Added SSO to Grafana & Gitea

nixos/roles/gitea.nix

@@ -36,6 +36,11 @@ in
       owner = "gitea";
       group = "gitea";
     };
+    "kanidm_gitea_secret" = {
+      owner = "gitea";
+      group = "gitea";
+      mode = "0444";
+    };
   };
 
   services.postgresql = {

nixos/roles/monitoring.nix

@@ -21,44 +21,6 @@ let
     "cyper-node-2" = "192.168.2.31";
     "cyper-proxy" = "178.254.8.35";
   };
-
-  mkWeatherScrapeConfigs =
-    cities:
-    map (city: {
-      job_name = "weather_${lib.strings.toLower (lib.strings.replaceStrings [ " " ] [ "_" ] city)}";
-      scrape_interval = "5m";
-      scrape_timeout = "30s";
-      metrics_path = "/${city}";
-      params.format = [ "p1" ];
-      static_configs = [ { targets = [ "wttr.in" ]; } ];
-      scheme = "https";
-      metric_relabel_configs = [
-        {
-          target_label = "location";
-          replacement = city;
-        }
-      ];
-    }) cities;
-
-  weatherCities = [
-    # Braunschweig itself
-    "Braunschweig"
-
-    # Immediate surroundings (~15km)
-    "Wolfenbuettel"
-    "Salzgitter"
-    "Peine"
-    "Cremlingen"
-    "Wendeburg"
-    "Sickte"
-
-    # Greater region (~50km)
-    "Wolfsburg"
-    "Gifhorn"
-    "Goslar"
-    "Hildesheim"
-    "Hannover"
-  ];
 in
 {
   sops.secrets = {
@@ -66,7 +28,10 @@ in
       owner = "grafana";
       group = "grafana";
     };
-
+    kanidm_grafana_secret = {
+      owner = "grafana";
+      group = "grafana";
+    };
   };
 
   services = {
@@ -83,12 +48,6 @@ in
               url = "http://127.0.0.1:${toString config.services.prometheus.port}";
               isDefault = true;
             }
-            {
-              name = "Loki";
-              type = "loki";
-              url = "http://127.0.0.1:${toString config.services.loki.configuration.server.http_listen_port}";
-              isDefault = false;
-            }
           ];
         };
       };
@@ -97,7 +56,7 @@ in
           domain = "www.cyperpunk.de"; # serverIP; # "grafana.cyperpunk.de";
           http_port = 2342;
           http_addr = "0.0.0.0";
-          root_url = "http://www.cyperpunk.de/grafana/";
+          root_url = "https://www.cyperpunk.de/grafana/";
           serve_from_sub_path = true;
         };
         security = {
@@ -106,6 +65,23 @@ in
         };
         auth = {
           disable_login_form = false;
+          oauth_allow_insecure_email_lookup = true;
+        };
+        "auth.generic_oauth" = {
+          enabled = true;
+          name = "Kanidm";
+          client_id = "grafana";
+          client_secret = "$__file{${config.sops.secrets.kanidm_grafana_secret.path}}";
+          scopes = "openid profile email";
+          auth_url = "https://auth.cyperpunk.de/ui/oauth2";
+          token_url = "https://auth.cyperpunk.de/oauth2/token";
+          api_url = "https://auth.cyperpunk.de/oauth2/openid/grafana/userinfo";
+          use_pkce = false;
+          allow_sign_up = true;
+          auto_assign_org = true;
+          auto_assign_org_id = 1;
+          auto_assign_org_role = "Admin";
+          skip_org_role_sync = true;
         };
       };
     };
@@ -136,7 +112,7 @@ in
             {
               targets = [ "100.109.10.91:9009" ];
               labels = {
-                instance = config.networking.hostName;
+                instance = "cyper-proxy";
                 job = "master";
                 index = "1";
               };
@@ -166,50 +142,7 @@ in
           ];
         }
       ]
-      ++ (lib.mapAttrsToList mkNodeJob extraNodes)
+      ++ (lib.mapAttrsToList mkNodeJob extraNodes);
-      ++ (mkWeatherScrapeConfigs weatherCities);
-    };
-
-    loki = {
-      enable = true;
-      configuration = {
-        auth_enabled = false;
-        server.http_listen_port = 3100;
-        ingester = {
-          lifecycler = {
-            address = "127.0.0.1";
-            ring = {
-              kvstore.store = "inmemory";
-              replication_factor = 1;
-            };
-          };
-          chunk_idle_period = "5m";
-          chunk_retain_period = "30s";
-        };
-        schema_config.configs = [
-          {
-            from = "2024-01-01";
-            store = "tsdb";
-            object_store = "filesystem";
-            schema = "v13";
-            index = {
-              prefix = "index_";
-              period = "24h";
-            };
-          }
-        ];
-        storage_config = {
-          tsdb_shipper = {
-            active_index_directory = "/var/lib/loki/tsdb-index";
-            cache_location = "/var/lib/loki/tsdb-cache";
-          };
-          filesystem.directory = "/var/lib/loki/chunks";
-        };
-        limits_config = {
-          reject_old_samples = true;
-          reject_old_samples_max_age = "168h";
-        };
-      };
     };
   };
 
