Torjus Håkestad
030e8518c5
Some checks failed
Run nix flake check / flake-check (push) Failing after 4m3s
Deploy Grafana test instance on monitoring02 with: - Kanidm OIDC authentication (admins -> Admin role, others -> Viewer) - PKCE enabled for secure OAuth2 flow (required by Kanidm) - Declarative datasources for Prometheus and Loki on monitoring01 - Local Caddy for TLS termination via internal ACME CA - DNS CNAME grafana-test.home.2rjus.net Terraform changes add OAuth2 client secret and AppRole policies for kanidm01 and monitoring02. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
99 lines
2.7 KiB
Nix
99 lines
2.7 KiB
Nix
{ config, pkgs, ... }:
|
|
{
|
|
services.grafana = {
|
|
enable = true;
|
|
settings = {
|
|
server = {
|
|
http_addr = "127.0.0.1";
|
|
http_port = 3000;
|
|
domain = "grafana-test.home.2rjus.net";
|
|
root_url = "https://grafana-test.home.2rjus.net/";
|
|
};
|
|
|
|
# Disable anonymous access
|
|
"auth.anonymous".enabled = false;
|
|
|
|
# OIDC authentication via Kanidm
|
|
"auth.generic_oauth" = {
|
|
enabled = true;
|
|
name = "Kanidm";
|
|
client_id = "grafana";
|
|
client_secret = "$__file{/run/secrets/grafana-oauth2}";
|
|
auth_url = "https://auth.home.2rjus.net/ui/oauth2";
|
|
token_url = "https://auth.home.2rjus.net/oauth2/token";
|
|
api_url = "https://auth.home.2rjus.net/oauth2/openid/grafana/userinfo";
|
|
scopes = "openid profile email groups";
|
|
use_pkce = true; # Required by Kanidm, more secure
|
|
# Extract user attributes from userinfo response
|
|
email_attribute_path = "email";
|
|
login_attribute_path = "preferred_username";
|
|
name_attribute_path = "name";
|
|
# Map admins group to Admin role, everyone else to Viewer
|
|
role_attribute_path = "contains(groups[*], 'admins') && 'Admin' || 'Viewer'";
|
|
allow_sign_up = true;
|
|
};
|
|
};
|
|
|
|
# Declarative datasources pointing to monitoring01
|
|
provision.datasources.settings = {
|
|
apiVersion = 1;
|
|
datasources = [
|
|
{
|
|
name = "Prometheus";
|
|
type = "prometheus";
|
|
url = "http://monitoring01.home.2rjus.net:9090";
|
|
isDefault = true;
|
|
uid = "prometheus";
|
|
}
|
|
{
|
|
name = "Loki";
|
|
type = "loki";
|
|
url = "http://monitoring01.home.2rjus.net:3100";
|
|
uid = "loki";
|
|
}
|
|
];
|
|
};
|
|
};
|
|
|
|
# Vault secret for OAuth2 client secret
|
|
vault.secrets.grafana-oauth2 = {
|
|
secretPath = "services/grafana/oauth2-client-secret";
|
|
extractKey = "password";
|
|
services = [ "grafana" ];
|
|
owner = "grafana";
|
|
group = "grafana";
|
|
};
|
|
|
|
# Local Caddy for TLS termination
|
|
services.caddy = {
|
|
enable = true;
|
|
package = pkgs.unstable.caddy;
|
|
configFile = pkgs.writeText "Caddyfile" ''
|
|
{
|
|
acme_ca https://vault.home.2rjus.net:8200/v1/pki_int/acme/directory
|
|
metrics
|
|
}
|
|
|
|
grafana-test.home.2rjus.net {
|
|
log {
|
|
output file /var/log/caddy/grafana.log {
|
|
mode 644
|
|
}
|
|
}
|
|
|
|
reverse_proxy http://127.0.0.1:3000
|
|
}
|
|
|
|
http://${config.networking.hostName}.home.2rjus.net/metrics {
|
|
metrics
|
|
}
|
|
'';
|
|
};
|
|
|
|
# Expose Caddy metrics for Prometheus
|
|
homelab.monitoring.scrapeTargets = [{
|
|
job_name = "caddy";
|
|
port = 80;
|
|
}];
|
|
}
|