apiVersion: v1
kind: ConfigMap
metadata:
  name: k8sdc-grafana
  namespace: k8sdc-system
  #namespace: {{ .namespace }}
  labels:
    app: k8sdc-grafana
    heritage: k8sdc
data:
  grafana.ini: |
    ##################### Grafana Configuration Example #####################
    #
    # Everything has defaults so you only need to uncomment things you want to
    # change

    # possible values : production, development
    ; app_mode = production

    #################################### Paths ####################################
    [paths]
    # Path to where grafana can store temp files, sessions, and the sqlite3 db (if that is used)
    #
    ;data = /var/lib/grafana
    #
    # Directory where grafana can store logs
    #
    ;logs = /var/log/grafana
    #
    # Directory where grafana will automatically scan and look for plugins
    #
    ;plugins = /var/lib/grafana/plugins

    #
    #################################### Server ####################################
    [server]
    # Protocol (http or https)
    ;protocol = http

    # The ip address to bind to, empty will bind to all interfaces
    ;http_addr =

    # The http port  to use
    ;http_port = 3000

    # The public facing domain name used to access grafana from a browser
    ;domain = localhost

    # Redirect to correct domain if host header does not match domain
    # Prevents DNS rebinding attacks
    ;enforce_domain = false

    # The full public facing url
    ;root_url = %(protocol)s://%(domain)s:%(http_port)s/

    # Log web requests
    ;router_logging = false

    # the path relative working path
    ;static_root_path = public

    # enable gzip
    ;enable_gzip = false

    # https certs & key file
    ;cert_file =
    ;cert_key =

    #################################### Database ####################################
    [database]
    # Either "mysql", "postgres" or "sqlite3", it's your choice
    ;type = sqlite3
    ;host = 127.0.0.1:3306
    ;name = grafana
    ;user = root
    ;password =

    # For "postgres" only, either "disable", "require" or "verify-full"
    ;ssl_mode = disable

    # For "sqlite3" only, path relative to data_path setting
    ;path = grafana.db

    #################################### Session ####################################
    [session]
    # Either "memory", "file", "redis", "mysql", "postgres", default is "file"
    ;provider = file

    # Provider config options
    # memory: not have any config yet
    # file: session dir path, is relative to grafana data_path
    # redis: config like redis server e.g. `addr=127.0.0.1:6379,pool_size=100,db=grafana`
    # mysql: go-sql-driver/mysql dsn config string, e.g. `user:password@tcp(127.0.0.1:3306)/database_name`
    # postgres: user=a password=b host=localhost port=5432 dbname=c sslmode=disable
    ;provider_config = sessions

    # Session cookie name
    ;cookie_name = grafana_sess

    # If you use session in https only, default is false
    ;cookie_secure = false

    # Session life time, default is 86400
    ;session_life_time = 86400

    #################################### Analytics ####################################
    [analytics]
    # Server reporting, sends usage counters to stats.grafana.org every 24 hours.
    # No ip addresses are being tracked, only simple counters to track
    # running instances, dashboard and error counts. It is very helpful to us.
    # Change this option to false to disable reporting.
    ;reporting_enabled = true

    # Set to false to disable all checks to https://grafana.net
    # for new vesions (grafana itself and plugins), check is used
    # in some UI views to notify that grafana or plugin update exists
    # This option does not cause any auto updates, nor send any information
    # only a GET request to http://grafana.net to get latest versions
    check_for_updates = true

    # Google Analytics universal tracking code, only enabled if you specify an id here
    ;google_analytics_ua_id =

    #################################### Security ####################################
    [security]
    # default admin user, created on startup
    ;admin_user = admin

    # default admin password, can be changed before first start of grafana,  or in profile settings
    ;admin_password = admin

    # used for signing
    ;secret_key = SW2YcwTIb9zpOOhoPsMm

    # Auto-login remember days
    ;login_remember_days = 7
    ;cookie_username = grafana_user
    ;cookie_remember_name = grafana_remember

    # disable gravatar profile images
    ;disable_gravatar = false

    # data source proxy whitelist (ip_or_domain:port seperated by spaces)
    ;data_source_proxy_whitelist =

    [snapshots]
    # snapshot sharing options
    ;external_enabled = true
    ;external_snapshot_url = https://snapshots-origin.raintank.io
    ;external_snapshot_name = Publish to snapshot.raintank.io

    #################################### Users ####################################
    [users]
    # disable user signup / registration
    ;allow_sign_up = true

    # Allow non admin users to create organizations
    ;allow_org_create = true

    # Set to true to automatically assign new users to the default organization (id 1)
    ;auto_assign_org = true

    # Default role new users will be automatically assigned (if disabled above is set to true)
    ;auto_assign_org_role = Viewer

    # Background text for the user field on the login page
    ;login_hint = email or username

    #################################### Anonymous Auth ##########################
    [auth.anonymous]
    # enable anonymous access
    ;enabled = false

    # specify organization name that should be used for unauthenticated users
    ;org_name = Main Org.

    # specify role for unauthenticated users
    ;org_role = Viewer

    #################################### Github Auth ##########################
    [auth.github]
    ;enabled = false
    ;allow_sign_up = false
    ;client_id = some_id
    ;client_secret = some_secret
    ;scopes = user:email,read:org
    ;auth_url = https://github.com/login/oauth/authorize
    ;token_url = https://github.com/login/oauth/access_token
    ;api_url = https://api.github.com/user
    ;team_ids =
    ;allowed_organizations =

    #################################### Google Auth ##########################
    [auth.google]
    ;enabled = false
    ;allow_sign_up = false
    ;client_id = some_client_id
    ;client_secret = some_client_secret
    ;scopes = https://www.googleapis.com/auth/userinfo.profile https://www.googleapis.com/auth/userinfo.email
    ;auth_url = https://accounts.google.com/o/oauth2/auth
    ;token_url = https://accounts.google.com/o/oauth2/token
    ;api_url = https://www.googleapis.com/oauth2/v1/userinfo
    ;allowed_domains =

