Added SSO to Grafana & Gitea
This commit is contained in:
@@ -36,6 +36,11 @@ in
|
||||
owner = "gitea";
|
||||
group = "gitea";
|
||||
};
|
||||
"kanidm_gitea_secret" = {
|
||||
owner = "gitea";
|
||||
group = "gitea";
|
||||
mode = "0444";
|
||||
};
|
||||
};
|
||||
|
||||
services.postgresql = {
|
||||
|
||||
+24
-95
@@ -21,44 +21,6 @@ let
|
||||
"cyper-node-2" = "192.168.2.31";
|
||||
"cyper-proxy" = "178.254.8.35";
|
||||
};
|
||||
|
||||
mkWeatherScrapeConfigs =
|
||||
cities:
|
||||
map (city: {
|
||||
job_name = "weather_${lib.strings.toLower (lib.strings.replaceStrings [ " " ] [ "_" ] city)}";
|
||||
scrape_interval = "5m";
|
||||
scrape_timeout = "30s";
|
||||
metrics_path = "/${city}";
|
||||
params.format = [ "p1" ];
|
||||
static_configs = [ { targets = [ "wttr.in" ]; } ];
|
||||
scheme = "https";
|
||||
metric_relabel_configs = [
|
||||
{
|
||||
target_label = "location";
|
||||
replacement = city;
|
||||
}
|
||||
];
|
||||
}) cities;
|
||||
|
||||
weatherCities = [
|
||||
# Braunschweig itself
|
||||
"Braunschweig"
|
||||
|
||||
# Immediate surroundings (~15km)
|
||||
"Wolfenbuettel"
|
||||
"Salzgitter"
|
||||
"Peine"
|
||||
"Cremlingen"
|
||||
"Wendeburg"
|
||||
"Sickte"
|
||||
|
||||
# Greater region (~50km)
|
||||
"Wolfsburg"
|
||||
"Gifhorn"
|
||||
"Goslar"
|
||||
"Hildesheim"
|
||||
"Hannover"
|
||||
];
|
||||
in
|
||||
{
|
||||
sops.secrets = {
|
||||
@@ -66,7 +28,10 @@ in
|
||||
owner = "grafana";
|
||||
group = "grafana";
|
||||
};
|
||||
|
||||
kanidm_grafana_secret = {
|
||||
owner = "grafana";
|
||||
group = "grafana";
|
||||
};
|
||||
};
|
||||
|
||||
services = {
|
||||
@@ -83,12 +48,6 @@ in
|
||||
url = "http://127.0.0.1:${toString config.services.prometheus.port}";
|
||||
isDefault = true;
|
||||
}
|
||||
{
|
||||
name = "Loki";
|
||||
type = "loki";
|
||||
url = "http://127.0.0.1:${toString config.services.loki.configuration.server.http_listen_port}";
|
||||
isDefault = false;
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
@@ -97,7 +56,7 @@ in
|
||||
domain = "www.cyperpunk.de"; # serverIP; # "grafana.cyperpunk.de";
|
||||
http_port = 2342;
|
||||
http_addr = "0.0.0.0";
|
||||
root_url = "http://www.cyperpunk.de/grafana/";
|
||||
root_url = "https://www.cyperpunk.de/grafana/";
|
||||
serve_from_sub_path = true;
|
||||
};
|
||||
security = {
|
||||
@@ -106,6 +65,23 @@ in
|
||||
};
|
||||
auth = {
|
||||
disable_login_form = false;
|
||||
oauth_allow_insecure_email_lookup = true;
|
||||
};
|
||||
"auth.generic_oauth" = {
|
||||
enabled = true;
|
||||
name = "Kanidm";
|
||||
client_id = "grafana";
|
||||
client_secret = "$__file{${config.sops.secrets.kanidm_grafana_secret.path}}";
|
||||
scopes = "openid profile email";
|
||||
auth_url = "https://auth.cyperpunk.de/ui/oauth2";
|
||||
token_url = "https://auth.cyperpunk.de/oauth2/token";
|
||||
api_url = "https://auth.cyperpunk.de/oauth2/openid/grafana/userinfo";
