grafana: note the query grant every rule's data source needs, and rename the Regions groups

[Peeja]

Written by Claude.

Part of FIL-1383

Problem

Applying #162 failed in apply-grafana:

[PUT /v1/provisioning/folder/{FolderUID}/rule-groups/{Group}][403] putAlertRuleGroupForbidden {}

#162's rule is the first to read grafanacloud-logs, and forge-terraform could query only grafanacloud-prom. Grafana refuses a whole rule group when it reads any data source the caller can't query. The header of alerts.tf described the grant, but only for grafanacloud-prom. The logs grant has since been added by hand, and a rerun applied the rule.

Change

• terraform/envs/grafana/alerts.tf, the header: datasources:query is needed on every data source a group's rules read, today grafanacloud-prom and grafanacloud-logs, and before the rule merges. Without it, the whole group is refused with a 403.

• The appliance rule groups are renamed to match their dashboard, Forge Regions:

  • "Forge appliances" → "Forge Regions", evaluated every 300s;
  • "Forge appliance containers" → "Forge Regions containers", evaluated every 60s.

  They stay two groups because a group's rules share one evaluation interval, and the split is intentional.

• docs/observability.md: the rules table uses the new group names, and gains Alert when Piri stops receiving chain notifications #162's "Piri has stopped receiving chain notifications" rule.

The renames replace the groups

The provider marks grafana_rule_group.name as ForceNew (internal/resources/grafana/resource_alerting_rule_group.go:53-57, at v4.46.0, the version pinned here), and no rule here pins a uid. So the apply destroys both groups and creates them under their new names:

• UIDs: their four rules get new ones, and their state and history start fresh.
• Gap: for the moment between each delete and create, the rules don't exist.
• Links: anything bookmarked to one of the old rules stops resolving.

The four rules are "Appliance has stopped reporting", "Appliance free disk space below 40%", "Piri has stopped receiving chain notifications" and "Appliance container is not running".

Testing

• tofu fmt -check -recursive and tofu validate pass.
• make check's Go tests pass. Its shellcheck step couldn't run here, since shellcheck isn't installed, but this PR changes no shell scripts.
• git grep -i 'forge appliances\|appliance containers' finds nothing left.

Notes

#163 adds four rules to the "Forge Regions" group, so whichever merges second will need a small merge.

🤖 Generated with Claude Code

https://claude.ai/code/session_01JCF8gyb8jNRmHmWqQmVhRJ

✴️

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.