grafana: Make it HTTPS

Note this introduces two files the user must provide.
We set up the makefile to fail if they don't exist.

monitoring/Makefile

@@ -1,6 +1,7 @@
 
+REQUIRED_FILES := grafana/tls.key grafana/tls.crt
 
-all: .prometheus.uptodate
+all: .prometheus.uptodate $(REQUIRED_FILES)
 .PHONY: all
 
 .prometheus.uptodate: Dockerfile.prometheus prometheus.yml
@@ -9,3 +10,6 @@ all: .prometheus.uptodate
 
 prometheus.yml: prometheus.jsonnet
 	./generate-config
+
+$(REQUIRED_FILES):
+	echo "Missing required file: $@" >&2 && exit 1

monitoring/grafana/grafana.ini

@@ -1,3 +1,8 @@
+[server]
+protocol = "https"
+cert_key = /etc/grafana/tls.key
+cert_file = /etc/grafana/tls.crt
+
 [auth.anonymous]
 enabled = true
 org_name = Main Org.