|
||||
use_pkce = false;
|
||||
allow_sign_up = true;
|
||||
auto_assign_org = true;
|
||||
auto_assign_org_id = 1;
|
||||
auto_assign_org_role = "Admin";
|
||||
skip_org_role_sync = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
@@ -136,7 +112,7 @@ in
|
||||
{
|
||||
targets = [ "100.109.10.91:9009" ];
|
||||
labels = {
|
||||
instance = config.networking.hostName;
|
||||
instance = "cyper-proxy";
|
||||
job = "master";
|
||||
index = "1";
|
||||
};
|
||||
@@ -166,50 +142,7 @@ in
|
||||
];
|
||||
}
|
||||
]
|
||||
++ (lib.mapAttrsToList mkNodeJob extraNodes)
|
||||
++ (mkWeatherScrapeConfigs weatherCities);
|
||||
};
|
||||
|
||||
loki = {
|
||||
enable = true;
|
||||
configuration = {
|
||||
auth_enabled = false;
|
||||
server.http_listen_port = 3100;
|
||||
ingester = {
|
||||
lifecycler = {
|
||||
address = "127.0.0.1";
|
||||
ring = {
|
||||
kvstore.store = "inmemory";
|
||||
replication_factor = 1;
|
||||
};
|
||||
};
|
||||
chunk_idle_period = "5m";
|
||||
chunk_retain_period = "30s";
|
||||
};
|
||||
schema_config.configs = [
|
||||
{
|
||||
from = "2024-01-01";
|
||||
store = "tsdb";
|
||||
object_store = "filesystem";
|
||||
schema = "v13";
|
||||
index = {
|
||||
prefix = "index_";
|
||||
period = "24h";
|
||||
};
|
||||
}
|
||||
];
|
||||
storage_config = {
|
||||
tsdb_shipper = {
|
||||
active_index_directory = "/var/lib/loki/tsdb-index";
|
||||
cache_location = "/var/lib/loki/tsdb-cache";
|
||||
};
|
||||
filesystem.directory = "/var/lib/loki/chunks";
|
||||
};
|
||||
limits_config = {
|
||||
reject_old_samples = true;
|
||||
reject_old_samples_max_age = "168h";
|
||||
};
|
||||
};
|
||||
++ (lib.mapAttrsToList mkNodeJob extraNodes);
|
||||
};
|
||||
};
|
||||
|
||||
@@ -218,8 +151,4 @@ in
|
||||
9001
|
||||
3100
|
||||
];
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"d /var/loki 0700 loki loki -"
|
||||
];
|
||||
}
|
||||
|
||||
@@ -2,6 +2,7 @@ GROQ_API_KEY: ENC[AES256_GCM,data:OyuC4jfw67sCDa0XBGr78S6pzPV1ruy7KiIqPMgWWcOCVm
|
||||
OPENWEATHER_API_KEY: ENC[AES256_GCM,data:bcuLz70u40nZfNgPTaeNRXdR/zjx0SQjwMbMNNFqROI=,iv:VCzse1a1/k1ZDIpFPL1QhjuS6YaDyohWi61JZaoc0Ws=,tag:UJSNyniNNLfGGRY/uiJcRA==,type:str]
|
||||
smb_passwd: ENC[AES256_GCM,data:+9RYomcnCZSME5DzuJWTLbS3IGJHhIYWZ5SmsgOn6YQ=,iv:VRPVR7DD+swjeUZKe54XYm3wn/KB4RqvQAyYXQbS+A8=,tag:NnA89efo6HVL0scHgyTZMQ==,type:str]
|
||||
grafana_secret_key: ENC[AES256_GCM,data:d6tu4kL7flfbdeOYk21zkSRmVe+NvVwd14jgr9Ds0adfgYetN852G25Z8/g=,iv:uWuwGBZVK1syhEfO9nLZUWwa801759tNJx+Pmnz3xeg=,tag:X6/NcdGZHAdIlOwxNPo/Ew==,type:str]
|
||||
kanidm_grafana_secret: ENC[AES256_GCM,data:rqK3hkpvtg24P4UVV0pFuabUhxoTgtZvK+h8EiSfVyOSrnRy6jtyGvOMMlIOAQDr,iv:I6e++KrpxAFhM8VDQkx8YsrQSvT4brc+Fh1cY5PlwKY=,tag:sEq91Yucb2pUTDbRir+NyA==,type:str]
|
||||
matrix_macaroon_secret: ENC[AES256_GCM,data:a9nMar+p+FXIsxxSqO/to2OJOvD1erfwLwwBeKOcWBu7xykHxqD+pCmrGhg=,iv:rp4ZDVIlZ7SN1RFHB2CfSV5ISPMl9pC4U8Jgqpz48Qs=,tag:LxmWUZE3mG4acagQmlieag==,type:str]
