Commit 8129a2d1 authored by Tony Wasserka's avatar Tony Wasserka
Browse files

nixos/grafana: Drop hardcoded default secret 

This reflects the upstream change https://github.com/grafana/grafana/pull/115676 .
It is too easy to accidentally ship this key in a production setup, so just
require the user to provide it instead.
parent 2d027a41

nixos/modules/services/monitoring/grafana.nix

+8 −2
Original line number Diff line number Diff line
@@ -876,13 +876,19 @@ in 


            secret_key = mkOption {

              description = ''

                Secret key used for signing. Please note that the contents of this option

                Secret key used for signing data source settings like secrets and passwords.

                Set this to a unique, random string in production, generated for example by running `openssl rand -hex 32`.



                If you change this later you will need to update data source settings to re-encode them.



                <https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#secret_key>



                Please note that the contents of this option

                will end up in a world-readable Nix store. Use the file provider

                pointing at a reasonably secured file in the local filesystem

                to work around that. Look at the documentation for details:

                <https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#file-provider>

              '';

              default = "SW2YcwTIb9zpOOhoPsMm";

              type = types.str;

            };

nixos/tests/grafana/basic.nix

+1 −0
Original line number Diff line number Diff line
@@ -18,6 +18,7 @@ import ../make-test-python.nix ( 
          security = {

            admin_user = "testadmin";

            admin_password = "snakeoilpwd";

            secret_key = "11111111111111111111";

          };

        };

      };

nixos/tests/grafana/provision/default.nix

+1 −0
Original line number Diff line number Diff line
@@ -19,6 +19,7 @@ import ../../make-test-python.nix ( 
          security = {

            admin_user = "testadmin";

            admin_password = "$__file{${pkgs.writeText "pwd" "snakeoilpwd"}}";

            secret_key = "11111111111111111111";

          };

        };

      };