 0.4.7, the first time Grafana starts LibrePortal checks whether admin/admin still signs in, and only if it does, sets the generated password shown in the Login Details. If you'd already changed the password yourself, it's left alone.
Getting dashboards#
Grafana on its own shows nothing. LibrePortal fills it in two ways.
First, it adds Prometheus as Grafana's default data source, so anything Prometheus collects is ready to graph.
Second, some apps come with a dashboard made for them. To turn one on, open that app's Config tab and switch on Export metrics to Grafana. That tells Prometheus to start collecting from it and puts its dashboard into Grafana, in a folder called LibrePortal. The switch is greyed out until both Prometheus and Grafana are installed. Apps with a dashboard include AdGuard Home, Pi-hole, Unbound, Traefik, CrowdSec, Authelia, Nextcloud, Vaultwarden, Gitea, Headscale, Gluetun, WireGuard and Ollama. Grafana's own Works with list says how many are showing.
Graphs start from the moment an app's metrics are switched on. Prometheus can't go back and collect what happened before.
Changing a LibrePortal dashboard
LibrePortal puts its dashboards back every time an app's metrics are switched on or off, and Grafana restarts to pick them up. To make your own version of one, save it as a copy under a new name, outside the LibrePortal folder, so your changes stay put.
You can also build your own dashboards from anything Prometheus collects, or import one of the thousands people share on Grafana's website. That's all standard Grafana.
Alerts#
Grafana can watch a graph and tell you when it crosses a line, say when memory stays above 90% for ten minutes. Set up where alerts go under Alerting in Grafana first (a webhook to ntfy is an easy one if you run it), then add rules. LibrePortal doesn't set up any alerts for you.
Who can reach it#
Grafana's port starts public. With a generated password that's safe enough, but a monitoring screen is rarely something anyone but you needs, so consider making it private and using the LibrePortal VPN when you're away.
Without a domain, Grafana is at your server's address and port, like http://192.168.1.50:<port>. With a domain and Traefik, it's at grafana.<your domain> over HTTPS. From 0.4.7, Grafana is told the address it's really reached on, so links in alerts and shared dashboards point to the right place, and it runs on your server's timezone.
Installed with 0.4.6 or earlier?
In older installs none of Grafana's own settings took effect, so its links point at http://localhost:3000/ and it runs on UTC. The fix is in the app's compose file, which an update doesn't rewrite. To pick it up, press Update Configuration on Grafana's Config tab; you don't need to change anything. That writes the compose afresh and keeps your dashboards and login.
Good to know#
- Updates are automatic. Grafana follows its latest release, and LibrePortal takes a recovery snapshot before each one, so a bad update can be rolled back.
- It's the Enterprise edition. That's Grafana's own recommended download. Without a licence it's the same as the open-source Grafana, and nothing is paid for.
- It comes with one plugin, the clock panel, for putting the time on a dashboard.
- Its storage location is fixed. Other apps put their dashboards into Grafana's folder, so it can't be moved to another disk.
- Backups: Grafana is part of the daily backup. To check: Not yet shown to work. Grafana's compose has no backup labels, so it is backed up stopped, as the install user, but grafana.db (your dashboards, users and settings) belongs to Grafana's own user; docs/design/update-backup-audit.md expects that file to make the whole backup fail (restic exit 3) rather than be captured. Test a Grafana backup and restore, then say what's covered and what to do.
- One dashboard feed. You can run several copies of Grafana, but LibrePortal's app dashboards go to the first one.
Addresses and ports#
Grafana has one port. LibrePortal picks a free port number for each when you install, so yours will differ from anyone else's. The Config tab's Network section shows them, and the app's Open button uses the right one. "Anyone" means it's reachable from wherever your server is reachable; you can make it private later.
| What it is | Who can reach it | With a domain |
|---|---|---|
| Web Interface | Anyone | grafana.your-domain |
Settings#
In its config file#
Grafana's own settings aren't on the Config tab yet. They live in the app's config file, described here so you know they exist. How to change them.
| Setting | What it does | Starts as |
|---|---|---|
NameCFG_GRAFANA_DISPLAY_NAME |
What this app is called on your dashboards. Leave empty to use its usual name | Empty |
Show on the LibrePortal DashboardCFG_GRAFANA_SHOW_ON_DASHBOARD |
Whether this app gets a shortcut on the front page of the LibrePortal WebUI, separate from any Dashy dashboard Choices: true, false |
false |
Usage reportingCFG_GRAFANA_TELEMETRY |
Whether Grafana may send anonymous usage statistics to grafana.com. Choices: true, false |
false |
Update checksCFG_GRAFANA_UPDATE_CHECK |
Whether Grafana may ask grafana.com for newer versions of itself and its plugins. Choices: true, false |
false |
News feedCFG_GRAFANA_NEWS_FEED |
Whether Grafana may load its news panel from grafana.com. Choices: true, false |
false |
Feedback linksCFG_GRAFANA_FEEDBACK_LINKS |
Whether Grafana shows its feedback and community links in the menu. Choices: true, false |
false |
Gravatar picturesCFG_GRAFANA_GRAVATAR |
Whether Grafana may fetch user pictures from Gravatar, which tells it people's email addresses. Choices: true, false |
false |
Detailed logsCFG_GRAFANA_VERBOSE_LOGS |
Whether Grafana writes its normal, chattier logs, including who connected, instead of only warnings and errors. Choices: true, false |
false |
Debug logging for 24 hoursCFG_GRAFANA_DEBUG_LOGS |
Turn on to see everything Grafana is doing while you look for a problem; it turns itself off after 24 hours. Choices: true, false |
false |
Works with#
These are the other apps Grafana knows how to work with. Once it's installed, its page shows the same list with whether each one is connected. How this works.
- Email: Sends its alerts and invitations through your mail server, from an account of its own. LibrePortal sets this up by itself when both are installed.
- App dashboards: Shows dashboards for the apps that have one. LibrePortal sets this up by itself when both are installed.
Every app you install
- Prometheus data source: Reads what Prometheus collects. LibrePortal sets this up by itself when both are installed.
- Prometheus: Collects metrics from the apps that can export them. works with every app
- Uptime Kuma: Watches your apps and shows when one goes down. works with every app
Privacy and security#
All clear Grafana shows your server's numbers. LibrePortal stops it reporting usage to grafana.com, checking for updates, loading its news feed and fetching Gravatar pictures.
What leaves this server#
- Map panels load tiles from CARTO, only if you add one
What LibrePortal turns off#
- Detailed logs and per-request access logging (switchable in Config)
- Anonymous usage reports to grafana.com (switchable in Config)
- Version and plugin update checks (switchable in Config)
- News feed from grafana.com (switchable in Config)
- Gravatar profile pictures (switchable in Config)
Licence: AGPL-3.0 (OSS); the -enterprise image adds proprietary code that stays inactive without a licence key. Audited: 21 October 2026. See the privacy of every app and the Promise.
Sources#
Under the hood#
- It runs this image:
grafana/grafana-enterprise:13.2.4@sha256:18b723df0d73f5861f8079afd4b31d22c68b9d1babc7b55c2dace57bde49b6ba. - It can sit behind Authelia's sign-in once Authelia is installed.
- Its own project and documentation: github.com/grafana/grafana
Ports, settings, tools and connections on this page are read from LibrePortal v0.10.97's app catalogue each time the guide is built.
