grafana: add kanidm oauth

modules/nixos/services/homeserver/grafana.nix

@@ -28,8 +28,29 @@
         enable_gzip = true;
       };
 
+      "auth.generic_oauth" = {
+        enabled = true;
+        name = "Kanidm";
+        client_id = "grafana";
+        auth_url = "https://kanidm.wo2wz.fyi/ui/oauth2";
+        token_url = "https://kanidm.wo2wz.fyi/oauth2/token";
+        api_url = "https://kanidm.wo2wz.fyi/oauth2/openid/grafana/userinfo";
+
+        scopes = [ "openid" "profile" "email" "groups" "offline_access" ];
+        login_attribute_path = "preferred_username";
+        email_attribute_path = "email";
+        groups_attribute_path = "groups";
+        role_attribute_path = "contains(grafana_users[*], 'GrafanaAdmin') && 'GrafanaAdmin' || 'Viewer'";
+        allow_assign_grafana_admin = true;
+
+        allow_sign_up = true;
+        use_pkce = true;
+        use_refresh_token = true;
+      };
+
       security = {
         secret_key = "$__env{GRAFANA_SECRET_KEY}";
+        disable_initial_admin_creation = true;
         cookie_secure = true;
         disable_gravatar = true;
       };

modules/nixos/services/homeserver/kanidm.nix

@@ -4,6 +4,10 @@
   sops.secrets = {
     "acme/secrets.env" = {};
 
+    "kanidm/oauth2/grafana" = {
+      owner = "kanidm";
+      group = "kanidm";
+    };
     "kanidm/oauth2/nextcloud" = {
       owner = "kanidm";
       group = "kanidm";
@@ -65,21 +69,45 @@
       persons.wo2w = {
         displayName = "wo2w";
         legalName = "Wo2wz_";
+        mailAddresses = [ "wo2w@kanidm.wo2wz.fyi" ];
+
+        groups = [
+          "grafana_users"
+          "nextcloud_users"
+          "zipline_users"
+
+          "grafana_admins"
+        ];
       };
 
       groups = {
-        nextcloud-grp.members = [ "wo2w" ];
+        grafana_users = {};
-        zipline-grp.members = [ "wo2w" ];
+        nextcloud_users = {};
+        zipline_users = {};
+
+        grafana_admins.members = [ "grafana_users" ];
       };
 
       systems.oauth2 = {
+        grafana = {
+          displayName = "Grafana";
+          originUrl = "https://grafana.taild5f7e6.ts.net/login/generic_oauth";
+          originLanding = "https://grafana.taild5f7e6.ts.net";
+
+          preferShortUsername = true;
+          basicSecretFile = config.sops.secrets."kanidm/oauth2/grafana".path;
+          scopeMaps.grafana_users = [ "openid" "email" "profile" "groups" "offline_access" ];
+          claimMaps.grafana_users.valuesByGroup.grafana_admins = [ "GrafanaAdmin" ];
+        };
+
         nextcloud = {
           displayName = "Nextcloud";
           originUrl = "https://nextcloud.wo2wz.fyi/index.php/apps/user_oidc/code";
           originLanding = "https://nextcloud.wo2wz.fyi/index.php";
 
+          preferShortUsername = true;
           basicSecretFile = config.sops.secrets."kanidm/oauth2/nextcloud".path;
-          scopeMaps.nextcloud-grp = [ "openid" "profile" ];
+          scopeMaps.nextcloud_users = [ "openid" "profile" ];
         };
 
         zipline = {
@@ -87,9 +115,10 @@
           originUrl = "https://zipline.wo2wz.fyi/api/auth/oauth/oidc";
           originLanding = "https://zipline.wo2wz.fyi";
 
+          preferShortUsername = true;
           allowInsecureClientDisablePkce = true;
           basicSecretFile = config.sops.secrets."kanidm/oauth2/zipline".path;
-          scopeMaps.zipline-grp = [ "openid" "profile" "email" "offline_access" ];
+          scopeMaps.zipline_users = [ "openid" "profile" "email" "offline_access" ];
         };
       };
     };

