This insight was synthesized by AI from public community discussions. We do not display original user posts or comments verbatim—all content has been rewritten and aggregated. Verify before acting on it.
Multi-tenant Observability Header Proxy for Grafana
A self-hosted or managed reverse proxy middleware that sits between Grafana and multi-tenant backends (Mimir, Loki, Tempo), handling JWT-to-tenant header mapping, configurable header propagation, and security filtering. Eliminates the need for custom Grafana patches and fragile proxy configurations.
Why this matters
You run a multi-tenant observability platform where different customers' metrics land in the same Mimir cluster, scoped by a tenant header. Your users access Grafana dashboards through a reverse proxy that authenticates them and maps their identity to a tenant. But Grafana has no way to forward that tenant header through to the Mimir datasource on the read path. You spent a week debugging, downgrading Grafana versions, and ultimately wrote a custom patch that breaks on every upgrade. Multiple GitHub issues spanning years reference this gap with no resolution. The existing workarounds—a boolean toggle that sends a fixed header, or auth proxy configs that do not reach datasources—do not solve your problem. You maintain a private fork and dread each Grafana release.
- · Built for Platform engineering and SRE teams at enterprises running multi-tenant Grafana deployments with Mimir/Loki/Tempo backends who need per-tenant dashboard scoping.
- · Most likely monetization: SaaS subscription with self-hosted option (open-core model).
The Pain · Narrative
You run a multi-tenant observability platform where different customers' metrics land in the same Mimir cluster, scoped by a tenant header. Your users access Grafana dashboards through a reverse proxy that authenticates them and maps their identity to a tenant. But Grafana has no way to forward that tenant header through to the Mimir datasource on the read path. You spent a week debugging, downgrading Grafana versions, and ultimately wrote a custom patch that breaks on every upgrade. Multiple GitHub issues spanning years reference this gap with no resolution. The existing workarounds—a boolean toggle that sends a fixed header, or auth proxy configs that do not reach datasources—do not solve your problem. You maintain a private fork and dread each Grafana release.
Score Breakdown
Market Signal
Go-to-Market
Platform engineers at SaaS companies and MSPs running shared multi-tenant Grafana+Mimir deployments serving 10+ tenant organizations
~5,000-15,000 organizations globally running multi-tenant observability stacks with Grafana
GitHub issue engagement and Grafana community Slack — directly responding to users who have commented on related header-forwarding issues
$99/month for managed proxy, $499/month for self-hosted enterprise license
10 organizations installing the open-source proxy within 30 days, with 3 converting to paid managed tier
MVP Scope · 1–2 weeks
- Build a Go-based reverse proxy that intercepts Grafana datasource requests and injects configurable headers
- Implement JWT claim extraction and mapping to tenant identifiers (X-Scope-OrgID, X-Scope-OrgID for Loki)
- Create YAML configuration schema for header forwarding rules with allow/deny lists
- Set up a test environment with Grafana + Mimir to validate end-to-end header propagation
- Write Docker Compose setup for local development and testing
- Add security filtering layer to strip sensitive headers (Cookie, Authorization) before forwarding
- Build pre-built configuration templates for Mimir, Loki, and Tempo tenant headers
- Create a simple web UI for managing forwarding rules and viewing propagation status
- Publish open-source GitHub repo with documentation targeting the exact pain points described in community issues
- Reach out directly to users who commented on related GitHub issues for beta feedback
Differentiation
Why This Might Fail
Self-rebuttal — the most important trust signal
- 1Grafana ships native forwarded headers support within 6-12 months, making this solution redundant — the multiple referenced issues suggest this is on their roadmap
- 2The market of organizations needing multi-tenant Grafana+Mimir is smaller than estimated, as many adopt single-tenant deployments or use Grafana Cloud's managed multi-tenancy
- 3Security-conscious enterprises may be reluctant to add another proxy layer that handles authentication headers, preferring to maintain their own vetted configurations
Evidence Summary
How AI synthesized this insight — no verbatim quotes
Approximately 5 commenters across the discussion describe the same fundamental problem: Grafana cannot forward custom headers to datasource backends, breaking multi-tenant deployments. One user describes spending a full week debugging, downgrading versions, and writing a patch. Multiple referenced GitHub issues (#89236, #62891, #44250, #80698, #82688) show this is a long-standing, unresolved problem spanning years. The Grafana maintainer acknowledges the need but suggests a more general solution that has not been implemented. Users have resorted to custom patches and private forks, indicating strong willingness to adopt a supported alternative.
Action Plan
Validate this opportunity before writing code
Recommended Next Step
Validate
Promising signals, but needs confirmation. Create a landing page, collect email sign-ups, then decide.
Landing Page Copy Kit
Ready-to-paste copy based on real Reddit community language — no editing required
Headline
Multi-tenant Observability Header Proxy for Grafana
Sub-headline
A self-hosted or managed reverse proxy middleware that sits between Grafana and multi-tenant backends (Mimir, Loki, Tempo), handling JWT-to-tenant header mapping, configurable header propagation, and security filtering. Eliminates the need for custom Grafana patches and fragile proxy configurations.
Who It's For
For Platform engineering and SRE teams at enterprises running multi-tenant Grafana deployments with Mimir/Loki/Tempo backends who need per-tenant dashboard scoping
Feature List
✓ Configurable header forwarding rules with allow/deny lists ✓ JWT claim-to-tenant-ID mapping engine ✓ Pre-built templates for Mimir X-Scope-OrgID, Loki X-Scope-OrgID, Tempo traces ✓ Security filtering to prevent leaking sensitive headers (Cookie, Authorization) ✓ Grafana datasource health dashboard showing header propagation status ✓ Per-datasource header forwarding rule editor in Grafana UI ✓ JWT claim extraction and variable interpolation for header values ✓ Header security validation (block forwarding of Cookie/Authorization)
Where to Validate
Share your landing page in r/GitHub · grafana/grafana — that's exactly where these pain points were discovered.
Sign up to unlock full deep analysis
GTM, MVP scope, why-it-might-fail, ActionPlan Copy Kit. Free signup grants 10 detail views/month.
Other opportunities in the same theme
Auto-clustered by AI from related discussions