Map a custom public domain name for a Grafana workspace - Application Real-Time Monitoring Service

The custom public domain name feature of Grafana Service resolves a Grafana workspace to a domain name that you specify. Use a custom public domain name when you want users to access a Grafana workspace through a domain name that you own rather than through the default domain name of the workspace.

Limits

Supported editions — The custom public domain name feature is available only to Grafana Pro Edition and Advanced Edition users. If you use Grafana Developer Edition, upgrade the edition of the workspace first.
Dependency on the public domain name — If you disable the public domain name, the custom public domain name feature becomes unavailable.

Upgrade a Grafana Developer Edition workspace

Log on to Managed Service for Grafana and go to the target workspace.
In the Basic Information section, click Upgrade to the right of Edition.
On the Modify page that appears, follow the prompts to upgrade to Pro Edition or Advanced Edition.

After the upgrade is complete, you can use the custom public domain name feature.

Prerequisites

You must have a registered domain name that you own. The domain name must have passed identity verification and completed ICP filing. It can be a public domain name or a private domain name.
Note
If your domain name is a private domain name, resolution relies on Alibaba Cloud DNS PrivateZone, which is a private DNS service that is based on the Alibaba Cloud Virtual Private Cloud (VPC) environment.
You must have the default domain name and the network protocol of your Grafana workspace. The connection information on the Workspace Information page displays the network protocol of the workspace.

This topic uses Public Authoritative DNS Resolution as an example to demonstrate domain name resolution operations.

Step 1: Configure DNS records

Add a CNAME record that resolves your domain name to the default domain name of your Grafana workspace. Choose one of the following two options based on whether your domain name is a public domain name or a private domain name. The option that you choose determines how you set Private Domain Name in Step 2.

Option 1: Resolve a public domain name

Log on to the Alibaba Cloud DNS console. In the left-side navigation pane, choose Public DNS Resolution > Authoritative DNS Resolution.
On the Authoritative Zone page, click Settings in the Actions column for the target domain name.
On the Settings tab, click Add Record. In the panel that appears, configure the following parameters and click OK.

Parameter	Description
Record Type	Select CNAME to point the domain name to another domain name.
Record Value	Enter the default domain name of the Grafana workspace as the record value.

Configure other parameters as needed. For more information, see Add DNS records.

Option 2: Resolve a private domain name

Log on to the Alibaba Cloud DNS console. In the left-side navigation pane, click Private Zone.
On the Private Zone page, click Configuration Mode in the upper-right corner of the page, and then click the Authoritative Zone tab.
On the User Defined Zones tab, click Add Zone. In the panel that appears, enter the Authoritative Zone, keep other parameters at their default values, and then click OK. For details about the other zone parameters, see Add a built-in authoritative domain name.
After the domain name is added, click Settings in the Actions column for the target built-in authoritative domain name, and then click Add Record on the Settings tab.
In the Add Record panel, select Form Editor Mode, configure the following parameters in the dialog box, and then click OK.

Parameter	Description
Record Type	Select CNAME to point the domain name to another domain name.
Hostname	Set the value to `@`.
Record Value	Enter the default domain name of the Grafana workspace as the record value.

For details about the other record parameters, see Form editor mode.

You can add records in Form Editor Mode or Visual Editor Mode. For details about Visual Editor Mode, see Visual editor mode.

Step 2: Add a custom public domain name

If Network Protocol is set to HTTPS, decide how to provide the certificate before you add the domain name. Select one of the following two values for Certificate Type:

Alibaba Cloud SSL Certificate — Select the Alibaba Cloud SSL certificate that you need from the Certificate Name drop-down list.
Upload — Manually enter the PEM certificate content and key.

Note

If you do not want to store the certificate on the Alibaba Cloud platform, you can configure an NGINX reverse proxy instead of selecting either Certificate Type value. For more information, see (Optional) Step 3: Configure an NGINX reverse proxy in this topic.

Log on to the ARMS console. In the left-side navigation pane, choose Managed Service for Grafana > Workspace Management.
On the Workspace Management page, click the ID of the workspace that you want to manage.
In the left-side navigation pane, click Domain Name Management.
On the Domain Name Management page, click the Customize Public Domain Name tab.

Click Add Custom Public Domain Name. In the dialog box that appears, configure the following parameters and click Confirm.

Parameter	Description
Domain Name	The domain name that you own. Example: `example.com`.
Private Domain Name	Specifies whether your domain name is a private domain name. Set this parameter based on the type of domain name that you resolved in Step 1.
Network Protocol	The protocol type must be consistent with the network protocol of the Grafana workspace that you obtained in the Prerequisites section.
Certificate Type	Required if the network protocol is HTTPS. Select Alibaba Cloud SSL Certificate or Upload, as described at the beginning of this step.
Certificate Name	Required if Certificate Type is set to Alibaba Cloud SSL Certificate.
PEM Certificate Content	Required if Certificate Type is set to Upload. Enter the PEM certificate content. The content must start with `-----BEGIN CERTIFICATE-----` and end with `-----END CERTIFICATE-----`.
PEM Certificate Key	Required if Certificate Type is set to Upload. Enter the PEM certificate key. The key must start with `-----BEGIN RSA PRIVATE KEY-----` and end with `-----END RSA PRIVATE KEY-----`.
Route Settings	The default subpath of the Grafana workspace. If you have no special requirements, enter `/`. The subpath is appended to the workspace URL. The following examples use the default domain name of the workspace: When configured as `/`, the Grafana workspace URL is `https://[Grafana-workspace-ID].grafana.aliyuncs.com/`. When configured as `/mypath`, the Grafana workspace URL is `https://[Grafana-workspace-ID].grafana.aliyuncs.com/mypath/`.

(Optional) Step 3: Configure an NGINX reverse proxy

If you do not want to store the certificate on the Alibaba Cloud platform, you can configure an NGINX reverse proxy.

Use the following NGINX reverse proxy configuration snippet:

location / {
    add_header Access-Control-Allow-Origin *;
    add_header Access-Control-Allow-Methods 'GET, POST, OPTIONS';
    add_header Access-Control-Allow-Headers 'DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization';
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_pass https://g-xxxxxxxxxxxxx.grafana.aliyuncs.com;     # Replace the proxy_pass value with the actual Grafana workspace URL.
}

Verify that you can access the Grafana service through this NGINX proxy.

Next steps

If you want only specific customers, or only clients in a corporate intranet or a VPC, to access the Grafana service, you can restrict the source IP addresses by configuring a whitelist on the Whitelists and Security Groups page. For more information, see Public IP address whitelist.