"""Grafana stack: VPC import, EC2, ALB, SG, Route53, Athena datasource role.

Scaffold — resources are added in Phase 5 of docs/BUILD.md. The running box is
the only non-serverless piece here (self-hosted Grafana OSS on a t4g.small,
ARM64, VPN-only) and carries an OS/Grafana patching + config-backup obligation.
Dashboards are provisioned as code from grafana/ — the running instance is never
the source of truth.
"""

from aws_cdk import Stack
from constructs import Construct


class GrafanaStack(Stack):
    def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
        super().__init__(scope, construct_id, **kwargs)

        # Phase 5 — EC2 (Amazon Linux 2023, Grafana OSS via user-data),
        #           internal ALB (HTTPS, *.seahaven.com ACM cert),
        #           SG ingress from VPN/office CIDRs only,
        #           Route53 alias grafana.seahaven.com,
        #           instance role: Athena + Glue + S3 read (no static keys).  TODO