From 24c09c2c803f77bff9c10b8317cb4892d645fb73 Mon Sep 17 00:00:00 2001
From: kisfenyo <kisfenyo@dooplex.local>
Date: Sun, 28 Dec 2025 11:53:34 +0100
Subject: [PATCH] added grafana oauth

---
 mon-system/monitoring.yaml | 36 ++++++++++++++++++++++++++++--------
 1 file changed, 28 insertions(+), 8 deletions(-)

diff --git a/mon-system/monitoring.yaml b/mon-system/monitoring.yaml
index 5c183c8..0c8ca3b 100644
--- a/mon-system/monitoring.yaml
+++ b/mon-system/monitoring.yaml
@@ -470,8 +470,34 @@ spec:
                   key: admin-password
             - name: GF_SERVER_ROOT_URL
               value: "https://grafana.dooplex.hu"
-            - name: GF_INSTALL_PLUGINS
-              value: "grafana-piechart-panel,grafana-clock-panel"
+            - name: GF_AUTH_GENERIC_OAUTH_ENABLED
+              value: "true"
+            - name: GF_AUTH_GENERIC_OAUTH_NAME
+              value: "authentik"
+            - name: GF_AUTH_GENERIC_OAUTH_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: grafana-oauth
+                  key: client-id
+            - name: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: grafana-oauth
+                  key: client-secret
+            - name: GF_AUTH_GENERIC_OAUTH_SCOPES
+              value: "openid profile email"
+            - name: GF_AUTH_GENERIC_OAUTH_AUTH_URL
+              value: "https://authentik.dooplex.hu/application/o/authorize/"
+            - name: GF_AUTH_GENERIC_OAUTH_TOKEN_URL
+              value: "https://authentik.dooplex.hu/application/o/token/"
+            - name: GF_AUTH_GENERIC_OAUTH_API_URL
+              value: "https://authentik.dooplex.hu/application/o/userinfo/"
+            - name: GF_AUTH_SIGNOUT_REDIRECT_URL
+              value: "https://authentik.dooplex.hu/application/o/grafana/end-session/"
+            - name: GF_AUTH_OAUTH_AUTO_LOGIN
+              value: "true"
+            - name: GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH
+              value: "contains(groups[*], 'Grafana Admins') && 'Admin' || 'Viewer'"
           livenessProbe:
             httpGet:
               path: /api/health
@@ -496,8 +522,6 @@ spec:
               mountPath: /var/lib/grafana
             - name: datasources
               mountPath: /etc/grafana/provisioning/datasources
-            - name: dashboards-config
-              mountPath: /etc/grafana/provisioning/dashboards
       volumes:
         - name: data
           persistentVolumeClaim:
@@ -505,10 +529,6 @@ spec:
         - name: datasources
           configMap:
             name: grafana-datasources
-        - name: dashboards-config
-          configMap:
-            name: grafana-dashboards-config
-
 ---
 apiVersion: v1
 kind: Service