|
|
|
|
version: "3"
|
|
|
|
|
services:
|
|
|
|
|
grafana:
|
|
|
|
|
image: grafana/grafana-oss:8.5.1
|
|
|
|
|
container_name: grafana
|
|
|
|
|
user: "0:0"
|
|
|
|
|
environment:
|
|
|
|
|
GF_AUTH_GENERIC_OAUTH_ENABLED: 'True'
|
|
|
|
|
GF_AUTH_GENERIC_OAUTH_ALLOW_SIGN_UP: 'True' # otherwise no login is possible
|
|
|
|
|
#GF_AUTH_GENERIC_OAUTH_TEAM_IDS: ''
|
|
|
|
|
#GF_AUTH_GENERIC_OAUTH_ALLOWED_ORGANIZATIONS: ''
|
|
|
|
|
#GF_AUTH_GENERIC_OAUTH_ALLOWED_DOMAINS: '<domains>'
|
|
|
|
|
#GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_ADMIN_PASSWORD} # ignored?
|
|
|
|
|
GF_AUTH_GENERIC_OAUTH_NAME: Keycloak
|
|
|
|
|
GF_AUTH_GENERIC_OAUTH_CLIENT_ID: grafana
|
|
|
|
|
GF_AUTH_GENERIC_OAUTH_SCOPES: openid profile email
|
|
|
|
|
GF_SERVER_ROOT_URL: https://${GRAFANA_HOSTNAME}.${DOMAIN_NAME}/
|
|
|
|
|
GF_SERVER_DOMAIN: ${GRAFANA_HOSTNAME}.${DOMAIN_NAME}
|
|
|
|
|
GF_AUTH_GENERIC_OAUTH_AUTH_URL: ${AUTH_URL}
|
|
|
|
|
GF_AUTH_GENERIC_OAUTH_TOKEN_URL: ${TOKEN_URL}
|
|
|
|
|
GF_AUTH_GENERIC_OAUTH_API_URL: ${USERINFO_URL}
|
|
|
|
|
GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: ${GRAFANA_CLIENT_SECRET}
|
|
|
|
|
# reset the admin password on every run, since otherwise it defaults to admin/admin
|
|
|
|
|
entrypoint: ["sh", "-c", "grafana-cli admin reset-admin-password ${GRAFANA_ADMIN_PASSWORD} && /run.sh"]
|
|
|
|
|
volumes:
|
|
|
|
|
- ./data/grafana/data:/var/lib/grafana
|
|
|
|
|
- ./grafana/provisioning:/etc/grafana/provisioning:ro
|
|
|
|
|
- ./grafana/dashboards:/etc/grafana/dashboards:ro
|
|
|
|
|
restart: always
|
|
|
|
|
# ports:
|
|
|
|
|
# - 3000:3000
|
|
|
|
|
|
|
|
|
|
# add the grafana nginx configuration into the nginx volume
|
|
|
|
|
nginx:
|
|
|
|
|
volumes:
|
|
|
|
|
- ./grafana/nginx.conf:/etc/nginx/templates/grafana.conf.template:ro
|
|
|
|
|
|
|
|
|
|
# add the grafana client secrets to the keycloak-setup volume
|
|
|
|
|
keycloak:
|
|
|
|
|
volumes:
|
|
|
|
|
- ./grafana/keycloak.sh:/keycloak-setup/grafana.sh:ro
|
|
|
|
|
- ./data/grafana/secrets:/run/secrets/grafana:ro
|
