Grafana With Its Own Secret Key

grafana-server

Grafana on loopback, with its own secret key, Secure cookies and HSTS for the TLS proxy in front of it, and every default that talks to the outside switched off. Original role for EL 10, live-tested with podman on Rocky Linux 10.

Every unconfigured Grafana shares one secret key. secret_key encrypts data-source credentials in Grafana's database, and the package default (SW2YcwTIb9zpOOhoPsMm, in defaults.ini) is the same on every install that never set it - anyone with a copy of the database and that string reads every stored password. This role requires a key of yours and the live test greps the package's out of the rendered file.

The real defaults are not in /etc/grafana/grafana.ini. That file is a commented sample; /usr/share/grafana/conf/defaults.ini is what applies. The role writes a short grafana.ini in which every line is a decision, and the live test reads the settings back through /api/admin/settings - what Grafana runs with, not what a file says.

Off here, on in Grafana: publishing dashboard snapshots to Grafana Labs' public service, plugin update checks, feedback links, Gravatar lookups. Usage reporting and update checks are already off in the EL packaging (upstream ships them on); the role pins them so a package from elsewhere cannot turn them back on.

Loopback and Secure. Grafana speaks plain HTTP, so it listens on 127.0.0.1 for a TLS proxy (this catalogue's haproxy-tls or caddy-https), marks its cookies Secure and sends HSTS. On plain HTTP a browser will not keep the session cookie; the API still answers, which is what the live test uses.

The admin password seeds a new database. admin_password in the ini applies when Grafana creates its database; for an existing one run grafana cli admin reset-admin-password <new>. Placeholders are refused with grafana_server_refuse_placeholders: true.

License

Commercial - IaC Bazaar EULA. (c) IaC Bazaar.