    #################################### Auth Proxy ##########################
    [auth.proxy]
    ;enabled = false
    ;header_name = X-WEBAUTH-USER
    ;header_property = username
    ;auto_sign_up = true

    #################################### Basic Auth ##########################
    [auth.basic]
    ;enabled = true

    #################################### Auth LDAP ##########################
    [auth.ldap]
    enabled = true
    config_file = /etc/grafana/ldap.toml

    #################################### SMTP / Emailing ##########################
    [smtp]
    ;enabled = false
    ;host = localhost:25
    ;user =
    ;password =
    ;cert_file =
    ;key_file =
    ;skip_verify = false
    ;from_address = admin@grafana.localhost

    [emails]
    ;welcome_email_on_sign_up = false

    #################################### Logging ##########################
    [log]
    # Either "console", "file", "syslog". Default is console and  file
    # Use comma to separate multiple modes, e.g. "console, file"
    ;mode = console, file

    # Buffer length of channel, keep it as it is if you don't know what it is.
    ;buffer_len = 10000

    # Either "Trace", "Debug", "Info", "Warn", "Error", "Critical", default is "Info"
    ;level = Info

    # For "console" mode only
    [log.console]
    ;level =

    # For "file" mode only
    [log.file]
    ;level =
    # This enables automated log rotate(switch of following options), default is true
    ;log_rotate = true

    # Max line number of single file, default is 1000000
    ;max_lines = 1000000

    # Max size shift of single file, default is 28 means 1 << 28, 256MB
    ;max_lines_shift = 28

    # Segment log daily, default is true
    ;daily_rotate = true

    # Expired days of log file(delete after max days), default is 7
    ;max_days = 7

    #################################### AMPQ Event Publisher ##########################
    [event_publisher]
    ;enabled = false
    ;rabbitmq_url = amqp://localhost/
    ;exchange = grafana_events

    ;#################################### Dashboard JSON files ##########################
    [dashboards.json]
    enabled = true
    path = /var/lib/grafana/dashboards

  ldap.toml: |
    # Set to true to log user information returned from LDAP
    verbose_logging = true

    [[servers]]
    # Ldap server host (specify multiple hosts space separated)
    host = "k8sdc-opendj"
    # Default port is 389 or 636 if use_ssl = true
    port = 389
    # Set to true if ldap server supports TLS
    use_ssl = false
    # set to true if you want to skip ssl cert validation
    ssl_skip_verify = false
    # set to the path to your root CA certificate or leave unset to use system defaults
    # root_ca_cert = /path/to/certificate.crt

    # Search user bind dn
    bind_dn = "uid=k8sdc,ou=Administrators,dc=k8sdc,dc=io"
    # Search user bind password
    bind_password = 'password'

    # User search filter, for example "(cn=%s)" or "(sAMAccountName=%s)" or "(uid=%s)"
    search_filter = "(uid=%s)"

    # An array of base dns to search through
    search_base_dns = ["dc=k8sdc,dc=io"]

    # In POSIX LDAP schemas, without memberOf attribute a secondary query must be made for groups.
    # This is done by enabling group_search_filter below. You must also set member_of= "cn"
    # in [servers.attributes] below.

    # Users with nested/recursive group membership and an LDAP server that supports LDAP_MATCHING_RULE_IN_CHAIN
    # can set group_search_filter, group_search_filter_user_attribute, group_search_base_dns and member_of
    # below in such a way that the user's recursive group membership is considered.
    #
    # Nested Groups + Active Directory (AD) Example:
    #
    #   AD groups store the Distinguished Names (DNs) of members, so your filter must
    #   recursively search your groups for the authenticating user's DN. For example:
    #
    #     group_search_filter = "(member:1.2.840.113556.1.4.1941:=%s)"
    #     group_search_filter_user_attribute = "distinguishedName"
    #     group_search_base_dns = ["ou=groups,dc=grafana,dc=org"]
    #
    #     [servers.attributes]
    #     ...
    #     member_of = "distinguishedName"

    ## Group search filter, to retrieve the groups of which the user is a member (only set if memberOf attribute is not available)
    # group_search_filter = "(&(objectClass=posixGroup)(memberUid=%s))"
    ## Group search filter user attribute defines what user attribute gets substituted for %s in group_search_filter.
    ## Defaults to the value of username in [server.attributes]
    ## Valid options are any of your values in [servers.attributes]
    ## If you are using nested groups you probably want to set this and member_of in
    ## [servers.attributes] to "distinguishedName"
    # group_search_filter_user_attribute = "distinguishedName"
    ## An array of the base DNs to search through for groups. Typically uses ou=groups
    group_search_base_dns = ["ou=Groups,dc=k8sdc,dc=io"]

    # Specify names of the ldap attributes your ldap uses
    [servers.attributes]
    name = "givenName"
    surname = "sn"
    username = "uid"
    member_of = "memberOf"
    email =  "email"

    # Map ldap groups to grafana org roles
    [[servers.group_mappings]]
    group_dn = "cn=grafana-admins,ou=Groups,dc=k8sdc,dc=io"
    org_role = "Admin"
    # The Grafana organization database id, optional, if left out the default org (id 1) will be used
    # org_id = 1

    [[servers.group_mappings]]
    group_dn = "cn=grafana-users,ou=Groups,dc=k8sdc,dc=io"
    org_role = "Editor"

    [[servers.group_mappings]]
    # If you want to match all (or no ldap groups) then you can use wildcard
    group_dn = "*"
    org_role = "Viewer"