@@ -218,8 +151,4 @@ in
     9001
     3100
   ];
-
-  systemd.tmpfiles.rules = [
-    "d /var/loki 0700 loki loki -"
-  ];
 }

secrets/secrets.yaml

@@ -2,6 +2,7 @@ GROQ_API_KEY: ENC[AES256_GCM,data:OyuC4jfw67sCDa0XBGr78S6pzPV1ruy7KiIqPMgWWcOCVm
 OPENWEATHER_API_KEY: ENC[AES256_GCM,data:bcuLz70u40nZfNgPTaeNRXdR/zjx0SQjwMbMNNFqROI=,iv:VCzse1a1/k1ZDIpFPL1QhjuS6YaDyohWi61JZaoc0Ws=,tag:UJSNyniNNLfGGRY/uiJcRA==,type:str]
 smb_passwd: ENC[AES256_GCM,data:+9RYomcnCZSME5DzuJWTLbS3IGJHhIYWZ5SmsgOn6YQ=,iv:VRPVR7DD+swjeUZKe54XYm3wn/KB4RqvQAyYXQbS+A8=,tag:NnA89efo6HVL0scHgyTZMQ==,type:str]
 grafana_secret_key: ENC[AES256_GCM,data:d6tu4kL7flfbdeOYk21zkSRmVe+NvVwd14jgr9Ds0adfgYetN852G25Z8/g=,iv:uWuwGBZVK1syhEfO9nLZUWwa801759tNJx+Pmnz3xeg=,tag:X6/NcdGZHAdIlOwxNPo/Ew==,type:str]
+kanidm_grafana_secret: ENC[AES256_GCM,data:rqK3hkpvtg24P4UVV0pFuabUhxoTgtZvK+h8EiSfVyOSrnRy6jtyGvOMMlIOAQDr,iv:I6e++KrpxAFhM8VDQkx8YsrQSvT4brc+Fh1cY5PlwKY=,tag:sEq91Yucb2pUTDbRir+NyA==,type:str]
 matrix_macaroon_secret: ENC[AES256_GCM,data:a9nMar+p+FXIsxxSqO/to2OJOvD1erfwLwwBeKOcWBu7xykHxqD+pCmrGhg=,iv:rp4ZDVIlZ7SN1RFHB2CfSV5ISPMl9pC4U8Jgqpz48Qs=,tag:LxmWUZE3mG4acagQmlieag==,type:str]
 matrix_registration_secret: ENC[AES256_GCM,data:KhKkJZqwE8xk4/tuQ7NYTv/Ot1qCAiy8yUbDyVvRa0H5BT4amCBIdATfR4Q=,iv:HBN+GorT1VpWCVkDugk4UxYLEYKJIoDZh2d+oUDLc8g=,tag:hHus458yVnH0qaQ4u37IZg==,type:str]
 kanidm_synapse_secret: ENC[AES256_GCM,data:F770siYcYLm3RAQ+3epfVTyp5mv0OJfiOdFiHD8CudjceNkkSuXIX7pxQYkhS3VY,iv:hqYMKLS5m+o3leFE0gBS05Npjy9uyqgSe7yJpPzxvQY=,tag:lLjVZ7/iYoIZh06VyF8zSw==,type:str]
@@ -15,6 +16,7 @@ coturn_static_auth_secret: ENC[AES256_GCM,data:7AI0E8Hu4WxI5q4j1GqBMSQ+evE006uPM
 discord_bot_token: ENC[AES256_GCM,data:j37Qo3FCyRwNFqWSWpnQKCs+AxH5HlQ8U5If7ylHilQoORp8Pb3TtNETTJSjZyvUXllldevAbHrbAEEKnNfoUJx1U8/wl6H0,iv:WQqxFXTE+0LIB2lSvVcnr4LNXPE7uzNc0Kk8NU6Z/aE=,tag:fNeQLhoThEgfa4sSGKLZCw==,type:str]