secrets/secrets.yaml

@@ -7,9 +7,10 @@ caddy:
 cloudflared:
     8af2892d-d534-4e32-b867-5b79308a99d5.json: ENC[AES256_GCM,data:4fOlt/pNxQ9CSuKf1ZPv9odtdU+Q7NTlO56xGp5yY0AEZrbpljSlTS/b8dON5iVwRoUjUbUui8+jvDri7ad99e+kZUwzDC2S294oaQyPa5Bl4jrYZSFn6SWZbnBzyV5tVN0hoQlIMQ/oU53TvBAtNrj10toePH7iLB12AmqMCBshWEFUViAJqGcZZMrcarAT453FgtpR+f3vR8Wv90SGc7wHXARJZ4NzEIRmYD4dGA==,iv:1Mt9FJTlT7Sv9FvrNY97icXSi757ejt56lhc7OG1dJM=,tag:JxW5Cg6nPzzh4zxi9Wvw0A==,type:str]
 grafana:
-    secrets.env: ENC[AES256_GCM,data:lWLfvr/pplCN1GzTiVF0avFzaqZX2+2kMK5bK19voyKGT8z6md/5vEKo4H9gDTKcSu7Y,iv:uj6wGI/OKtzvD4m+EVXfovvfRTCP4TnVxxnQtiwtpb4=,tag:syh4H2EnHgMJHQGyhBg+1g==,type:str]
+    secrets.env: ENC[AES256_GCM,data:yv7u5+8l7M4PJ4BzCUlTGX8PeFxxVMtS2Pi4yKnvAeZf+4tcz6NFNRjyPeqTFinqmZ8yq+iYA1tBS5Gy9DTHo8TzmhoaWBPI/ZUXQgl5Y7lnGBOyZ6wHlllsP8zbC+zEWW+gRssaXj6yYBuvQTTzfSqSlmZdB7VwhUegiVxMs722jbys1Rl+NE8TKDc384IbwPRAIi6ZO+UH,iv:M/dgcJ++gMH5/sNQDUQvkiJW2n+fSkPCEDZBcFRXWuE=,tag:SocmiehkaCzl9ZB8dNZPZQ==,type:str]
 kanidm:
     oauth2:
+        grafana: ENC[AES256_GCM,data:9aWa5SJ4UNWcQCCRT9rL6XnoUjlkXeifBYe3fL4xRbNC3bc5L6jNtJOF9v0ZZ874pTr/dnv5LzLz/ISLDQWfnw==,iv:+V+JjP2EA02cn7aFif262DjqoCXYRLqXv2jR0pc457c=,tag:CI9daTCxkeOueb3d//hx0A==,type:str]
         nextcloud: ENC[AES256_GCM,data:P7ha6OwX6A5PyNO4xy+UTfdQBeKbktJbK5Ggv/fLuW+SDrxTehuwM1F9A5el3j1Dsegk3VsrrTPBZTVU6i5qwA==,iv:YcvNvAZHjdBd9q5Uxdp+Phj5uQRqLoRi33rIzUcv7Ng=,tag:cXM58lfOpHbTbaJRNUm1Kw==,type:str]
         zipline: ENC[AES256_GCM,data:q25Ugsqj6+we3dTDyczfxuGA1DcnlxUDbJLxlzVAF3wTtzdF4t6p2tkPlTtvvgLQQPg/sYAQB0zFE9DcxpxuCw==,iv:fyhRGFUTx1d0ITygUWOkaDAtVI2h05DMv3aEI/DUM2k=,tag:WaPRXbFXl1+aTC+ZtyITYw==,type:str]
 nextcloud:
@@ -33,7 +34,7 @@ sops:
             N0U5bkt4aXJOS3N0Z2N4YTg4TDVUVncKCQLUTMmdM/IPzV3NDRhPdta1tvXxy/6P
             RYbLzlUryw+tqfTp8nDrdxyOWScLNzPOswAq0Qf7VMcEQ5bJEkAOhQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-11-03T19:35:32Z"
+    lastmodified: "2025-11-06T15:31:14Z"
-    mac: ENC[AES256_GCM,data:vN6cjwfohcSPtqjSc+PJbuLDXGZauk92/ICRi3u2KiXZiThbTHJVVRM5b9s/nPBKMfEXoNu1VW0G3FiM5AZIrJDDlzUrF63iGm8m4WHMp37EcKCAm+VUGJqSd2Tg5AzR0JBgf85MSpCuv+4Btu8y9l4cpJWWfD+xXaq77wrx7nk=,iv:u7i2waGlejnICk6xQGs59EVchPTpBv1Y/FSwr/tmJwM=,tag:+H6py1V65Y+QKQ0WQ4i5wg==,type:str]
+    mac: ENC[AES256_GCM,data:mOKxCnv5dDNuWGairJhV4Es36/MqM61d8ludzIgjpVmDD7arAxaMQA56FpCBU8eu0hVs1pO/Gw7xj0DIo+VTD0k2mdkimsp74gi13eEUdOCN5s+/7Th9sBpk5LeY9hzPp2fDFmBK3LLP9Jvp8IdKsbMgNKu6VzxukrWKOr1RpkM=,iv:HJKu/io7tV0Il06V2aglOaJHkjOxOcZ9JFbFCqFbTFw=,tag:iDmktXmP64OkijUxsQ5FCA==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.11.0