configure grafana for oidc

docs/oidc-services.md

@@ -139,12 +139,14 @@ All client secrets should be encrypted with `agenix` under the respective servic
     enabled = true;
     name = "Pocket ID";
     allow_sign_up = true;
-    client_id = "grafana";
+    client_id = "85d879ed-1a86-4984-b33d-43806500ef98";
     client_secret = "$__file{${config.secrets.grafana-oidc-secret.dest}}";
     scopes = "openid profile email";
-    auth_url = "https://auth.masu.rs/authorize";
+    auth_url = "https://${hostnames.auth}/authorize";
-    token_url = "https://auth.masu.rs/api/oidc/token";
+    token_url = "https://${hostnames.auth}/api/oidc/token";
-    api_url = "https://auth.masu.rs/api/oidc/userinfo";
+    api_url = "https://${hostnames.auth}/api/oidc/userinfo";
+    login_attribute_path = "preferred_username";
+    skip_org_role_sync = true;
   };
   ```
 

platforms/nixos/modules/nmasur/presets/services/grafana/grafana-oidc-secret.age

@@ -0,0 +1,17 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE1nSGFPdyBmRTZ2
+Q0pxZ2ZOZ21HcG9EWHJOR0FZbU5UeWFTQXZwRCtKK2hXWDZsQVJzCjh1MURnU0dr
+MERUWGVETHFZZjhiZnJsMVlqTDdSNnZwbDNQNFRCRDZuQ3MKLT4gc3NoLWVkMjU1
+MTkgWXlTVU1RIFl0V3Jac3IydVJDOVI3c3lscWZiQzU4TG1tYlNZSWZHbmtSakRl
+bGhVbk0KNzNFZDFXM3FhWkNWbUliRG00dGN3WjNxZktCT2RPd2FUbi9nS1NobEtQ
+cwotPiBzc2gtZWQyNTUxOSBuanZYNUEga29CZkplcC9yN25JU0lNakQxSW92UFBz
+bCtHQUNPd0FBdzVMaEhRVjJoWQpmV2xsWFcwU0o0SlljbjEzY2dPT0VlazVhZ3h3
+bDEwNzRGUWdJM0Y3UDhvCi0+IHNzaC1lZDI1NTE5IENxSU9VQSBzVWhPT01tSmZh
+UlpDb0ltZGdiRXRkVTFEQW45Tk5PMDVqdFczRTBlQ0hVCm1OOEJDNEN4K1lFZU1r
+cU1ENVRqM3BLV3lVTzRpOUhjbVFCU0t4Q0owR28KLT4gc3NoLWVkMjU1MTkgejFP
+Y1p3IFRTU1FBa2d2ZGRCc0JuanRpbEE2OU53M1htOGhJT1hoM0s5R2Rqbk1FMXcK
+SE1qbjFid1ZnUmljUDBlMU4yTlU0bWlOenhFN3Bkd3BSS3NIYStQNHFHYwotLS0g
+c2ZwZjNGaTQxVVBKUC9keTZhOGtxRHA0MkpmRkNwUGFjMlFXVnM0Y0VTWQpi8R/5
+BRFSxYiEYeB54XjyVXRcyct94jH4wentMOYUFcZP+kd3dwKnXdtrqZDlCk3eM9sy
+xzOoHpd8BhmmRK9hgw==
+-----END AGE ENCRYPTED FILE-----

platforms/nixos/modules/nmasur/presets/services/grafana/grafana.nix

@@ -40,6 +40,18 @@ in
       before = [ "grafana.service" ];
     };
 
+    secrets.grafana-oidc-secret = {
+      source = ./grafana-oidc-secret.age;
+      dest = "${config.secretsDirectory}/grafana-oidc-secret";
+      owner = "grafana";
+      group = "grafana";
+      permissions = "0440";
+    };
+    systemd.services.grafana-oidc-secret-secret = {
+      requiredBy = [ "grafana.service" ];
+      before = [ "grafana.service" ];
+    };
+
     services.grafana = {
       enable = true;
       settings = {
@@ -49,6 +61,7 @@ in
           http_addr = "127.0.0.1";
           http_port = 3000;
           protocol = "http";
+          root_url = "https://${hostnames.metrics}/";
         };
         smtp = rec {
           enabled = true;
@@ -58,6 +71,19 @@ in
           from_name = "Grafana";
           from_address = user;
         };
+        "auth.generic_oauth" = {
+          enabled = true;
+          name = "Pocket ID";
+          allow_sign_up = true;
+          client_id = "85d879ed-1a86-4984-b33d-43806500ef98";
+          client_secret = "$__file{${config.secrets.grafana-oidc-secret.dest}}";
+          scopes = "openid profile email";
+          auth_url = "https://${hostnames.auth}/authorize";
+          token_url = "https://${hostnames.auth}/api/oidc/token";
+          api_url = "https://${hostnames.auth}/api/oidc/userinfo";
+          login_attribute_path = "preferred_username";
+          skip_org_role_sync = true;
+        };
       };
       provision = {
         enable = true;