1 files changed, 70 insertions, 15 deletions
diff --git a/os/srv/grafana.nix b/os/srv/grafana.nix
index 3e1333b..5428818 100644
--- a/os/srv/grafana.nix
+++ b/os/srv/grafana.nix
@@ -19,26 +19,80 @@ in
   config = lib.mkIf cfg.enable {
     services.grafana = {
       enable = true;
-      settings.server = {
-        http_addr = "127.0.0.1";
-        http_port = 3000;
+      openFirewall = true;
+
+      # Might use later
+      # declarativePlugins = [ ];
+
+      settings = {
+        server = {
+          protocol = "http";
+          http_port = 3000;
+          http_addr = "0.0.0.0";
+          domain = "grafana.${masterDomain}";
+          root_url = "https://grafana.${masterDomain}";
+          enforceDomain = true;
+          enable_gzip = true;
+        };
+        database = {
+          wal = true;
+        };
+        security = {
+          admin_user = "opc";
+          # TODO: Generate password to use in sops-nix
+          # admin_password = "sops"
+          admin_email = "adikro@disroot.org";
+          # TODO generate secret key and put it in sops-nix
+          # secret_key = "sops";
+          disable_gravatar = true;
+          cookie_secure = true;
+          cookie_samesite = "lax";
+          # security
+          allow_embedding = false;
+          strict_transport_security = true;
+
+          disable_initial_admin_creation = false;
+          disable_brute_force_login_protection = false;
+        };
+        # TODO setup mailing
+        # smtp = { enabled = true; };
+        analytics.feedback_links_enabled = false;
       };
       provision = {
         enable = true;
-        datasources.settings.datasources = [
-          {
-            name = "Prometheus";
-            type = "prometheus";
-            url = "http://127.0.0.1:9090";
-          }
-          {
-            name = "Loki";
-            type = "loki";
-            url = "http://127.0.0.1:3100";
-          }
-        ];
+        datasources.settings = {
+          prune = true;
+
+          datasources = [
+            {
+              name = "Prometheus";
+              type = "prometheus";
+              url = "http://127.0.0.1:9090";
+              access = "proxy";
+              isDefault = true;
+              editable = false;
+            }
+            {
+              name = "Loki";
+              type = "loki";
+              url = "http://127.0.0.1:3100";
+              access = "proxy";
+              editable = false;
+            }
+          ];
+        };
       };
+      # dashboards.settings = {
+      #   providers = [
+      #     {
+      #       name = "default";
+      #       type = "file";
+      #       options.path = "/var/lib/grafana/dashboards";
+      #     }
+      #   ];
+      # };
     };
+
     os.srv.grafana.proxyConfig = {
       "grafana.${masterDomain}" = {
         enableACME = true;
@@ -46,6 +100,7 @@ in
 
         locations."/" = {
           proxyPass = "http://${config.os.core.network.ips.vm2-gateway}:3000";
+          proxyWebsockets = true;
           extraConfig = securityTemplates.restrictToInternal;
         };
       };