diff options
author | Vincent Ambo <mail@tazj.in> | 2021-12-27T13·56+0300 |
---|---|---|
committer | clbot <clbot@tvl.fyi> | 2021-12-27T14·44+0000 |
commit | 906d6553c65f5eac1f6f77f3984bfd04963cb13f (patch) | |
tree | 9c0b44aeb37a5824bc0d66225f23b2982741afb5 | |
parent | 7154507e78693cd609b1742f8fee51dfcff69d97 (diff) |
fix(whitby): Point grafana at new auth provider r/3468
Grafana was still pointing at the (now non-existent) CAS setup. This changes the endpoints to use Keycloak instead and updates the client secret. Change-Id: Ib25d38330aba2ef6d894e8c33d86852c884ab5be Reviewed-on: https://cl.tvl.fyi/c/depot/+/4706 Tested-by: BuildkiteCI Autosubmit: tazjin <mail@tazj.in> Reviewed-by: grfn <grfn@gws.fyi>
-rw-r--r-- | ops/machines/whitby/default.nix | 10 | ||||
-rw-r--r-- | ops/secrets/grafana.age | 26 |
2 files changed, 18 insertions, 18 deletions
diff --git a/ops/machines/whitby/default.nix b/ops/machines/whitby/default.nix index 727859542938..e013c56196f5 100644 --- a/ops/machines/whitby/default.nix +++ b/ops/machines/whitby/default.nix @@ -500,15 +500,15 @@ in { auth = { generic_oauth = { enabled = true; - client_id = "OAUTH-TVL-grafana-f1A1EmHLDT"; + client_id = "grafana"; scopes = "openid profile email"; name = "TVL"; email_attribute_path = "mail"; login_attribute_path = "sub"; name_attribute_path = "displayName"; - auth_url = "https://login.tvl.fyi/oidc/authorize"; - token_url = "https://login.tvl.fyi/oidc/accessToken"; - api_url = "https://login.tvl.fyi/oidc/profile"; + auth_url = "https://auth.tvl.fyi/auth/realms/TVL/protocol/openid-connect/auth"; + token_url = "https://auth.tvl.fyi/auth/realms/TVL/protocol/openid-connect/token"; + api_url = "https://auth.tvl.fyi/auth/realms/TVL/protocol/openid-connect/userinfo"; # Give lukegb, grfn, tazjin "Admin" rights. role_attribute_path = "((sub == 'lukegb' || sub == 'grfn' || sub == 'tazjin') && 'Admin') || 'Editor'"; @@ -516,11 +516,13 @@ in { # Allow creating new Grafana accounts from OAuth accounts. allow_sign_up = true; }; + anonymous = { enabled = true; org_name = "The Virus Lounge"; org_role = "Viewer"; }; + basic.enabled = false; oauth_auto_login = true; disable_login_form = true; diff --git a/ops/secrets/grafana.age b/ops/secrets/grafana.age index 9c093968471c..ad503dc32a8f 100644 --- a/ops/secrets/grafana.age +++ b/ops/secrets/grafana.age @@ -1,15 +1,13 @@ age-encryption.org/v1 --> ssh-ed25519 dcsaLw TjDj+2FT4468X7jin78UPetVsZRmDtwU7HfwAk79Omc -WLxXI+jaYFuvynK06GaHFs7D3XeYzSjHl6mteiks3uc --> ssh-ed25519 CpJBgQ Z3y+8U5H0ZTQdIaBgOtLGFst925kTspwJ1z+W/op8wo -jHuIydmqN1ypCsyPZVbJYuuW6aJiTOe3SoSD7Ju2tMY --> ssh-ed25519 aXKGcg KttaHGM/1zYMFCfdYFKmWyUpco0mPmKxeX2LpUndm0c -vLULuYNRGDdvuWf1M9o+Vq9cnk3G/DzYVAcxdZfvcvg --> ssh-ed25519 OkGqLg Obwnq0537RDZHFT7I+vucuYFk/fKTZYUzccSM/HfNnY -tSqtWbgt/PebTDK9Od0EWj4mf3gXomtONcj0XBFYQDs --> [eCG-grease CV -j5A3qikgyfxFMAcqeheGI8CMNDfhBh399JddXXvziPYB7QBkbeznUdMCX+2wOg/U -U2rBgA1G84Rlr+2BJXlQ6iLL9xs7/us9vANaiTPiB0Ir4u377HBuCWoDLg ---- ucJ+JohxZBSFnDzNw/pFvlYOZIFWvBxrn+CP9bcEsD0 -rB]�0U��jfuabd�6 -pWy�H�\��e�֯8�rC�z)ӛ�u�_䌡��clw�,��"�e��wS�vh�%8�����e�{�7dC'���_n \ No newline at end of file +-> ssh-ed25519 dcsaLw CrJGrkztUpn+XkED1hn4Clr/oBNrer9J+/fdqDhgx18 +VWENh02k4HTkhDS2F219vrCUVuxXFOCPsCW+8eeZHs4 +-> ssh-ed25519 CpJBgQ 8Lm14o93CEh/aerPtMiStKYtqF/HdgJD05uRRegLgUs +b0H5XBOe4nepmGzl646Ar0XAazzHAJeTLCCGUVaZyW0 +-> ssh-ed25519 aXKGcg SKWLHNM0WeFJoGlOPbI6v7CebdSK3qAmQ6kMW5YbIz4 +kQD7Oh9mQeCXyXzOc1kVI8ShE0J89TzuZBOboaQn7sE +-> ssh-ed25519 OkGqLg ablfqKN1GYY3GWGCHGtciRFJwO4e0kbcS75Kaj+elUA +PQPeRVzV/Yi0lxI7U+lNbCpeatymazj7GjQLhmL4YI8 +-> gse~-grease +I9X7cHnmfbsnu/4AeVVtTRlbguJDylrAlCOqTOt11Gtg/Ft2fnZZTOmsKo8 +--- 3xk3ls7SR7s394FtfqLwxgUDjTPMjnhLz79ClvIm4pE +�yF�z���H�������*M��\�26I`ko�&ba�W��vM���.����j�����F�;Z��N��*�P� �_J��c�_��(�S�j�d��8F� \ No newline at end of file |