mirrors_public/oddlama_nix-config
1
1
Fork 1
mirror of https://github.com/oddlama/nix-config.git synced 2025-10-11 07:10:39 +02:00
Code Activity

chore: disable auto login on oauth2-proxy and grafana (better for sign-out)

Browse source
This commit is contained in:
oddlama 2023-06-23 23:27:34 +02:00
parent ccd62a730a
commit df2e046295
No known key found for this signature in database
GPG key ID: 14EFE510775FE39A
4 changed files with 15 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

12
hosts/ward/microvms/grafana/default.nix
View file

@ -64,8 +64,6 @@ in {
virtualHosts.${grafanaDomain} = {
forceSSL = true;
useACMEHost = sentinelCfg.lib.extra.matchingWildcardCert grafanaDomain;
oauth2.enable = true;
oauth2.allowedGroups = ["access_grafana"];
locations."/" = {
proxyPass = "http://grafana";
proxyWebsockets = true;
@ -103,7 +101,7 @@ in {
name = "Kanidm";
icon = "signin";
allow_sign_up = true;
auto_login = true;
#auto_login = true;
client_id = "grafana";
#client_secret = "$__file{${config.age.secrets.grafana-oauth-client-secret.path}}";
client_secret = "aZKNCM6KpjBy4RqwKJXMLXzyx9rKH6MZTFk4wYrKWuBqLj6t"; # TODO temporary test not a real secret
@ -122,12 +120,6 @@ in {
provision = {
enable = true;
datasources.settings.datasources = [
#{
# name = "Prometheus";
# type = "prometheus";
# url = "http://127.0.0.1:9090";
# orgId = 1;
#}
{
name = "InfluxDB";
type = "influxdb";
@ -137,6 +129,8 @@ in {
basicAuth = true;
basicAuthUser = "${nodeName}+grafana-influxdb-basic-auth-password";
secureJsonData.basicAuthPassword = "$__file{${config.age.secrets.grafana-influxdb-basic-auth-password.path}}";
#secureJsonData.token = "$__file{${config.age.secrets.grafana-influxdb-token.path}}";
jsonData.version = "Flux";
}
{
name = "Loki";

16
hosts/ward/microvms/influxdb/default.nix
View file

@ -9,6 +9,8 @@
influxdbDomain = "influxdb.${sentinelCfg.repo.secrets.local.personalDomain}";
influxdbPort = 8086;
in {
microvm.mem = 1024;
imports = [
../../../../modules/proxy-via-sentinel.nix
];
@ -45,23 +47,15 @@ in {
virtualHosts.${influxdbDomain} = {
forceSSL = true;
useACMEHost = sentinelCfg.lib.extra.matchingWildcardCert influxdbDomain;
oauth2.enable = true;
oauth2.allowedGroups = ["access_influxdb"];
locations."/" = {
proxyPass = "http://influxdb";
proxyWebsockets = true;
extraConfig = ''
satisfy any;
auth_basic "Authentication required";
auth_basic_user_file ${sentinelCfg.age.secrets.influxdb-basic-auth-hashes.path};
proxy_read_timeout 1800s;
proxy_connect_timeout 1600s;
access_log off;
'';
};
locations."= /ready" = {
proxyPass = "http://influxdb";
extraConfig = ''
auth_basic off;
access_log off;
'';
};