configure grafana for oidc

platforms/nixos/modules/nmasur/presets/services/grafana/grafana-oidc-secret.age

@@ -0,0 +1,17 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE1nSGFPdyBmRTZ2
+Q0pxZ2ZOZ21HcG9EWHJOR0FZbU5UeWFTQXZwRCtKK2hXWDZsQVJzCjh1MURnU0dr
+MERUWGVETHFZZjhiZnJsMVlqTDdSNnZwbDNQNFRCRDZuQ3MKLT4gc3NoLWVkMjU1
+MTkgWXlTVU1RIFl0V3Jac3IydVJDOVI3c3lscWZiQzU4TG1tYlNZSWZHbmtSakRl
+bGhVbk0KNzNFZDFXM3FhWkNWbUliRG00dGN3WjNxZktCT2RPd2FUbi9nS1NobEtQ
+cwotPiBzc2gtZWQyNTUxOSBuanZYNUEga29CZkplcC9yN25JU0lNakQxSW92UFBz
+bCtHQUNPd0FBdzVMaEhRVjJoWQpmV2xsWFcwU0o0SlljbjEzY2dPT0VlazVhZ3h3
+bDEwNzRGUWdJM0Y3UDhvCi0+IHNzaC1lZDI1NTE5IENxSU9VQSBzVWhPT01tSmZh
+UlpDb0ltZGdiRXRkVTFEQW45Tk5PMDVqdFczRTBlQ0hVCm1OOEJDNEN4K1lFZU1r
+cU1ENVRqM3BLV3lVTzRpOUhjbVFCU0t4Q0owR28KLT4gc3NoLWVkMjU1MTkgejFP
+Y1p3IFRTU1FBa2d2ZGRCc0JuanRpbEE2OU53M1htOGhJT1hoM0s5R2Rqbk1FMXcK
+SE1qbjFid1ZnUmljUDBlMU4yTlU0bWlOenhFN3Bkd3BSS3NIYStQNHFHYwotLS0g
+c2ZwZjNGaTQxVVBKUC9keTZhOGtxRHA0MkpmRkNwUGFjMlFXVnM0Y0VTWQpi8R/5
+BRFSxYiEYeB54XjyVXRcyct94jH4wentMOYUFcZP+kd3dwKnXdtrqZDlCk3eM9sy
+xzOoHpd8BhmmRK9hgw==
+-----END AGE ENCRYPTED FILE-----

platforms/nixos/modules/nmasur/presets/services/grafana/grafana.nix

@@ -29,13 +29,25 @@ in
     };
 
     secrets.grafana-secret-key = {
-             source = ./grafana-secret-key.age;
+      source = ./grafana-secret-key.age;
       dest = "${config.secretsDirectory}/grafana-secret-key";
       owner = "grafana";
       group = "grafana";
       permissions = "0440";
     };
-    systemd.services.grafana-secret-key-secret  = {
+    systemd.services.grafana-secret-key-secret = {
+      requiredBy = [ "grafana.service" ];
+      before = [ "grafana.service" ];
+    };
+
+    secrets.grafana-oidc-secret = {
+      source = ./grafana-oidc-secret.age;
+      dest = "${config.secretsDirectory}/grafana-oidc-secret";
+      owner = "grafana";
+      group = "grafana";
+      permissions = "0440";
+    };
+    systemd.services.grafana-oidc-secret-secret = {
       requiredBy = [ "grafana.service" ];
       before = [ "grafana.service" ];
     };
@@ -49,6 +61,7 @@ in
           http_addr = "127.0.0.1";
           http_port = 3000;
           protocol = "http";
+          root_url = "https://${hostnames.metrics}/";
         };
         smtp = rec {
           enabled = true;
@@ -58,6 +71,19 @@ in
           from_name = "Grafana";
           from_address = user;
         };
+        "auth.generic_oauth" = {
+          enabled = true;
+          name = "Pocket ID";
+          allow_sign_up = true;
+          client_id = "85d879ed-1a86-4984-b33d-43806500ef98";
+          client_secret = "$__file{${config.secrets.grafana-oidc-secret.dest}}";
+          scopes = "openid profile email";
+          auth_url = "https://${hostnames.auth}/authorize";
+          token_url = "https://${hostnames.auth}/api/oidc/token";
+          api_url = "https://${hostnames.auth}/api/oidc/userinfo";
+          login_attribute_path = "preferred_username";
+          skip_org_role_sync = true;
+        };
       };
       provision = {
         enable = true;