Emi Griffith
7e8a484ad5
- Grafana served at dashboard.thermograph.org (the record now points at beta) - Google OAuth (OIDC) login, env-gated (OAUTH_ENABLED + GOOGLE_CLIENT_ID/SECRET); allow_sign_up=false so access is locked to pre-provisioned accounts, with a break-glass local admin fallback - README: Google Cloud OAuth client setup with the redirect URIs for both Grafana and Forgejo, plus the Forgejo add-oauth command
20 lines
965 B
Text
20 lines
965 B
Text
# Copy to .env on the monitoring host (beta) before `docker compose up`.
|
|
# .env is gitignored — never commit real secrets.
|
|
|
|
# The public hostname beta's Caddy serves Grafana at (see caddy-grafana.conf).
|
|
GRAFANA_DOMAIN=dashboard.thermograph.org
|
|
|
|
# Break-glass local admin (Google SSO below is the primary login). Keep this
|
|
# strong; it's the fallback if OAuth ever breaks.
|
|
GF_ADMIN_USER=admin
|
|
GF_SECURITY_ADMIN_PASSWORD=change-me-to-something-strong
|
|
|
|
# --- Google SSO ------------------------------------------------------------------
|
|
# Create a Google Cloud "OAuth 2.0 Client ID" (type: Web application) and set:
|
|
# Authorized redirect URI: https://dashboard.thermograph.org/login/google
|
|
# Then paste the client id/secret here and flip OAUTH_ENABLED=true.
|
|
# Login is locked to pre-provisioned accounts (allow_sign_up=false) — provision
|
|
# your email as an admin (see README) so only you can sign in.
|
|
OAUTH_ENABLED=false
|
|
GOOGLE_CLIENT_ID=
|
|
GOOGLE_CLIENT_SECRET=
|