Managed Service for Grafana:Customize a private domain name

Enable and retrieve the private domain name

1. Log on to the Managed Service for Grafana console and go to the Workspace Information page.

2. In the Basic Information section, enable the private domain name.

   

3. Copy the private domain name displayed on the page. This value is required in later steps.

   

Create a Private DNS zone

1. Log on to the Alibaba Cloud DNS console.

2. On the Private DNS (PrivateZone) page, click Add New Zone.

3. Set the zone type to Built-in Authoritative Zone and click OK.

   

Add a CNAME record

1. On the User Defined Zones tab, click the zone you created.

2. On the Resource Records Settings tab, click Add Record and configure the following parameters:

   Parameter	Description	Example
   Record Type	Select CNAME to point your domain to another domain name.	CNAME
   Hostname	Enter the domain name prefix. Use @ for the root domain.	@
   Request Line	Select Default.	Default
   Record Value	Enter the private domain name of the Grafana workspace. Set Weight to 1.	grafana-cn-kjp**-vpc.grafana.aliyuncs.com
   TTL	Select 1 Minute.	1 Minute

   

3. In the Change Resource Record Confirmation dialog, click OK.

   

Set the effective scope

1. Return to the Private DNS (PrivateZone) page. Find the zone and click Effective Scope Settings in the Actions column.

   

2. On the Zone Settings tab, select the VPC where the domain name should take effect and click OK.

   

Verify the domain name

From an ECS instance in the selected VPC, ping the custom domain or access it in a browser:

ping grafana.mydomain.com

Or open http://grafana.mydomain.com in a browser.

Install NGINX

1. Download and extract NGINX on the ECS instance:

      wget https://nginx.org/download/nginx-1.24.0.tar.gz
      cp nginx-1.24.0.tar.gz /usr/local/nginx/
      cd /usr/local/nginx/
      tar -zxvf nginx-1.24.0.tar.gz
      cd nginx-1.24.0/

2. Install the SSL and build dependencies:

      yum -y install make zlib-devel gcc-c++ libtool openssl openssl-devel

3. Configure the build with SSL support:

      ./configure --user=nobody --group=nobody --prefix=/usr/local/nginx \
        --with-http_stub_status_module --with-http_gzip_static_module \
        --with-http_realip_module --with-http_sub_module --with-http_ssl_module

4. Compile and install:

      make
      make install

Prepare the SSL certificate

Copy your certificate and private key to the ECS instance:

/usr/local/nginx/ssl/cert.pem
/usr/local/nginx/ssl/cert.key

Configure NGINX

Edit /usr/local/nginx/conf/nginx.conf and add the following server block:

server {
    listen       443 ssl;
    server_name  <your-custom-domain>;

    ssl_certificate      /usr/local/nginx/ssl/cert.pem;
    ssl_certificate_key  /usr/local/nginx/ssl/cert.key;

    ssl_session_cache    shared:SSL:1m;
    ssl_session_timeout  5m;

    ssl_ciphers  HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers  on;

    location / {
        add_header Access-Control-Allow-Origin *;
        add_header Access-Control-Allow-Methods 'GET, POST, OPTIONS';
        add_header Access-Control-Allow-Headers 'DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization';
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_pass http://<grafana-private-domain>:80;
    }
}

Replace the following placeholders with your actual values:

Validate and start NGINX

1. Test the configuration:

   Note

   If the test fails, check for common issues: certificate file not found, incorrect certificate format, configuration format not compliant with NGINX requirements, line break comments not valid, or separators containing Chinese characters.

      cd /usr/local/nginx/sbin/
      ./nginx -t

2. Start NGINX:

      ./nginx

Configure domain name resolution

Follow the Private DNS setup in Set up an HTTP private domain name with the following difference: set Record Type to A and set Record Value to the private IP address of the ECS instance (instead of a CNAME record pointing to the Grafana workspace domain).

After the DNS record takes effect, open https://grafana.mydomain.com from an ECS instance in the target VPC to verify the setup.

Get the Grafana workspace IP address

Ping the private domain name to get the IP address:

ping grafana-cn-kjp4*******-vpc.grafana.aliyuncs.com

Add an HTTPS listener

1. Log on to the SLB console and navigate to ALB > Instances.

2. Find the ALB instance and click Create Listener in the Actions column.

   

3. In the Configure Listener step, set the listener protocol to HTTPS and port to 443.

   

4. In the Configure SSL Certificate step, select an SSL certificate. To create a new certificate, click Create SSL Certificate.

5. In the Select Server Group step, configure the following parameters: Click Add Server to add the private IP address obtained in the previous section, with port 80.

   Parameter	Description	Example
   Server Group Type	Select IP Type.	IP Type
   Server Group Name	Enter a name for the server group.	Grafana Service

6. Click Submit.

7. Verify that the listener status is Normal in the listener list.

For detailed instructions, see Add an HTTPS listener.

Configure domain name resolution

1. On the ALB instance details page, copy the VIP (virtual IP address).

   

2. Follow the Private DNS setup in Set up an HTTP private domain name with the following differences:

   • Set Record Type to A.

   • Set Hostname to @ (or adjust based on your domain structure).

   • Set Record Value to the ALB VIP.

3. Set the effective scope to include the target VPC.

Verify the domain name

Confirm that the custom domain resolves correctly and the HTTPS connection works: