pazpi/nix
1
0
Fork 0
Code Issues 2 Pull requests Projects Releases Packages Wiki Activity Actions

Grafana with authentik

Browse source
This commit is contained in:
pazpi 2025-02-21 17:45:18 +01:00
parent 1efda446f3
commit db350e2445
4 changed files with 49 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

35
modules/monitoring/grafana.nix
View file

@ -23,6 +23,25 @@ in
'';
};
auth = {
enable = lib.mkEnableOption "Enable authentication (Authentik) for Grafana";
baseUrl = lib.mkOption {
default = "https://auth.example.com";
type = lib.types.str;
description = ''
The base URL of the Authentik instance
'';
};
sectetKeyFile = lib.mkOption {
default = "";
type = lib.types.path;
description = ''
Path to the file containing the secret key for Grafana
'';
};
};
proxy = {
enable = lib.mkEnableOption "Set the proxy entry for this service";
@ -63,6 +82,22 @@ in
enable = true;
settings = {
analytics.reporting_enabled = false;
auth = lib.mkIf cfg.auth.enable {
signout_redirect_url = "https://${cfg.auth.baseUrl}/application/o/grafana/end-session/";
disable_login_form = true;
};
"auth.generic_oauth" = {
name = "authentik";
enabled = cfg.auth.enable;
client_id = "GpPQl4K55kQQhIeuIgzN27kzPzSpY5HlpmqpU9sy";
client_secret = "$__file{${cfg.auth.sectetKeyFile}}";
scopes = "openid email profile";
auth_url = "https://${cfg.auth.baseUrl}/application/o/authorize/";
token_url = "https://${cfg.auth.baseUrl}/application/o/token/";
api_url = "https://${cfg.auth.baseUrl}/application/o/userinfo/";
# Optionally map user groups to Grafana roles";
role_attribute_path = "contains(groups, 'Grafana Admins') && 'Admin' || contains(groups, 'Grafana Editors') && 'Editor' || 'Viewer'";
};
database = {
user = "grafana";
type = "postgres";