This commit introduces a new protocol scheme 'sockettls' (internal constant
SocketHTTP2Scheme) that enables serving TLS-encrypted traffic over Unix
domain sockets.
Previously, Grafana supported plain HTTP over Unix sockets via the 'socket'
protocol, but there was no way to enable TLS or HTTP/2 when using sockets.
This is useful when Grafana is behind a reverse proxy that communicates
via sockets and requires end-to-end encryption or HTTP/2 features.
Key changes:
- pkg/setting: Added SocketHTTP2Scheme and updated readServerSettings to
parse the 'sockettls' protocol. This includes support for socket paths,
GID/mode permissions, and TLS certificate/key configuration.
- pkg/api: Modified HTTPServer to support listening on Unix sockets when
TLS is enabled. Updated Run, getListener, and configureTLS to
correctly handle the new scheme.
- pkg/services/rendering: Updated getGrafanaCallbackURL to use 'https'
scheme for the new socket-based scheme, ensuring correct callback URLs.
- pkg/services/frontend: Enabled the Http2Enabled flag for the new scheme
to inform the frontend about HTTP/2 availability.
- conf: Updated defaults.ini and sample.ini to include 'sockettls' in
the documented protocol options.
- docs: Updated configuration documentation to reflect the new protocol.
