tbarnouin/nixos-hypervisor
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Try and enable oauth on grafana

Browse source
This commit is contained in:
Théo Barnouin 2025-01-08 11:50:21 +01:00
parent 1c6643d4c2
commit ff620d9d22
2 changed files with 26 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
services/grafana/default.nix
View file

@ -19,11 +19,17 @@ in
}; };
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
age.secrets.grafana-db = { age.secrets ={
grafana-db = {
file = ./secrets/grafana-db.age; file = ./secrets/grafana-db.age;
owner = "grafana"; owner = "grafana";
}; };
age.secrets.kuma-token.file = ./secrets/kuma-token.age; grafana-oauth_secret = {
file = ./secrets/grafana-oauth_secret.age;
owner = "grafana";
};
kuma-token.file = ./secrets/kuma-token.age;
};
services.rsyslogd = { services.rsyslogd = {
enable = true; enable = true;
extraConfig = '' extraConfig = ''
@ -59,6 +65,19 @@ in
user = "grafana"; user = "grafana";
password = "\$__file{${config.age.secrets.grafana-db.path}}"; password = "\$__file{${config.age.secrets.grafana-db.path}}";
}; };
"auth.generic_oauth" = {
enabled = true;
name = "authentik";
allow_sign_up = true;
client_id = "WYrvCg9SYRPxHFZ7ag4oxlPRBNFUSC5M4uPZQMIqi";
client_secret = "\$__file{${config.age.secrets.grafana-oauth_secret.path}}";
scopes = [ "openid" "email" "profile" ];
auth_url = "https://auth.omero-fbi.fr/application/o/authorize/";
token_url = "https://auth.omero-fbi.fr/application/o/token/";
api_url = "https://auth.omero-fbi.fr/application/o/userinfo/";
role_attribute_path = "contains(groups, 'project_admins') && 'Admin' || contains(groups, 'project_agent') && 'Editor' || 'Viewer';role_attribute_strict = false";
allow_assign_grafana_admin = true;
};
}; };
}; };
services.prometheus = { services.prometheus = {

1
services/grafana/secrets/grafana-oauth_secret.age Normal file
View file

@ -0,0 +1 @@
S0VJw2OdQPMPNaKwoIS86tm8sGyTOZzauK7h6AhNfeYJiLUtVJgOcIhydxHtBqVPwNE2WagYHEaDjGnS2sJjWMzZNbm1ZjOuorYYRQhpR0w33lAfu4bsU9Lof2JjSvtP