From 02535cca089ef6b2d84756d6c9061d68963d3f88 Mon Sep 17 00:00:00 2001
From: Rouven Seifert <rouven@rfive.de>
Date: Wed, 8 May 2024 00:09:40 +0200
Subject: [PATCH] grafana: configure oidc

---
 modules/monitoring.nix | 21 +++++++++++++++++++++
 secrets/quitte.yaml    |  6 ++++--
 2 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/modules/monitoring.nix b/modules/monitoring.nix
index ed68e37..e277876 100644
--- a/modules/monitoring.nix
+++ b/modules/monitoring.nix
@@ -3,6 +3,9 @@ let
   domain = "monitoring.${config.networking.domain}";
 in
 {
+  sops.secrets."grafana/oidc_secret" = {
+    owner = "grafana";
+  };
   # grafana configuration
   services.grafana = {
     enable = true;
@@ -18,6 +21,24 @@ in
         user = "grafana";
         host = "/run/postgresql";
       };
+      "auth.generic_oauth" = {
+        enabled = true;
+        name = "iFSR";
+        allow_sign_up = true;
+        client_id = "grafana";
+        client_secret = "$__file{${config.sops.secrets."grafana/oidc_secret".path}}";
+        scopes = "openid email profile offline_access roles";
+
+        email_attribute_path = "email";
+        login_attribute_path = "username";
+        name_attribute_path = "full_name";
+
+        auth_url = "https://sso.ifsr.de/realms/internal/protocol/openid-connect/auth";
+        token_url = "https://sso.ifsr.de/realms/internal/protocol/openid-connect/token";
+        api_url = "https://sso.ifsr.de/realms/internal/protocol/openid-connect/userinfo";
+        role_attribute_path = "contains(roles[*], 'admin') && 'Admin' || contains(roles[*], 'editor') && 'Editor' || 'Viewer'";
+
+      };
 
     };
 
diff --git a/secrets/quitte.yaml b/secrets/quitte.yaml
index ebf220e..6f26813 100644
--- a/secrets/quitte.yaml
+++ b/secrets/quitte.yaml
@@ -13,6 +13,8 @@ sssd:
     env: ENC[AES256_GCM,data:ng189+ulH79xCZKOn9N5kN3KqED9dWqLM8dErukJH3a3ivxhUjyy3Tpa+uSnJDh8tAyOesT1j71mlTgKQKb3phylVEdL,iv:i8NEGR+eQ42q5be4gJdNMf/9DCCcjr3gwkEW/+hrgxs=,tag:16EvtkTu+0M5bIlgxC2j9Q==,type:str]
 dovecot_ldap_search: ENC[AES256_GCM,data:xip5KREy8oqH+58DOtw9QLcVdDlO5Nr0IHki8X0i9J1rrI/BreH2tVPC8aRTDHFPRgpBxiL6,iv:98PSXajEis7sSJ4+IkPuBC05y8w7/XRYQVFH1cripEU=,tag:LcId5rlzz3JjjZIHwoh+AA==,type:str]
 rspamd-password: ENC[AES256_GCM,data:UEJEPSQDGa4lewyqQ4fZH//li6KMfE9Jb/BzbLUM9o02qZuuAUDw17gTTTTPdl8WoBS02nN9r0s=,iv:2TFoMv0LAFTQDEf6ekjzS1Q1P+Z47V8kUnluQpTHWug=,tag:QOKDbVDZLmBymplJPHfrfQ==,type:str]
+grafana:
+    oidc_secret: ENC[AES256_GCM,data:oH+VCL4e4wve6RyVwlTXPSmirbf+STD5FxUj9OjGDLs=,iv:PhVVCy5JyRa+fOrYAsnjDL+97zYASmKcBzB8t9ZVWIU=,tag:JzGO/FeKem4vd7ApvZ2Zcg==,type:str]
 mediawiki:
     initial_admin: ENC[AES256_GCM,data:JzW2rgXQHXxj1e3vFhkXVkWSgrA3Y88KWlQ81hqUHw2UvnBH4GWtMXbZ,iv:zqKUyEaIOa/7hpwzjJPwk5gfqbEYJrE7Oc1Zqcqm3vo=,tag:T1gObIGtI4uVdpONvIXofA==,type:str]
     oidc_secret: ENC[AES256_GCM,data:xK5XSAwa1NOLx+hQqcgrCdQZ/zXErkRL+UV7HCBqF/0=,iv:Vbdus4jzJPAyG4ymIPVjudeHofyqNpIStecVnbyYA6s=,tag:+8xYpJbWWAbswitDHMGCCA==,type:str]
@@ -50,8 +52,8 @@ sops:
             c2lzVGV6WnVQT1pOTTVwRUxlMWZobWsK0CrDl2ELoYOTrMt3uN3mgBSyaYqOQY4I
             vBK12PV9FR9GFpKN4kGB03PZ0gV0N1zlcCHpnPCUuHwbCvvF2+vCag==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-05-07T09:10:56Z"
-    mac: ENC[AES256_GCM,data:Q4N0aaBVYGBEUsUePd8WvrCA3Kb6F1iaVXQQYPTLCVHcw9WCTtDHsUxUEeVZkpxwhKsX+yMjc1S4ATNbTXoOf6tfEadAw/0PPrQatkxPZyz26u8EgSykAGj3tRiUKU9YQg3ieiiIDQokqqaCq+Bjcrg/7BLsQT/u+kowzhPIHH0=,iv:Ez3jSVakc46JQfE1FsH4RVuhtX27gAQ3AeFG735W4p4=,tag:Njbi0+11j0ZGLskP8aX7XA==,type:str]
+    lastmodified: "2024-05-07T22:01:28Z"
+    mac: ENC[AES256_GCM,data:zL8TYp7ivjwjMpjC8FizCxq/OmdiD1hcKn8dnrrx/Lm07e/cjBf6MweJWBYLKwpigMOPeY7CvmCBW8EXvVao38n0zzNIoj1zFZRhnaxDoa961OkJ2WHduM9DCwvSN03wL8lOhT8dgBjsjR3Jzennfx5Mn2Q5cosfBBDWpaLl9sY=,iv:K5OKJSoXagU5CIzvJ37ikj3haTjMtQG0LBTCXqH4FYc=,tag:1n/MHnQCBlOIjNAXQJGanw==,type:str]
     pgp:
         - created_at: "2024-02-29T15:23:23Z"
           enc: |-