services/grafana: setup oidc

modules/nixos/services/grafana.nix

···
   };
 
   config = mkIf cfg.enable {
+    sops.secrets.grafana = {
+      sopsFile = "${self}/secrets/services/grafana.yaml";
+    };
+
     services = {
       grafana = {
         enable = true;
···
             name = "grafana";
             user = "grafana";
             password = "grafana";
+          };
+
+          security.disable_gravatar = true;
+
+          auth = {
+            generic_oauth = {
+              enabled = true;
+              client_id = "fc40c281-9f05-4907-8c85-17c265fbc7c5";
+              client_secret = builtins.readFile config.sops.secrets.grafana.path;
+              scopes = "openid profile email";
+              auth_url = "https://id.diogocastro.net/authorize";
+              token_url = "https://id.diogocastro.net/api/oidc/token";
+              api_url = "";
+              signout_redirect_url = "";
+              allow_sign_up = false;
+              auto_login = "false";
+              email_attribute_name = "email:primary";
+              skip_org_role_sync = false;
+            };
           };
         };
 

secrets/services/grafana.yaml

···
+grafana: ENC[AES256_GCM,data:pARheSOsQv2L4Wk1/BGHnEiZxGht5QwdixuK0gRln6o=,iv:bWFrdC3YY0kWjzqHSl6DYlucGqLc+cMc+Vq/jQ489ds=,tag:XnZoe1swyMDr4Dy2aGjQXQ==,type:str]
+sops:
+    age:
+        - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICCTbCHJ0avif6MQ7izXlHHaubNsOhU2xf9lMvXKLyUQ
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IEZnTXFHQSBnS3dQ
+            OVpQUm51dWZzTENOUzArcmJuN1cvWituSTQxTGsrRGVnbTRha0YwCi9IM3dqbTFt
+            d0hNRFFuVUhkRzBZK1FYb3c2VnB6dU5mRmdMdUZkRGdRNE0KLS0tIDN1Y1JKQUZO
+            QTljdkJkRGpFMjJOVUc5TjVzUDFZZ3A3K2MxUFg3d2ZSZDgK7q3VTXR3u4vXCHSo
+            SiHjk6lFAxrFDel45XMmJc2lGlnivO1LmwyqXX7FqdGzWWj+XfWIlFitmCHiOf1X
+            W8yHDg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1x6rgrjkj0sx32apkg7fzsrgns8t524h3th0m8s30u08vl9lge9jqcvulxt
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpb0dlNmdxc1NkUW5FY1FO
+            ZHFDUENqWkdtcGtFby9FSlRMRkhMWFRUdlFzCis0b3J1cVFtaVR5ZkhBSEVEb1Ux
+            cGdWQ0lUYWtKSWRNL3lKclNOem9WQjAKLS0tIDErdHZQcG43SktwMFg1WXZNelB3
+            VlhoZ1NuQzY1L1psSnNmb1ZXSzgrUE0KteE2Ra7J0hGbeUKqAd3tQkuXUS2NZfl1
+            ZAeNshFaqw3RuIu29C6C8qKbB7QmCp5MIYH/BrOIZNEgAoB/a21zQg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-12-09T10:38:54Z"
+    mac: ENC[AES256_GCM,data:iU0jUtAr5PQbfxQtPMdhdB6aa44xsIoYd4hwLnEqQqLMemTwPJZmHxDubjQYrpBRkx6FlwF7Fw+1kxGV+4OjdX2A0BHjktQByCggIe/FwTbYGrAFuXT8VKBqtPWZtOtWsqPGcHJ/C99z7MKjIrk0ualqNcpM2NFnmgiiQgZsiqg=,iv:Wy2dBD7Y+PKzzarH4lyl5elBeSVJ+6qi1JCBLPjiyNI=,tag:icIOCfx1QBYhWpnZEfKU/A==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0