apiVersion: v1
kind: ConfigMap
metadata:
  name: grafana-config
data:
  grafana.ini: |
    [server]
    # Protocol (http or https)
    protocol = https

    # The ip address to bind to, empty will bind to all interfaces
    ;http_addr =

    # The http port  to use
    http_port = 3000

    # The public facing domain name used to access grafana from a browser
    domain = 131.154.97.69

    # Redirect to correct domain if host header does not match domain
    # Prevents DNS rebinding attacks
    enforce_domain = false

    # The full public facing url you use in browser, used for redirects and emails
    # If you use reverse proxy and sub path specify full url (with sub path)
    root_url = https://131.154.97.69:31001

    # Log web requests
    router_logging = false

    # the path relative working path
    static_root_path = public

    # enable gzip
    enable_gzip = false

    # https certs & key file
    cert_file = /etc/grafana/tls.crt
    cert_key = /etc/grafana/tls.key
    #################################### Security ####################################
    [security]
    # disable creation of admin user on first start of grafana
    disable_initial_admin_creation = false

    # default admin user, created on startup
    admin_user = admin

    # default admin password, can be changed before first start of grafana,  or in profile settings
    admin_password = admin

    # used for signing
    secret_key = SW2YcwTIb9zpOOhoPsMm

    # disable gravatar profile images
    disable_gravatar = false

    # data source proxy whitelist (ip_or_domain:port separated by spaces)
    ;data_source_proxy_whitelist =

    # disable protection against brute force login attempts
    disable_brute_force_login_protection = false
    
    # set to true if you host Grafana behind HTTPS. default is false.
    ;cookie_secure = false

    # set cookie SameSite attribute. defaults to `lax`. can be set to "lax", "strict", "none" and "disabled"
    ;cookie_samesite = lax

    # set to true if you want to allow browsers to render Grafana in a <frame>, <iframe>, <embed> or <object>. default is false.
    ;allow_embedding = false

    # Set to true if you want to enable http strict transport security (HSTS) response header.
    # This is only sent when HTTPS is enabled in this configuration.
    # HSTS tells browsers that the site should only be accessed using HTTPS.
    strict_transport_security = false

    # Sets how long a browser should cache HSTS. Only applied if strict_transport_security is enabled.
    strict_transport_security_max_age_seconds = 86400

    # Set to true if to enable HSTS preloading option. Only applied if strict_transport_security is enabled.
    strict_transport_security_preload = false

    # Set to true if to enable the HSTS includeSubDomains option. Only applied if strict_transport_security is enabled.
    strict_transport_security_subdomains = false

    # Set to true to enable the X-Content-Type-Options response header.
    # The X-Content-Type-Options response HTTP header is a marker used by the server to indicate that the MIME types advertised
    # in the Content-Type headers should not be changed and be followed.
    x_content_type_options = true

    # Set to true to enable the X-XSS-Protection header, which tells browsers to stop pages from loading
    # when they detect reflected cross-site scripting (XSS) attacks.
    x_xss_protection = true
    #################################### Users ###############################
    [users]
    # disable user signup / registration
    allow_sign_up = true

    # Allow non admin users to create organizations
    allow_org_create = true

    # Set to true to automatically assign new users to the default organization (id 1)
    auto_assign_org = true

    # Set this value to automatically add new users to the provided organization (if auto_assign_org above is set to true)
    auto_assign_org_id = 1

    # Default role new users will be automatically assigned (if disabled above is set to true)
    auto_assign_org_role = Viewer

    # Require email validation before sign up completes
    verify_email_enabled = true

    #  Background text for the user field on the login page
    login_hint = email or username
    password_hint = password

    # Default UI theme ("dark" or "light")
    default_theme = dark

    # External user management, these options affect the organization users view
    ;external_manage_link_url =
    ;external_manage_link_name =
    ;external_manage_info =

    # Viewers can edit/inspect dashboard settings in the browser. But not save the dashboard.
    viewers_can_edit = false

    # Editors can administrate dashboard, folders and teams they create
    editors_can_admin = false

    # The duration in time a user invitation remains valid before expiring. This setting should be expressed as a duration. Examples: 6h (hours), 2d (days), 1w (week). Default is 24h (24 hours). The minimum supported duration is 15m (15 minutes).
    user_invite_max_lifetime_duration = 24h
    [auth]
    # Login cookie name
    login_cookie_name = grafana_session

    # The maximum lifetime (duration) an authenticated user can be inactive before being required to login at next visit. Default is 7 days (7d). This setting should be expressed as a duration, e.g. 5m (minutes), 6h (hours), 10d (days), 2w (weeks), 1M (month). The lifetime resets at each successful token rotation.
    login_maximum_inactive_lifetime_duration = 3h

    # The maximum lifetime (duration) an authenticated user can be logged in since login time before being required to login. Default is 30 days (30d). This setting should be expressed as a duration, e.g. 5m (minutes), 6h (hours), 10d (days), 2w (weeks), 1M (month).
    login_maximum_lifetime_duration = 3h

    # How often should auth tokens be rotated for authenticated users when being active. The default is each 10 minutes.
    ;token_rotation_interval_minutes = 10

    # Set to true to disable (hide) the login form, useful if you use OAuth, defaults to false
    disable_login_form = false

    # Set to true to disable the signout link in the side menu. useful if you use auth.proxy, defaults to false
    disable_signout_menu = false

    # URL to redirect the user to after sign out
    ;signout_redirect_url =

    # Set to true to attempt login with OAuth automatically, skipping the login screen.
    # This setting is ignored if multiple OAuth providers are configured.
    ;oauth_auto_login = false

    # OAuth state max age cookie duration in seconds. Defaults to 600 seconds.
    ;oauth_state_cookie_max_age = 600

    # limit of api_key seconds to live before expiration
    ;api_key_max_seconds_to_live = -1

    # Set to true to enable SigV4 authentication option for HTTP-based datasources.
    ;sigv4_auth_enabled = false
 
