commit a7cc4e9da15538085ae617919cf8f3ff8c3acf09
author TheCodedProf <coded@clicks.codes> Tue Oct 10 19:29:06 2023 -0400
committer Skyler Grey <minion@clicks.codes> Wed Oct 11 23:15:09 2023 +0000
tree ac56da93e90d2dc36451503ce51fe67b638d95ca
parent 8bbc61644df8565bae687f113dd74e5fe9fdd039

add oauth to grafana via keycloak

Change-Id: Ib35cb9ba01c1822f42dc068e95636aa571e1452a

modules/grafana.nix

diff --git a/modules/grafana.nix b/modules/grafana.nix
index 6aee70f..7c3b175 100644
--- a/modules/grafana.nix
+++ b/modules/grafana.nix
@@ -1,4 +1,6 @@
-{ lib, config, ... }: {
+{ lib, config, base, pkgs, ... }:
+lib.recursiveUpdate
+{
   services.grafana = {
     enable = true;
 
@@ -10,6 +12,29 @@
         enable_gzip = true;
       };
       analytics.reporting_enabled = false;
+      "auth.generic_oauth" = {
+        enabled = true;
+        name = "Clicks OAuth";
+        allow_sign_up = true;
+        client_id = "grafana";
+        client_secret = "!!client_secret!!";
+        scopes = "openid email profile offline_access roles";
+        email_attribute_path = "email";
+        login_attribute_path = "login";
+        name_attribute_path = "name";
+        auth_url =
+          "https://login.clicks.codes/realms/clicks/protocol/openid-connect/auth";
+        token_url =
+          "https://login.clicks.codes/realms/clicks/protocol/openid-connect/token";
+        api_url =
+          "https://login.clicks.codes/realms/clicks/protocol/openid-connect/userinfo";
+        role_attribute_path =
+        "contains(resource_access.grafana.roles[*], 'server_admin') && 'GrafanaAdmin' || contains(resource_access.grafana.roles[*], 'admin') && 'Admin' || contains(resource_access.grafana.roles[*], 'editor') && 'Editor' || 'Viewer'";
+        allow_assign_grafana_admin = true;
+        auto_login = true;
+      };
+      "auth.basic".enabled = false;
+      auth.disable_login_form = true;
     };
 
     provision.datasources.settings.datasources = [{
@@ -19,8 +44,55 @@
 
       url = "postgres://localhost:${toString config.services.postgresql.port}";
       user = "clicks_grafana";
-      password = "$__file{${config.sops.secrets.clicks_grafana_db_password.path}}";
+      password =
+        "$__file{${config.sops.secrets.clicks_grafana_db_password.path}}";
       # defined in postgres.nix
     }];
   };
+
+  sops.secrets.clicks_grafana_client_secret = {
+    mode = "0600";
+    owner = "root";
+    group = "nobody";
+    sopsFile = ../secrets/grafana.json;
+    format = "json";
+  };
 }
+  (
+    let isDerived = base != null;
+    in if isDerived then
+      let
+        generators = lib.generators;
+        cfg = config.services.grafana;
+        settingsFormatIni = pkgs.formats.ini {
+          listToValue =
+            lib.concatMapStringsSep " " (generators.mkValueStringDefault { });
+          mkKeyValue = generators.mkKeyValueDefault
+            {
+              mkValueString = v:
+                if v == null then "" else generators.mkValueStringDefault { } v;
+            } "=";
+        };
+        grafana_cfgfile = settingsFormatIni.generate "config.ini" cfg.settings;
+      in
+      {
+        scalpel.trafos."grafana.ini" = {
+          source = toString grafana_cfgfile;
+          matchers."client_secret".secret =
+            config.sops.secrets.clicks_grafana_client_secret.path;
+          owner = config.users.users.grafana.name;
+          group = "nobody";
+          mode = "0400";
+        };
+
+        systemd.services.grafana.serviceConfig.ExecStart = lib.mkForce (pkgs.writeShellScript "grafana-start" ''
+          set -o errexit -o pipefail -o nounset -o errtrace
+          shopt -s inherit_errexit
+
+          exec ${cfg.package}/bin/grafana-server -homepath ${cfg.dataDir} -config ${config.scalpel.trafos."grafana.ini".destination}
+        '');
+        systemd.services.grafana.restartTriggers = [ grafana_cfgfile ];
+      }
+    else
+      { }
+  )