diff --git a/lotus-land-story/grafana.yml b/lotus-land-story/grafana.yml
index a26134a..781ad54 100644
--- a/lotus-land-story/grafana.yml
+++ b/lotus-land-story/grafana.yml
@@ -32,34 +32,19 @@
           disable_total_stats = false
 
           [server]
-          domain = grafana.{{ domain }}
+          domain = grafana
           http_addr = 0.0.0.0
-          root_url = https://grafana.{{ domain }}
+          root_url = https://grafana
 
-          # https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication
+          # https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/auth-proxy/
           [auth]
-          oauth_allow_insecure_email_lookup = true
           disable_signout_menu = true
 
-          # https://www.authelia.com/integration/openid-connect/grafana/
-          [auth.generic_oauth]
+          [auth.proxy]
           enabled = true
-          name = Authelia
-          icon = signin
-          client_id = grafana
-          client_secret = {{ grafana.oauth_secret }}
-          scopes = openid profile email groups
-          empty_scopes = false
-          auth_url = https://auth.{{ domain }}/api/oidc/authorization
-          token_url = https://auth.{{ domain }}/api/oidc/token
-          api_url = https://auth.{{ domain }}/api/oidc/userinfo
-          login_attribute_path = preferred_username
-          groups_attribute_path = groups
-          name_attribute_path = name
-          use_pkce = true
-          auto_login = true
-          role_attribute_path = contains(groups, 'admin') && 'Admin' || contains(groups, 'editor') && 'Editor' || 'Viewer'
-          allow_assign_grafana_admin = true
+          header_name = Remote-User
+          header_property = email
+          auto_sign_up = false
 
           [smtp]
           enabled = true
diff --git a/lotus-land-story/main.tf b/lotus-land-story/main.tf
index 9095f9a..161bf0c 100644
--- a/lotus-land-story/main.tf
+++ b/lotus-land-story/main.tf
@@ -60,13 +60,10 @@ resource "linode_domain_record" "subdomains" {
 
   for_each = toset([
     "auth",
-    "books",
-    "grafana",
-    "hledger",
     "loki",
     "prometheus",
   ])
-  name     = each.key
+  name = each.key
 }
 
 resource "linode_domain_record" "prometheus" {
diff --git a/lotus-land-story/templates/Caddyfile b/lotus-land-story/templates/Caddyfile
index b02aa76..9f6eae4 100644
--- a/lotus-land-story/templates/Caddyfile
+++ b/lotus-land-story/templates/Caddyfile
@@ -39,6 +39,15 @@ grafana.kejadlen.dev {
 	reverse_proxy grafana:3000
 }
 
+grafana {
+	tls internal
+	bind tailscale/grafana
+	tailscale_auth
+	reverse_proxy grafana:3000 {
+		header_up Remote-User {http.auth.user.tailscale_user}
+	}
+}
+
 {% for domain in ("kejadlen.dev", "chislan.family") %}
 auth.{{ domain }} {
 	reverse_proxy authelia:9091 {