I am having exactly the same problem. Grafana graph images render fine when the sitemap is accessed from my local network, but when accessed remotely I get a broken image.
As an experiment I opened up port 8080 and connected remotely. In this case the image rendered OK too - so from this the issue does seem to be related to Nginx.
The system is an Intel NUC running Ubuntu 18.04.
Here are some snippets of my configs:
sitemap:
Image refresh=60000 url="http://localhost:3000/render/d-solo/mtUhoXUZz/heating?orgId=1&from=now-6h&to=now&panelId=2&width=800&height=400"
grafana.ini
[server]
root_url = %(protocol)s://%(domain)s:/grafana/
[auth.anonymous]
enabled = true
nginx config
server {
listen 80;
server_name <redacted>;
return 301 https://$server_name$request_uri;
}
## Reverse Proxy to openHAB
server {
listen 443 ssl;
server_name <redacted>;
# Cross-Origin Resource Sharing.
add_header 'Access-Control-Allow-Origin' 'http://localhost:8080/rest';
add_header 'Access-Control-Allow_Credentials' 'true';
add_header 'Access-Control-Allow-Headers' 'Authorization,Accept,Origin,DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range';
add_header 'Access-Control-Allow-Methods' 'GET,POST,OPTIONS,PUT,DELETE,PATCH';
## Secure Certificate Locations
ssl_certificate /etc/letsencrypt/live<redacted>/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/<redacted>/privkey.pem;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
# ssl_client_certificate /etc/nginx/Client-CA.pem; # trusted CA used to issue client certs
# ssl_verify_client on;
#
# Password Protection
auth_basic "Username and Password Required";
auth_basic_user_file /etc/nginx/.htpasswd;
satisfy any;
allow 192.168.1.0/24;
allow 127.0.0.1;
deny all;
location / {
proxy_pass http://localhost:8080/;
# proxy_buffering off; # openHAB supports non-buffering specifically for SSEs now
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
location /grafana/ {
proxy_pass http://localhost:3000/;
proxy_set_header Authorization ""; # stop nginx forwarding the basic auth header for nginx .httpasswd to grafana
}
location /frontail/ {
proxy_pass http://localhost:9001;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
## Let's Encrypt webroot location
location /.well-known/acme-challenge/ {
root /var/www/<redacted>;
}
}
If I right-click on the broken image and select ‘View image’ I see this:
The JSON ‘Invalid username or password’ is from Grafana as I see this in my Grafana log:
t=2020-02-12T11:54:01+0000 lvl=eror msg="Invalid username or password" logger=context error="Invalid Username or Password"
t=2020-02-12T11:54:01+0000 lvl=info msg="Request Completed" logger=context userId=0 orgId=0 uname= method=GET path=/render/d-solo/mtUhoXUZz/heating status=401 remote_addr=<redacted> time_ms=69 size=42 referer=https://<redacted>.org/basicui/app
So it appears to be a Grafana authentication issue caused when the sitemap is served via Nginx. Any thoughts on steps to troubleshoot?
