diff --git a/nixos/modules/monitoring/server/grafana.nix b/nixos/modules/monitoring/server/grafana.nix index 8cce63e0725f8142d3f9b6e3cafc647c04413ae5..7ce9eaef664beed48cd13644f1915c6fd088b3e9 100644 --- a/nixos/modules/monitoring/server/grafana.nix +++ b/nixos/modules/monitoring/server/grafana.nix @@ -7,16 +7,6 @@ let cfg = config.services.private-storage.monitoring.grafana; - grafanaAuth = if (cfg.googleOAuthClientID == "") then { - anonymous.enable = true; - } else { - google.enable = true; - # Grafana considers it "sign up" to let in a user it has - # never seen before. - google.allowSignUp = true; - google.clientSecretFile = cfg.googleOAuthClientSecretFile; - google.clientId = cfg.googleOAuthClientID; - }; in { @@ -93,35 +83,52 @@ in { enable = true; settings = { - server.domain = "${toString domain}"; - server.http_port = 2342; - server.http_addr = "127.0.0.1"; - }; - # No phoning home - settings.analytics.reporting_enabled = false; + server = { + domain = "${toString domain}"; + http_port = 2342; + http_addr = "127.0.0.1"; - # Force Grafana to believe it is reachable via https on the default port - # number because that's where the nginx that forwards traffic to it is - # listening. Grafana's own server listens on an internal address that - # doesn't matter to anyone except our nginx instance. - settings.server.root_url = "https://%(domain)s/"; + # Defend against DNS rebinding attacks. + enforce_domain = true; - # Defend against DNS rebinding attacks. - settings.server.enforce_domain = true; - # Same time zone for all users by default - settings.date_formats.default_timezone = "UTC"; + # Force Grafana to believe it is reachable via https on the default port + # number because that's where the nginx that forwards traffic to it is + # listening. Grafana's own server listens on an internal address that + # doesn't matter to anyone except our nginx instance. + root_url = "https://%(domain)s/"; + }; - auth = { - anonymous.org_role = "Admin"; - anonymous.org_name = "Main Org."; - } // grafanaAuth; + # No phoning home + analytics.reporting_enabled = false; - # Give users that come through GSuite SSO the highest possible privileges: - settings.users.auto_assign_org_role = "Editor"; + # Same time zone for all users by default + date_formats.default_timezone = "UTC"; - # Read the admin password from a file in our secrets folder: - settings.security.admin_password = "$__file{${toString cfg.adminPasswordFile}}"; + # The auth sections since NixOS 22.11 are named a bit funky with a dot in the name + # + # https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/grafana/#anonymous-authentication + # https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/google/ + "auth.anonymous" = lib.mkIf (cfg.googleOAuthClientID == "") { + enabled = true; + org_role = "Admin"; + org_name = "Main Org."; + }; + "auth.google" = lib.mkIf (cfg.googleOAuthClientID != "") { + enabled = true; + # Grafana considers it "sign up" to let in a user it has + # never seen before. + allowSignUp = true; + clientSecretFile = cfg.googleOAuthClientSecretFile; + clientId = cfg.googleOAuthClientID; + }; + + # Give users that come through GSuite SSO the highest possible privileges: + users.auto_assign_org_role = "Editor"; + + # Read the admin password from a file in our secrets folder: + security.admin_password = "$__file{${toString cfg.adminPasswordFile}}"; + }; provision = { enable = true;