grafana: within-major step, both venues proven (R-462, Part F)

{'grafana': 'grafana/grafana:13.2.2'} -> {'grafana': 'grafana/grafana:13.2.3'}
The ONLY image move in this commit. Written by upgrade-test.py --write-ladder (catalog gates rc=0):
- bench LXC 9401 (harness v4): the seed read back before and after; 10-minute memory watch:
  grafana anon 47.1 % (cgroup 100.0 %); 0 kills, 0 restarts; the abort starts and serves the data;
- box 9202 (controller 0.283.1, the product's guarded Update, drill catalog): done in 23.6 s, the seed
  read back through the app's own front door.
  The box walk was run TWICE: the first read back 401 because the instrument lost the deploy's
  admin password between two processes (box/grafana/step-attempt1-instrument-401.txt); fixed in the
  walk tools, grafana reinstalled at 13.2.2 from the drill catalog, seeded, stepped: read back.
Evidence: felhom.eu/documentation/audits/pg-last-six-2026-09-30/F/ and .../box/grafana/

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

templates/grafana/.felhom.yml

@@ -10,7 +10,7 @@ subdomain: "grafana"
 slug: "grafana"
 # catalog_since: the date THIS repo last changed this app's pinned images. Any commit that
 # changes an image: line must set this to the same day (see CLAUDE.md).
-catalog_since: "2026-09-22"
+catalog_since: "2026-09-30"
 
 # --- Resource hints (displayed on deploy screen) ---
 resources:
@@ -111,3 +111,4 @@ i18n:
 # gated by scripts/check-test-record.py. An image: move without a proven entry here is refused.
 update_ladder:
   - {"from": {"grafana": "grafana/grafana:13.1.0"}, "to": {"grafana": "grafana/grafana:13.2.2"}, "digest": {"grafana": "sha256:ac461fb352abc50da10a51c7d02462e9c05488f11f53f14b3ad79a8145f638a0"}, "verdict": "proven", "tested_at": "2026-09-21T19:02:25.646053+00:00", "harness_version": 1, "evidence": "felhom.eu/documentation/audits/update-night-2026-09-21/apps/grafana/verdict.json", "memory_peak_pct": null, "marks": {"files_may_change": false, "needs_person": null, "memory_tight": false}, "backfilled": "2026-09-23", "note": "backfilled from catalog commit 068f445; box walk only (harness v1, no memory watch); digest = what the registry served on 2026-09-23, not a measurement of the tested image"}
+  - {"from": {"grafana": "grafana/grafana:13.2.2"}, "to": {"grafana": "grafana/grafana:13.2.3"}, "digest": {"grafana": "sha256:b28bae15e219c998fb0e0424ed724930cc61b1f61fb404d47c862f9a23f9e572"}, "verdict": "proven", "tested_at": "2026-09-30T12:17:45Z", "harness_version": 4, "evidence": "felhom.eu/documentation/audits/pg-last-six-2026-09-30/F/apps/grafana/bench/evidence/MV-grafana/verdict.json", "box_evidence": "felhom.eu/documentation/audits/pg-last-six-2026-09-30/box/grafana/box-verdict-grafana.json", "memory_peak_pct": 47.1, "marks": {"files_may_change": false, "needs_person": null, "memory_tight": false}, "memory_basis": "anon", "memory_cgroup_peak_pct": 100.0}

templates/grafana/docker-compose.yml

@@ -9,7 +9,7 @@
 
 services:
   grafana:
-    image: grafana/grafana:13.2.2
+    image: grafana/grafana:13.2.3
     container_name: grafana
     restart: unless-stopped
     environment:

