Configured Grafana to allow Authentik authentication

collections/ansible_collections/adhdgirl/minilab/roles/grafana/templates/grafana.ini.j2

@@ -46,3 +46,18 @@ level = {{ grafana_log_level }}
 [analytics]
 reporting_enabled = false
 check_for_updates = true
+
+[auth]
+signout_redirect_url = https://authentik.local.cobb.lgbt/application/o/grafana/end-session/
+oauth_auto_login = true
+
+[auth.generic_oauth]
+name = authentik
+enabled = true
+client_id = {{ grafana_authentik_id }}
+client_secret = {{ grafana_authentik_secret }}
+scopes = openid email profile entitlements
+auth_url = https://authentik.local.cobb.lgbt/application/o/authorize/
+token_url = https://authentik.local.cobb.lgbt/application/o/token/
+api_url = https://authentik.local.cobb.lgbt/application/o/userinfo/
+role_attribute_path = contains(entitlements[*], 'Grafana Admins') && 'Admin' || contains(entitlements[*], 'Grafana Editors') && 'Editor' || 'Viewer'

collections/ansible_collections/adhdgirl/minilab/roles/grafana/vars/main.yaml

@@ -7,6 +7,7 @@ grafana_admin_password: !vault |
   6165636162363165360a633930643933613264613332333461653765663032626630313563633333
   3331
 grafana_domain: "grafana.local.cobb.lgbt"
+grafana_root_url: "https://grafana.local.cobb.lgbt/"
 grafana_datasources:
   - name: Prometheus
     type: prometheus
@@ -23,3 +24,17 @@ grafana_plugins:
   - grafana-clock-panel
   - grafana-polystat-panel
 grafana_secret_key: "4V0H3pCvZAmQ02TDJJoc"
+grafana_authentik_id: JIrKG2SuOUKqlWqeV6W0XxpF2NYeQwgY48G7cnhj
+grafana_authentik_secret: !vault |
+  $ANSIBLE_VAULT;1.1;AES256
+  63303663646661633366656431326231316338643261626137343335623333653139633932396338
+  3264353532396365346430353434663932323065323032340a363134623732373935313737306332
+  63626365313962633932316230626435313234353535626261333462626161363061656262303236
+  3034323035333837350a643734373636373631323734383166303364646331646336386539356636
+  65383365653237393632643437626166363733346562393533363564626330623938336535613636
+  35373166623862323137653135363264346531656562663534376164306466303663666338656562
+  65663534386532643866303635323433363039663432633334343963646338316366343938623235
+  63373765303539373032353631663266316533613361643336373065306635613832313532636464
+  32363464353761363332646635616136346138336238333536353531643731663334333962326134
+  37316335366164363861333136323734336262363634326130343234303632616562303031303039
+  393331616563303033636261313937383238

collections/ansible_collections/adhdgirl/minilab/roles/traefik/files/routers.yaml

@@ -62,3 +62,14 @@ http:
       observability:
         metrics: true
       service: coder@file
+    grafana:
+      entryPoints:
+        - websecure
+      rule: "Host(`grafana.local.cobb.lgbt`)"
+      tls:
+        certResolver: letsEncrypt
+      observability:
+        metrics: true
+      service: grafana@file
+      middlewares:
+        - known-ips@file

collections/ansible_collections/adhdgirl/minilab/roles/traefik/tasks/main.yaml

@@ -19,6 +19,7 @@
         traefik_home_assistant_address: "{{ hostvars['home_assistant']['ansible_host'] }}"
         traefik_frigate_address: "{{ hostvars['curren']['ansible_host'] }}"
         traefik_truenas_address: "{{ hostvars['mors']['ansible_host'] }}"
+        traefik_grafana_address: "{{ hostvars['super']['ansible_host'] }}"
         cacheable: true
     - name: Ensure presense of folders for Traefik
       tags: packages,docker,traefik

collections/ansible_collections/adhdgirl/minilab/roles/traefik/templates/services.yaml.j2

@@ -28,3 +28,7 @@ http:
         serversTransport: insecureTransport
         servers:
           - url: "https://{{ traefik_frigate_address }}:8971"
+    grafana:
+      loadBalancer:
+        servers:
+          - url: "http://{{ traefik_grafana_address }}:3000"