Repository navigation
grafana.lassul.us: styx's Grafana with id.lassul.us login - #146
Merged
Merged
Conversation
added 3 commits
October 25, 2026 00:49
neoprism serves grafana.lassul.us over TLS and proxies it over retiolum to the Grafana on styx (port 3000 is already open on retiolum there), with websockets for Grafana Live. The Zitadel project grafana is declarative: only [email protected] gets a user grant and can log in. Its web app is a public client with PKCE, so there is no secret to ship; the client id goes to styx through a prompted var. The Gatus check runs on every monitoring server, so it also changes coaxmetal's gatus.yaml.
styx's Grafana becomes public at grafana.lassul.us, so anonymous viewing and the password form go away and Grafana's generic_oauth logs users in against Zitadel. Users are created on first login and keyed by the token's sub claim (Grafana's user_auth): generic_oauth always takes the auth id from sub, Grafana 13 has no id_attribute_path to change that. Email lookup stays off so a matching address cannot take over an existing account. Zitadel only lets the users listed on the project through, so everyone who gets in is made Grafana Admin. The client id comes from the grafana-oidc var as an environment file, optional so Grafana starts before the var exists. The local admin stays for API access and grafana cli. cookie_secure because sessions now only live on the https origin.
Grafana reads config.ini with go-ini (gopkg.in/ini.v1 v1.67.2), whose readValue strips quotes that surround an entire value (parser.go:300-302, hasSurroundedQuote at parser.go:231). role_attribute_path='GrafanaAdmin' thus became the JMESPath identifier GrafanaAdmin, which evaluates to null, so OIDC logins fell back to Viewer. sub && 'GrafanaAdmin' does not start and end with a quote and yields GrafanaAdmin for every user, since every userinfo has a sub (Zitadel restricts who can log in).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Public Grafana at https://grafana.lassul.us (styx), login via id.lassul.us. Deployed on neoprism and styx; login tested.