templates/grafana/steps/f3b0cc9b3e239437.felhom.yml

@@ -0,0 +1,107 @@
+# =============================================================================
+# .felhom.yml - App metadata for felhom-controller
+# =============================================================================
+
+# --- Display info (shown on dashboard) ---
+display_name: "Grafana"
+description: "Professzionális monitoring és vizualizációs platform"
+category: "dashboard"
+subdomain: "grafana"
+slug: "grafana"
+# catalog_since: the date THIS repo last changed this app's pinned images. Any commit that
+# changes an image: line must set this to the same day (see CLAUDE.md).
+catalog_since: "2026-09-22"
+
+# --- Resource hints (displayed on deploy screen) ---
+resources:
+  mem_request: "100M"
+  mem_limit: "512M"
+  pi_compatible: true
+  needs_hdd: false
+
+# --- Deploy fields (first deployment only) ---
+deploy_fields:
+  - env_var: DOMAIN
+    label: "Domain"
+    type: domain
+    description: "A szerver domain neve"
+    locked_after_deploy: true
+
+  - env_var: SUBDOMAIN
+    label: "Aldomain"
+    type: subdomain
+    default: "grafana"
+    required: true
+    locked_after_deploy: true
+    description: "Az alkalmazás aldomainje"
+
+  - env_var: GF_SECURITY_ADMIN_PASSWORD
+    label: "Admin jelszó"
+    type: password
+    generate: "password:16"
+    description: "Első bejelentkezéshez. Utána a webes felületen módosítható."
+    locked_after_deploy: false
+
+# --- App info (info page content) ---
+app_info:
+  tagline: "Vizualizációs platform - dashboardok, grafikonok, alertek"
+  default_creds: "admin / (telepítéskor megadott jelszó)"
+  docs_url: "https://grafana.com/docs/grafana/latest/"
+
+  use_cases:
+    - 'Rendszer metrikák vizualizálása (CPU, RAM, hálózat, lemez)'
+    - 'Egyedi dashboardok létrehozása különböző adatforrásokból'
+    - 'Alertek és értesítések küszöbértékek alapján'
+    - 'Prometheus, InfluxDB és sok más adatforrás támogatás'
+    - 'Szép, megosztható dashboardok'
+
+  first_steps:
+    - 'Nyisd meg a grafana.DOMAIN címet a böngészőben'
+    - 'Jelentkezz be az admin fiókkal'
+    - 'Add hozzá az adatforrásokat (Connections > Data Sources)'
+    - 'Importálj egy dashboard sablont vagy hozz létre sajátot'
+
+  prerequisites:
+    - 'Adatforrás szükséges (pl. Prometheus - külön telepítendő)'
+
+# --- Controller-side health probe ---
+healthcheck:
+  checks:
+    - type: api
+      port: 3000
+      path: "/api/health"
+      expect:
+        status: 200
+
+# --- English copy (localisation slice 5, R-560) --------------------------------------------
+# The Hungarian above is UNCHANGED. A box on English reads this block field by field; a missing
+# field shows the Hungarian one; a controller older than 0.257.0 ignores the block entirely.
+i18n:
+  en:
+    description: 'A professional monitoring and visualisation platform'
+    app_info:
+      tagline: 'A visualisation platform - dashboards, graphs and alerts'
+      default_creds: 'admin / (the password you set at install time)'
+      use_cases:
+        - 'See system numbers as graphs (CPU, RAM, network, disk)'
+        - 'Build your own dashboards from several data sources'
+        - 'Alerts and notifications when a number crosses a line you set'
+        - 'Prometheus, InfluxDB and many more data sources'
+        - 'Dashboards that look good and can be shared'
+      first_steps:
+        - 'Open grafana.DOMAIN in your browser'
+        - 'Sign in with the admin account'
+        - 'Add your data sources (Connections > Data Sources)'
+        - 'Import a dashboard template, or build your own'
+      prerequisites:
+        - 'A data source is needed (Prometheus, for example - installed separately)'
+    deploy_fields:
+      - env_var: DOMAIN
+        label: 'Domain'
+        description: 'The server domain name'
+      - env_var: SUBDOMAIN
+        label: 'Subdomain'
+        description: 'The subdomain this app answers on'
+      - env_var: GF_SECURITY_ADMIN_PASSWORD
+        label: 'Admin password'
+        description: 'For the first sign-in. You can change it in the app afterwards.'

templates/grafana/steps/f3b0cc9b3e239437.yml

@@ -0,0 +1,46 @@
+# Grafana - Professzionális monitoring és vizualizációs platform
+# Domain: ${SUBDOMAIN}.${DOMAIN}
+# Database: None (file-based)
+# RAM: ~100M (mem_limit: 512M) | Pi-compatible: Yes
+#
+# Environment variables:
+#   DOMAIN          - Your domain (e.g., demo-felhom.eu)
+#   GF_SECURITY_ADMIN_PASSWORD- Admin jelszó (auto-generated)
+
+services:
+  grafana:
+    image: grafana/grafana:13.2.2
+    container_name: grafana
+    restart: unless-stopped
+    environment:
+      - TZ=Europe/Budapest
+      - GF_SERVER_ROOT_URL=https://${SUBDOMAIN}.${DOMAIN}
+      - GF_SECURITY_ADMIN_PASSWORD=${GF_SECURITY_ADMIN_PASSWORD:?the admin password is required (R-708)}
+    volumes:
+      - grafana_data:/var/lib/grafana
+    networks:
+      - traefik-public
+    deploy:
+      resources:
+        limits:
+          memory: 512M
+    healthcheck:
+      test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:3000/api/health"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 30s
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.grafana.rule=Host(`${SUBDOMAIN}.${DOMAIN}`)"
+      - "traefik.http.routers.grafana.entrypoints=websecure"
+      - "traefik.http.routers.grafana.tls=true"
+      - "traefik.http.routers.grafana.tls.certresolver=letsencrypt"
+      - "traefik.http.services.grafana.loadbalancer.server.port=3000"
+
+volumes:
+  grafana_data:
+
+networks:
+  traefik-public:
+    external: true