There’s nothing wrong with exposing Grafana as long as you’re following security best practices.
It’s 2024, zero trust networking is where you want to be. Real zero trust networking is NOT adding a VPN to access internal services. It’s doing away with the notion of internal services all together and securing them for exposure on the internet.
I don’t think it is advisable to directly expose your Grafana to the public internet where you can hit it with dictionary attacks.
It’s about zero trust, includes the claim “VPNs are Deprecated!”
I, for one, will still keep using VPNs as an additional layer of security and expose only a single UDP port (WireGuard), to at least reduce the chances of that happening.
So you might have an internal service that has passed a minimal security bar that you can only establish an https connection with if you have a valid SSO token.