Vonng · Nov 4, 2026
diff --git a/conf/demo/debian.yml b/conf/demo/debian.yml
@@ -373,6 +373,7 @@ all:
     grafana_clean: false              # clean grafana data during init?
     grafana_admin_username: admin     # grafana admin username, `admin` by default
     grafana_admin_password: pigsty    # grafana admin password, `pigsty` by default
+    grafana_anon_enabled: true        # enable anonymous access with the Viewer role?
     grafana_auth_proxy: false         # enable grafana auth proxy?
     grafana_pgurl: ''                 # external postgres database url for grafana if given
     grafana_view_password: DBUser.Viewer # password for grafana meta pg datasource

diff --git a/conf/demo/el.yml b/conf/demo/el.yml
@@ -377,6 +377,7 @@ all:
     grafana_clean: false              # clean grafana data during init?
     grafana_admin_username: admin     # grafana admin username, `admin` by default
     grafana_admin_password: pigsty    # grafana admin password, `pigsty` by default
+    grafana_anon_enabled: true        # enable anonymous access with the Viewer role?
     grafana_auth_proxy: false         # enable grafana auth proxy?
     grafana_pgurl: ''                 # external postgres database url for grafana if given
     grafana_view_password: DBUser.Viewer # password for grafana meta pg datasource

diff --git a/files/cmdb.sql b/files/cmdb.sql
@@ -1360,6 +1360,7 @@ INSERT INTO pigsty.default_var VALUES
 (195, 'grafana_auth_proxy', 'false', 'INFRA', 'GRAFANA', 'bool', 'G', 'enable grafana auth proxy?', NULL),
 (196, 'grafana_pgurl', '""', 'INFRA', 'GRAFANA', 'url', 'G', 'external postgres database url for grafana if given', NULL),
 (197, 'grafana_view_password', '"DBUser.Viewer"', 'INFRA', 'GRAFANA', 'password', 'G', 'password for grafana meta pg datasource', NULL),
+(198, 'grafana_anon_enabled', 'true', 'INFRA', 'GRAFANA', 'bool', 'G/I', 'enable anonymous access with the Viewer role?', NULL),
 
 -- NODE PARAMETERS
 (201, 'nodename', NULL, 'NODE', 'NODE_ID', 'string', 'I', 'node instance identity, use hostname if missing, optional', NULL),

diff --git a/roles/infra/README.md b/roles/infra/README.md
@@ -188,12 +188,38 @@ infra (full role)
 
 ### Grafana
 
-| Variable                 | Default  | Description    |
-|--------------------------|----------|----------------|
-| `grafana_enabled`        | `true`   | Enable Grafana |
-| `grafana_port`           | `3000`   | Listen port    |
-| `grafana_admin_username` | `admin`  | Admin username |
-| `grafana_admin_password` | `pigsty` | Admin password |
+| Variable                 | Default         | Description                                  |
+|--------------------------|-----------------|----------------------------------------------|
+| `grafana_enabled`        | `true`          | Enable Grafana                               |
+| `grafana_port`           | `3000`          | Listen port                                  |
+| `grafana_clean`          | `false`         | Clean Grafana data and configuration on init  |
+| `grafana_admin_username` | `admin`         | Admin username                               |
+| `grafana_admin_password` | `pigsty`        | Initial admin password                       |
+| `grafana_anon_enabled`   | `true`          | Allow anonymous access with the Viewer role   |
+| `grafana_auth_proxy`     | `false`         | Enable authentication through a trusted proxy |
+| `grafana_pgurl`          | `''`            | External PostgreSQL URL for Grafana's own data |
+| `grafana_view_password`  | `DBUser.Viewer`  | Password for the `meta` PostgreSQL datasource |
+
+Anonymous access is enabled by default. Set `grafana_anon_enabled: false` in
+`all.vars` or the `infra` group's variables to require authentication:
+
+```yaml
+grafana_anon_enabled: false
+```
+
+Render the configuration and restart Grafana for the change to take effect:
+
+```bash
+./infra.yml -l infra -t grafana_config,grafana_launch
+```
+
+Use `-l <infra-node>` to apply the change to a single node. The `grafana_config`
+tag alone only writes the configuration. `grafana_auth_proxy` remains independent:
+enable it as needed when authentication is provided by a trusted reverse proxy.
+
+`grafana_view_password` authenticates the PostgreSQL datasource, not visitors to
+Grafana. Disabling anonymous access protects Grafana; other infrastructure
+endpoints still need their own network or portal access controls.
 
 ### Blackbox Exporter
 

diff --git a/roles/infra/defaults/main.yml b/roles/infra/defaults/main.yml
@@ -107,6 +107,7 @@ grafana_port: 3000                # default listen port for grafana
 grafana_clean: false              # clean grafana data during init?
 grafana_admin_username: admin     # grafana admin username, `admin` by default
 grafana_admin_password: pigsty    # grafana admin password, `pigsty` by default
+grafana_anon_enabled: true        # enable anonymous access with the Viewer role?
 grafana_auth_proxy: false         # enable grafana auth proxy?
 grafana_pgurl: ''                 # external postgres database url for grafana if given
 grafana_view_password: DBUser.Viewer # password for grafana meta pg datasource

diff --git a/roles/infra/templates/grafana/grafana.ini.j2 b/roles/infra/templates/grafana/grafana.ini.j2
@@ -699,7 +699,7 @@ default_language = en-US
 #################################### Anonymous Auth ######################
 [auth.anonymous]
 # enable anonymous access
-enabled = true
+enabled = {{ grafana_anon_enabled|default(true)|bool|lower }}
 
 # specify organization name that should be used for unauthenticated users
 org_name = Pigsty