 discord_client_id: ENC[AES256_GCM,data:U/iUKXT6Nsl6LRN9lPh1xaIaqw==,iv:k7kQ8rJBrMs3YwD9aDfZ6qhd7H3aVsSPTOwEIxVTw2Y=,tag:2wKhxGbf+P+h3BYeWUSczA==,type:str]
 pg_replication_password: ENC[AES256_GCM,data:w2h07D+j3LNkcbvoKQ2Qp3HSvC2Wf5HRAPAo/HNhmUkHBOaDyILNxo7IDjqajv0jytpG7q4joCJQhS7tEUlA9Q==,iv:26ZurAq61IDqGdAl0yPpoTJElo93hJJIEUlza4DGDNc=,tag:a46FOKgeqEEZE+rC+H9NbQ==,type:str]
+kanidm_gitea_secret: ENC[AES256_GCM,data:RavtSb5BaJGwwLB/oGzG/KK2AyV+IzEjihVxnD3/dVnxmxcG+CITIYPLvFUJjmvY,iv:Cg8dAhtJXDvRGULIkpWAyuhhlLEdvN+4lyjHPR/740I=,tag:8kMGrOjXEA4GWSLlP7oIkA==,type:str]
 gitea:
     dbPassword: ENC[AES256_GCM,data:S6VvRgkdYk1AzXljyQEEq68UJ9zrFy6+INBMIAspXNcqcM6o+es19o0mcXA=,iv:/pHYpkZZq+9Md+75uSCb2YXfSvaDzUh6mMfH53wb7eg=,tag:ZnbyCQwrK2JnbO5HFqgJYw==,type:str]
     internalToken: ENC[AES256_GCM,data:7N8TkPNb1YdCk2uAcCvVd2pKRVOf85//DYxAvz0UCg1E8ccEI5630xVyKafDFiSTM4ER7xiYelartzXL0jLWSf3QNOjSHUP8TIAz4bJRAZUJPxO917bURSLGGe7WEOfONzqy3Ts5QhrJ,iv:DiIs1ytlwLvqD/Ejep6m2fmpSqdFZkxBcgLNt6+29jY=,tag:8jsEcOkH0p+1mP9cnVjiDQ==,type:str]
@@ -33,7 +35,7 @@ sops:
             N3I5dzUwc3JtYzczMUhyT04vSHlZamMKT+FzYcDLmlEFYxm/XoBpJb8XaZzBH1v9
             6fuez+zApathZfl14w41kAUojPWBznnxDqYtNvzVVLXwnpp3BMx+7w==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-05-15T09:03:17Z"
+    lastmodified: "2026-05-15T10:39:04Z"
-    mac: ENC[AES256_GCM,data:1rSwkArJPxLpyatnp+EJDX4//B7aWUScfM5u0XEQlWeKWjHPYxvZ7b2Vvqx8RFJcWp3QgqQf3f+Mp2DmuDdxAuK94XxHIRk3c1bimKeNrCBPZqQkTjJH8tyklrW1Grob7Xi82GXhk96/s0bTzU58uSdvJXGReYraqvnAuitehPY=,iv:JsImUF/7zQCmIRz34LEOJStL2kAqw8QcARE5eHGsGyU=,tag:8CpmWPVozDPTyNwhoZqC9A==,type:str]
+    mac: ENC[AES256_GCM,data:wXTasAyCQWSX25Npcvg9RewgKZqRlbAtI0Mk1XXLsuvgMoLVCDQWM0VVA4IDp0SUMzU3iocP4FKjhtNve054DT6a/Fcv3laY7dMLrgdJEvGfwsR0kNtIYsTFb5vVF3+h1Za18/9S9M7UINL38Bhwa56O8jnShZpwxe3y9XqMGQ4=,iv:t4ekytZ6dy6QeWcOSho877yK/DFYYFfCi/bHHezrAIc=,tag:HZaE3bWZe+9OtZsVmb52+Q==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.12.2