Enable anonymous authentication in Grafana

nadrog · January 6, 2024, 8:28am

I’d like to enable anonymous authentication in Grafana so that the iframes including Grafana panels (in Hugo) do not require login.

I’m looking for an option like services.grafana.settings.security.allow_anonymous = true; or another way of achieving the same goal.

APCodes · January 6, 2024, 5:12pm

I am not really sure about this one, as I am not using Grafana on NixOS.

However juding from the source code of the NixOS module, have you tried this?

services.grafana.settings.auth.anonymous.enabled = true;

If this doesn’t work, I am not sure what the purpose of this line in the code below is otherwise. It looks like this option is supposed to exist and has been renamed, but I am not really sure if it actually does:

github.com

NixOS/nixpkgs/blob/bd645e8668ec6612439a9ee7e71f7eac4099d4f6/nixos/modules/services/monitoring/grafana.nix#L260


      
          (mkRenamedOptionModule [ "services" "grafana" "server" "serveFromSubPath" ] [ "services" "grafana" "settings" "server" "serve_from_sub_path" ])
          (mkRenamedOptionModule [ "services" "grafana" "smtp" "enable" ] [ "services" "grafana" "settings" "smtp" "enabled" ])
          (mkRenamedOptionModule [ "services" "grafana" "smtp" "user" ] [ "services" "grafana" "settings" "smtp" "user" ])
          (mkRenamedOptionModule [ "services" "grafana" "smtp" "password" ] [ "services" "grafana" "settings" "smtp" "password" ])
          (mkRenamedOptionModule [ "services" "grafana" "smtp" "fromAddress" ] [ "services" "grafana" "settings" "smtp" "from_address" ])
          (mkRenamedOptionModule [ "services" "grafana" "users" "allowSignUp" ] [ "services" "grafana" "settings" "users" "allow_sign_up" ])
          (mkRenamedOptionModule [ "services" "grafana" "users" "allowOrgCreate" ] [ "services" "grafana" "settings" "users" "allow_org_create" ])
          (mkRenamedOptionModule [ "services" "grafana" "users" "autoAssignOrg" ] [ "services" "grafana" "settings" "users" "auto_assign_org" ])
          (mkRenamedOptionModule [ "services" "grafana" "users" "autoAssignOrgRole" ] [ "services" "grafana" "settings" "users" "auto_assign_org_role" ])
          (mkRenamedOptionModule [ "services" "grafana" "auth" "disableLoginForm" ] [ "services" "grafana" "settings" "auth" "disable_login_form" ])
          (mkRenamedOptionModule [ "services" "grafana" "auth" "anonymous" "enable" ] [ "services" "grafana" "settings" "auth.anonymous" "enabled" ])
          (mkRenamedOptionModule [ "services" "grafana" "auth" "anonymous" "org_name" ] [ "services" "grafana" "settings" "auth.anonymous" "org_name" ])
          (mkRenamedOptionModule [ "services" "grafana" "auth" "anonymous" "org_role" ] [ "services" "grafana" "settings" "auth.anonymous" "org_role" ])
          (mkRenamedOptionModule [ "services" "grafana" "auth" "azuread" "enable" ] [ "services" "grafana" "settings" "auth.azuread" "enabled" ])
          (mkRenamedOptionModule [ "services" "grafana" "auth" "azuread" "allowSignUp" ] [ "services" "grafana" "settings" "auth.azuread" "allow_sign_up" ])
          (mkRenamedOptionModule [ "services" "grafana" "auth" "azuread" "clientId" ] [ "services" "grafana" "settings" "auth.azuread" "client_id" ])
          (mkRenamedOptionModule [ "services" "grafana" "auth" "azuread" "allowedDomains" ] [ "services" "grafana" "settings" "auth.azuread" "allowed_domains" ])
          (mkRenamedOptionModule [ "services" "grafana" "auth" "azuread" "allowedGroups" ] [ "services" "grafana" "settings" "auth.azuread" "allowed_groups" ])
          (mkRenamedOptionModule [ "services" "grafana" "auth" "google" "enable" ] [ "services" "grafana" "settings" "auth.google" "enabled" ])
          (mkRenamedOptionModule [ "services" "grafana" "auth" "google" "allowSignUp" ] [ "services" "grafana" "settings" "auth.google" "allow_sign_up" ])
          (mkRenamedOptionModule [ "services" "grafana" "auth" "google" "clientId" ] [ "services" "grafana" "settings" "auth.google" "client_id" ])

nadrog · January 6, 2024, 5:25pm

Yes, it does seem obvious except that I thought that the options at search.nixos.org/options are autogenerated based on the nix you referenced so they include all the options.

BTW, it’s slightly different: services.grafana.settings."auth.anonymous".enabled

Thanks!

APCodes · January 6, 2024, 5:28pm

Yes, that confused me too. That is why I wasn’t sure if it is really properly implemented. The fact that the option doesn’t show up in search is certainly a bug of sorts. Maybe you can write a bug report (after looking if it’s not already known of course). But it’s great if it works anyways.

You’re welcome!

nadrog · January 6, 2024, 5:37pm

Well, for now, I’m only sure that the option can be set. I’m not sure about its effect yet. Seems to me it doesn’t work, but I will check more thoroughly and report back.

nadrog · January 20, 2024, 5:25pm

Just tested it. The following config works for me:

services.grafana.settings.auth.disable_login_form = true;
services.grafana.settings."auth.anonymous".enabled = true;