Skip to content

feat(infra): make Grafana anonymous access configurable - #795

Draft
Vonng wants to merge 1 commit into
mainfrom
codex/grafana-auth-anon
Draft

Vonng wants to merge 1 commit into
mainfrom
codex/grafana-auth-anon

Conversation

@Vonng

@Vonng Vonng commented Nov 4, 2026 •

Copy link
Copy Markdown
Member

Grafana anonymous access is hardcoded to true, so operators cannot persistently require authentication through the inventory. Add grafana_anon_enabled (default true) to control [auth.anonymous].enabled. Setting it to false survives configuration re-renders; grafana_auth_proxy remains independent and the anonymous role remains Viewer.

Update INFRA defaults, CMDB metadata (ID 198, boolean, G/I), complete EL/Debian inventories, and the role README. Applying the setting requires grafana_config,grafana_launch. Clarify that grafana_view_password belongs to the PostgreSQL datasource.

Validation:

  • 28 full-template render cases using Ansible's boolean filter, covering omitted/default/explicit/string values, both proxy settings, and both UI languages; output otherwise matches the previous template.
  • Ansible syntax check, YAML and CMDB metadata validation, and consistency checks across the README and bilingual examples.
  • Both documentation sites passed make check, including Hugo rendering and full internal-link scans. No old variable names remain in the implementation or documentation source.

Documentation committed directly to main:

Closes #782.

@Vonng
Vonng force-pushed the codex/grafana-auth-anon branch from 21a140c to 8d31ab7 Compare November 4, 2026 23:57

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

grafana: anonymous access is enabled by default with no variable to disable it, and the template overwrites any manual change

1 participant