infrastructure/machines/nixos/compute01/grafana.nix
Tom Hubrecht 200104bf84
Some checks failed
Build all the nodes / web02 (push) Waiting to run
Build all the nodes / web03 (push) Waiting to run
Run pre-commit on all files / pre-commit (push) Waiting to run
Build all the nodes / ap01 (push) Successful in 1m2s
Build all the nodes / bridge01 (push) Successful in 1m35s
Build all the nodes / netcore02 (push) Successful in 39s
Build all the nodes / compute01 (push) Successful in 2m29s
Build all the nodes / geo01 (push) Successful in 1m35s
Build all the nodes / geo02 (push) Successful in 1m30s
Build all the nodes / rescue01 (push) Has been cancelled
Build all the nodes / vault01 (push) Has been cancelled
Build all the nodes / storage01 (push) Has been cancelled
Build all the nodes / web01 (push) Has been cancelled
chore(kanidm): Update origin uris, oauth2 endpoints and switch to 1.4
2024-12-17 00:11:05 +01:00

84 lines
2 KiB
Nix

# SPDX-FileCopyrightText: 2024 Tom Hubrecht <tom.hubrecht@dgnum.eu>
#
# SPDX-License-Identifier: EUPL-1.2
{ config, ... }:
let
host = "grafana.dgnum.eu";
port = 3033;
file = name: "$__file{${config.age.secrets."grafana-${name}_file".path}}";
in
{
services = {
grafana = {
enable = true;
settings = {
"auth.generic_oauth" = {
api_url = "https://sso.dgnum.eu/oauth2/openid/dgn_grafana/userinfo";
auth_url = "https://sso.dgnum.eu/ui/oauth2";
client_id = "dgn_grafana";
client_secret = file "oauth_client_secret";
enabled = true;
id_token_attribute_name = "sub";
login_attribute_path = "preferred_username";
name = "Kanidm";
scopes = "email,openid,profile";
token_url = "https://sso.dgnum.eu/oauth2/token";
use_pkce = true;
};
database = {
type = "postgres";
user = "grafana";
host = "/run/postgresql";
};
security.disable_initial_admin_creation = true;
server = {
domain = host;
enable_gzip = true;
enforce_domain = true;
http_port = port;
root_url = "https://${host}";
router_logging = true;
};
smtp = {
enabled = true;
from_address = "grafana@infra.dgnum.eu";
host = "kurisu.lahfa.xyz:587";
password = file "smtp_password";
user = "web-services@infra.dgnum.eu";
};
users = {
default_theme = "system";
default_language = "en-GB";
auto_assign_org_role = "Admin";
};
};
};
postgresql = {
ensureDatabases = [ "grafana" ];
ensureUsers = [
{
name = "grafana";
ensureDBOwnership = true;
}
];
};
};
dgn-web.simpleProxies.grafana = {
inherit host port;
proxyWebsockets = true;
};
age-secrets.autoMatch = [ "grafana" ];
}