add Grafana service with provisioned ClickHouse datasource

Bundle Grafana (127.0.0.1:3000) with the grafana-clickhouse-datasource plugin
and an auto-provisioned ClickHouse datasource using the read-only user. Adds
GRAFANA_ADMIN_PASSWORD to .env.example. Verified: datasource health returns OK.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.env.example

@@ -39,3 +39,8 @@ POLL_INTERVAL=300
 MAX_ROWS_PER_POLL=50
 # Comma-separated base64 private keys used to decrypt channel messages.
 PRIVATE_KEYS=
+
+# ─── Grafana ─────────────────────────────────────────────────────────────────
+# Admin password for the bundled Grafana (published on 127.0.0.1:3000). A
+# ClickHouse datasource is auto-provisioned using the read-only user above.
+GRAFANA_ADMIN_PASSWORD=admin

README.md

@@ -9,6 +9,7 @@ single `docker compose up`:
 | Web app | [`meshexplorer/`](./meshexplorer) | Next.js UI + API (map, chat, stats, packet analysis) |
 | Ingest + DB | [`ingest/`](./ingest) | Go MeshCore MQTT→ClickHouse ingest, ClickHouse image, and SQL migrations |
 | Discord relay | [`meshexplorer/`](./meshexplorer) (`Dockerfile.bot`) | Optional bot that relays MeshCore channel messages to Discord |
+| Grafana | [`grafana/`](./grafana) | Dashboards with a pre-provisioned ClickHouse datasource (read-only user), on `127.0.0.1:3000` |
 
 ## Architecture
 
@@ -21,9 +22,9 @@ single `docker compose up`:
    └──────────────┘   └──────┬───────┘
                              │ (readonly user)
                   ┌──────────┴──────────┐
-                  ▼                     ▼
-            meshexplorer           discord-bot
-            (web UI :3001)         (optional --profile bot)
+                  ▼              ▼              ▼
+            meshexplorer     discord-bot      grafana
+            (web UI :3001)   (--profile bot)  (:3000)
 ```
 
 ## Quick start

docker-compose.yml

@@ -126,8 +126,31 @@ services:
     networks:
       - meshnet
 
+  # Grafana dashboards, wired to ClickHouse via the read-only user.
+  grafana:
+    image: grafana/grafana:11.0.0
+    environment:
+      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD:-admin}
+      - GF_INSTALL_PLUGINS=grafana-clickhouse-datasource
+      - GF_USERS_DEFAULT_THEME=dark
+      # Consumed by the provisioned ClickHouse datasource (grafana/provisioning).
+      - CLICKHOUSE_READONLY_USER=${CLICKHOUSE_READONLY_USER:-readonly}
+      - CLICKHOUSE_READONLY_PASSWORD=${CLICKHOUSE_READONLY_PASSWORD:-readonly}
+    ports:
+      - "127.0.0.1:3000:3000"
+    volumes:
+      - grafana-data:/var/lib/grafana
+      - ./grafana/provisioning:/etc/grafana/provisioning:ro
+    depends_on:
+      clickhouse:
+        condition: service_healthy
+    restart: unless-stopped
+    networks:
+      - meshnet
+
 volumes:
   clickhouse-data:
+  grafana-data:
 
 networks:
   meshnet:

grafana/provisioning/datasources/clickhouse.yaml

@@ -0,0 +1,15 @@
+apiVersion: 1
+
+datasources:
+  - name: ClickHouse
+    type: grafana-clickhouse-datasource
+    access: proxy
+    isDefault: true
+    jsonData:
+      host: clickhouse
+      port: 9000
+      protocol: native
+      username: $CLICKHOUSE_READONLY_USER
+    secureJsonData:
+      password: $CLICKHOUSE_READONLY_PASSWORD
+    editable: false