dank/serverAppConfigs
1
0
Fork 0
Code Issues 6 Pull Requests Actions Packages Projects Releases Wiki Activity

grafana: switch auth_proxy -> OAuth2 relying-party against authentik

Browse Source 
The embedded outpost carries no provider token (token=None), so the
auth_proxy identity header was never set and no user could log in. RP
mode is topology-independent: challenge gate stays in front, login runs
inside Grafana via the OAuth2 code flow against auth.franksdank.cloud.

Provider 'grafana' (pk 9, confidential) created via ak shell; secret
written straight into the live .env (never in git). Auth URL uses the
global /application/o/authorize/ path — this fork resolves the provider
by client_id query param; per-slug authorize does not exist.
Caddyfile comment corrected: no identity header is forwarded to Grafana.
This commit is contained in:
Frank
2026-08-31 03:32:53 -07:00
parent ec03929d95
commit 3d64f2ca99
3 changed files with 36 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dankclaw/.env.example
+5 -5
View File
@@ -20,11 +20,11 @@ WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL=25s
# Gitea database
GITEA_DB_PASSWORD=changeme
# Grafana auth-proxy trust token. The outpost proxy provider 'grafana-proxy'
# forwards authenticated traffic to Grafana with Authorization: Bearer
# <client_id>_<client_secret>; the live .env must set this to that exact
# concatenation (provider created via ak shell on authentik-server).
GRAFANA_PROXY_TOKEN=changeme
# Grafana OAuth2 client secret (authentik OAuth2Provider "grafana", pk 9).
# Created via ak shell on authentik-server; the live .env must hold the
# provider's generated client_secret verbatim. Rotation = rotate the provider
# secret in authentik, restart grafana after updating the live .env value.
GRAFANA_OAUTH_CLIENT_SECRET=changeme
# Caddy (the homelab's single reverse proxy, on this host)
# bcrypt hash (caddy hash-password). deploy.sh renders it into