Stop serving Grafana as anonymous admin on the public hostname

infra/helm/medical-chatbot/templates/ingress.yaml

@@ -1,4 +1,16 @@
 {{- if .Values.ingress.enabled }}
+{{- /*
+  The cutover serves the new production hostname alongside the rehearsal one
+  from the same release, so `host` alone is not enough. `extraHosts` adds more
+  names against the identical path set; with none set the render is unchanged.
+
+  Note that cert-manager's ingress-shim derives Certificates from the `tls`
+  block, not from these rules. A host listed here but absent from `tls` is
+  routed over HTTP without triggering an ACME order — which is what lets a new
+  hostname be wired up *before* its DNS moves, without burning Let's Encrypt
+  failed-validation attempts on a challenge that cannot succeed yet.
+*/}}
+{{- $hosts := concat (list .Values.ingress.host) (default (list) .Values.ingress.extraHosts) }}
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
@@ -14,27 +26,29 @@ spec:
     {{- toYaml . | nindent 4 }}
   {{- end }}
   rules:
-    - host: {{ .Values.ingress.host | quote }}
+    {{- range $host := $hosts }}
+    - host: {{ $host | quote }}
       http:
         paths:
           - path: /v1/rag
             pathType: Prefix
             backend:
               service:
-                name: {{ include "medical-chatbot.fullname" . }}-ai-service
+                name: {{ include "medical-chatbot.fullname" $ }}-ai-service
                 port: { name: http }
-          {{- if .Values.observability.enabled }}
+          {{- if $.Values.observability.enabled }}
           - path: /grafana
             pathType: Prefix
             backend:
               service:
-                name: {{ include "medical-chatbot.fullname" . }}-grafana
+                name: {{ include "medical-chatbot.fullname" $ }}-grafana
                 port: { name: http }
           {{- end }}
           - path: /
             pathType: Prefix
             backend:
               service:
-                name: {{ include "medical-chatbot.fullname" . }}-web
+                name: {{ include "medical-chatbot.fullname" $ }}-web
                 port: { name: http }
+    {{- end }}
 {{- end }}

infra/helm/medical-chatbot/templates/observability-workloads.yaml

@@ -236,13 +236,21 @@ spec:
                 secretKeyRef:
                   name: {{ include "medical-chatbot.secretName" . }}
                   key: grafana-admin-password
+            # Anonymous access is a viewing convenience, never an admin
+            # bypass: this Grafana is reachable from the public internet
+            # through the same ingress as the app, so an anonymous Admin role
+            # hands strangers the datasource and dashboard APIs.
             - name: GF_AUTH_ANONYMOUS_ENABLED
-              value: {{ .Values.observability.grafana.anonymousAdmin | quote }}
+              value: {{ .Values.observability.grafana.anonymous.enabled | quote }}
             - name: GF_AUTH_ANONYMOUS_ORG_ROLE
-              value: Admin
+              value: {{ .Values.observability.grafana.anonymous.role | quote }}
+            # Never disabled. Hiding the login form alongside anonymous Admin
+            # left no way to authenticate as a real user at all.
             - name: GF_AUTH_DISABLE_LOGIN_FORM
-              value: {{ .Values.observability.grafana.anonymousAdmin | quote }}
+              value: "false"
             {{- if .Values.ingress.enabled }}
+            # Must be the hostname users actually arrive on, or Grafana's own
+            # redirects and asset links point at the wrong site.
             - name: GF_SERVER_ROOT_URL
               value: "https://{{ .Values.ingress.host }}/grafana/"
             - name: GF_SERVER_SERVE_FROM_SUB_PATH

infra/helm/medical-chatbot/values-practice.yaml

@@ -55,18 +55,37 @@ aiService:
 
 observability:
   grafana:
-    # Practice-only convenience: the rehearsal cluster is a throwaway box and
-    # Grafana sits behind the same ingress host. Never set this on production.
-    anonymousAdmin: true
+    # Dashboards stay open so a demo needs no credentials, but read-only: this
+    # Grafana answers on the public production hostname, and it previously ran
+    # anonymous *Admin* with the login form disabled — which handed the
+    # datasource and dashboard APIs to anyone who found the URL, and left no
+    # way to sign in as a real admin either.
+    anonymous:
+      enabled: true
+      role: Viewer
 
 ingress:
   enabled: true
   className: traefik
-  host: readytochat.realvuxbaro.me
+  # Primary, not merely first in a list: `ingress.host` is what Grafana's
+  # GF_SERVER_ROOT_URL is built from, so it must be the name users arrive on.
+  # `realvuxbaro.me` moved here from the Compose host on 2026-08-17 — routed
+  # first and certificated only once its A record pointed at this cluster,
+  # because cert-manager solves HTTP-01 and the challenge could not reach here
+  # before that.
+  host: realvuxbaro.me
+  # The rehearsal name is kept so existing links and bookmarks still resolve.
+  extraHosts:
+    - readytochat.realvuxbaro.me
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-prod
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
+  # Separate secrets per hostname: a renewal failure on one name must not take
+  # the other offline.
   tls:
     - hosts:
         - readytochat.realvuxbaro.me
       secretName: readytochat-tls
+    - hosts:
+        - realvuxbaro.me
+      secretName: realvuxbaro-tls

infra/helm/medical-chatbot/values.yaml

@@ -73,6 +73,11 @@ ingress:
   className: nginx
   annotations: {}
   host: duocthu.local
+  # Additional hostnames served by the same rules as `host`. Used during a
+  # cutover, when one release must answer to both the old and the new name.
+  # A host here is routed but gets no certificate unless it also appears in
+  # `tls` below — see the note in templates/ingress.yaml.
+  extraHosts: []
   tls: []
 
 postgres:
@@ -121,7 +126,12 @@ observability:
       port: 3000
       nodePort: null
     storage: 2Gi
-    anonymousAdmin: false
+    # Anonymous access, when enabled, must stay read-only. `role: Admin` on an
+    # internet-reachable Grafana exposes the datasource and dashboard APIs to
+    # anyone; the login form is always available for real admin access.
+    anonymous:
+      enabled: false
+      role: Viewer
     resources:
       requests: { cpu: 50m, memory: 128Mi }
       limits: { cpu: 500m, memory: 512Mi }