noah/dotfiles
1
0
Fork 0
mirror of https://github.com/nmasur/dotfiles synced 2026-09-08 14:46:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(grafana): allow oauth email lookup to match existing user

Browse Source
This commit is contained in:
Noah Masur
2026-09-06 18:04:46 +00:00
parent ca1343f593
commit 2a3cbfb5f5
3 changed files with 23 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/CHANGELOG.md
+5
View File
@@ -102,6 +102,11 @@
to bind, the failure took down the entire terminal instead of erroring to bind, the failure took down the entire terminal instead of erroring
gracefully. gracefully.
## 2026-09-06
- Configured Grafana OIDC authentication via Pocket ID in `platforms/nixos/modules/nmasur/presets/services/grafana/grafana.nix`.
- Enabled `auth.oauth_allow_insecure_email_lookup = true` in Grafana settings to allow linking an incoming OAuth login to an existing Grafana user account with the same email.
## 2026-07-25 ## 2026-07-25
- Added jjui config generation to `jujutsu.nix` in Home Manager to include custom GitHub ruleset bypass commands (`ctrl+b` and `ctrl+shift+b`). - Added jjui config generation to `jujutsu.nix` in Home Manager to include custom GitHub ruleset bypass commands (`ctrl+b` and `ctrl+shift+b`).
docs/oidc-services.md
+15 -12
View File
@@ -135,18 +135,21 @@ All client secrets should be encrypted with `agenix` under the respective servic
- **Pocket ID Redirect URI:** `https://metrics.masu.rs/login/generic_oauth` - **Pocket ID Redirect URI:** `https://metrics.masu.rs/login/generic_oauth`
- **Setup in `grafana/grafana.nix`:** - **Setup in `grafana/grafana.nix`:**
```nix ```nix
services.grafana.settings."auth.generic_oauth" = { services.grafana.settings = {
enabled = true; auth.oauth_allow_insecure_email_lookup = true;
name = "Pocket ID"; "auth.generic_oauth" = {
allow_sign_up = true; enabled = true;
client_id = "85d879ed-1a86-4984-b33d-43806500ef98"; name = "Pocket ID";
client_secret = "$__file{${config.secrets.grafana-oidc-secret.dest}}"; allow_sign_up = true;
scopes = "openid profile email"; client_id = "85d879ed-1a86-4984-b33d-43806500ef98";
auth_url = "https://${hostnames.auth}/authorize"; client_secret = "$__file{${config.secrets.grafana-oidc-secret.dest}}";
token_url = "https://${hostnames.auth}/api/oidc/token"; scopes = "openid profile email";
api_url = "https://${hostnames.auth}/api/oidc/userinfo"; auth_url = "https://${hostnames.auth}/authorize";
login_attribute_path = "preferred_username"; token_url = "https://${hostnames.auth}/api/oidc/token";
skip_org_role_sync = true; api_url = "https://${hostnames.auth}/api/oidc/userinfo";
login_attribute_path = "preferred_username";
skip_org_role_sync = true;
};
}; };
``` ```
platforms/nixos/modules/nmasur/presets/services/grafana/grafana.nix
+3
View File
@@ -56,6 +56,9 @@ in
enable = true; enable = true;
settings = { settings = {
security.secret_key = "$__file{${config.secrets.grafana-secret-key.dest}}"; security.secret_key = "$__file{${config.secrets.grafana-secret-key.dest}}";
auth = {
oauth_allow_insecure_email_lookup = true;
};
server = { server = {
domain = hostnames.metrics; domain = hostnames.metrics;
http_addr = "127.0.0.1"; http_addr = "127.0.0.1";