|
||||
matrix_registration_secret: ENC[AES256_GCM,data:KhKkJZqwE8xk4/tuQ7NYTv/Ot1qCAiy8yUbDyVvRa0H5BT4amCBIdATfR4Q=,iv:HBN+GorT1VpWCVkDugk4UxYLEYKJIoDZh2d+oUDLc8g=,tag:hHus458yVnH0qaQ4u37IZg==,type:str]
|
||||
kanidm_synapse_secret: ENC[AES256_GCM,data:F770siYcYLm3RAQ+3epfVTyp5mv0OJfiOdFiHD8CudjceNkkSuXIX7pxQYkhS3VY,iv:hqYMKLS5m+o3leFE0gBS05Npjy9uyqgSe7yJpPzxvQY=,tag:lLjVZ7/iYoIZh06VyF8zSw==,type:str]
|
||||
@@ -15,6 +16,7 @@ coturn_static_auth_secret: ENC[AES256_GCM,data:7AI0E8Hu4WxI5q4j1GqBMSQ+evE006uPM
|
||||
discord_bot_token: ENC[AES256_GCM,data:j37Qo3FCyRwNFqWSWpnQKCs+AxH5HlQ8U5If7ylHilQoORp8Pb3TtNETTJSjZyvUXllldevAbHrbAEEKnNfoUJx1U8/wl6H0,iv:WQqxFXTE+0LIB2lSvVcnr4LNXPE7uzNc0Kk8NU6Z/aE=,tag:fNeQLhoThEgfa4sSGKLZCw==,type:str]
|
||||
discord_client_id: ENC[AES256_GCM,data:U/iUKXT6Nsl6LRN9lPh1xaIaqw==,iv:k7kQ8rJBrMs3YwD9aDfZ6qhd7H3aVsSPTOwEIxVTw2Y=,tag:2wKhxGbf+P+h3BYeWUSczA==,type:str]
|
||||
pg_replication_password: ENC[AES256_GCM,data:w2h07D+j3LNkcbvoKQ2Qp3HSvC2Wf5HRAPAo/HNhmUkHBOaDyILNxo7IDjqajv0jytpG7q4joCJQhS7tEUlA9Q==,iv:26ZurAq61IDqGdAl0yPpoTJElo93hJJIEUlza4DGDNc=,tag:a46FOKgeqEEZE+rC+H9NbQ==,type:str]
|
||||
kanidm_gitea_secret: ENC[AES256_GCM,data:RavtSb5BaJGwwLB/oGzG/KK2AyV+IzEjihVxnD3/dVnxmxcG+CITIYPLvFUJjmvY,iv:Cg8dAhtJXDvRGULIkpWAyuhhlLEdvN+4lyjHPR/740I=,tag:8kMGrOjXEA4GWSLlP7oIkA==,type:str]
|
||||
gitea:
|
||||
dbPassword: ENC[AES256_GCM,data:S6VvRgkdYk1AzXljyQEEq68UJ9zrFy6+INBMIAspXNcqcM6o+es19o0mcXA=,iv:/pHYpkZZq+9Md+75uSCb2YXfSvaDzUh6mMfH53wb7eg=,tag:ZnbyCQwrK2JnbO5HFqgJYw==,type:str]
|
||||
internalToken: ENC[AES256_GCM,data:7N8TkPNb1YdCk2uAcCvVd2pKRVOf85//DYxAvz0UCg1E8ccEI5630xVyKafDFiSTM4ER7xiYelartzXL0jLWSf3QNOjSHUP8TIAz4bJRAZUJPxO917bURSLGGe7WEOfONzqy3Ts5QhrJ,iv:DiIs1ytlwLvqD/Ejep6m2fmpSqdFZkxBcgLNt6+29jY=,tag:8jsEcOkH0p+1mP9cnVjiDQ==,type:str]
|
||||
@@ -33,7 +35,7 @@ sops:
|
||||
N3I5dzUwc3JtYzczMUhyT04vSHlZamMKT+FzYcDLmlEFYxm/XoBpJb8XaZzBH1v9
|
||||
6fuez+zApathZfl14w41kAUojPWBznnxDqYtNvzVVLXwnpp3BMx+7w==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2026-05-15T09:03:17Z"
|
||||
mac: ENC[AES256_GCM,data:1rSwkArJPxLpyatnp+EJDX4//B7aWUScfM5u0XEQlWeKWjHPYxvZ7b2Vvqx8RFJcWp3QgqQf3f+Mp2DmuDdxAuK94XxHIRk3c1bimKeNrCBPZqQkTjJH8tyklrW1Grob7Xi82GXhk96/s0bTzU58uSdvJXGReYraqvnAuitehPY=,iv:JsImUF/7zQCmIRz34LEOJStL2kAqw8QcARE5eHGsGyU=,tag:8CpmWPVozDPTyNwhoZqC9A==,type:str]
|
||||
lastmodified: "2026-05-15T10:39:04Z"
|
||||
mac: ENC[AES256_GCM,data:wXTasAyCQWSX25Npcvg9RewgKZqRlbAtI0Mk1XXLsuvgMoLVCDQWM0VVA4IDp0SUMzU3iocP4FKjhtNve054DT6a/Fcv3laY7dMLrgdJEvGfwsR0kNtIYsTFb5vVF3+h1Za18/9S9M7UINL38Bhwa56O8jnShZpwxe3y9XqMGQ4=,iv:t4ekytZ6dy6QeWcOSho877yK/DFYYFfCi/bHHezrAIc=,tag:HZaE3bWZe+9OtZsVmb52+Q==,type:str]
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.12.2
|
||||
|
||||
Reference in New Issue
Block a user