# One machine that becomes a mesh and assigns itself grafana's tool runtime, configured by settings.
#
# plex/sonarr prove a runtime that self-detects its credential; this proves the other half of the
# config story (novox/hq ADR 0051 + 0052): the operator states grafana's URL and token as the
# assignment's settings, the mesh merges them into the config file the runtime reads, and the
# runtime registers and serves grafana's tools from that — no credential baked into the manifest.
scenario: grafana-node

segments:
  hosting:
    kind: public
    cidr: [192.0.2.0/24]

machines:
  anchor:
    at: { segment: hosting, address: [192.0.2.10] }
    egress: true
    inbound: allow
    memory: 3GiB
    cpus: 2

images:
  - mesh-control:development
  - mesh-runtime-grafana:development

place:
  all: [host, runtime]