grafana: rebase grafana.ini to grafana 11.2.0-2

roles/grafana/templates/grafana.ini.j2

@@ -31,13 +31,13 @@ provisioning = /etc/grafana/provisioning
 # Protocol (http, https, h2, socket)
 ;protocol = http
 
-# This is the minimum TLS version allowed. By default, this value is empty. Accepted values are: TLS1.2, TLS1.3. If nothing is set TLS1.2 would be taken
+# Minimum TLS version allowed. By default, this value is empty. Accepted values are: TLS1.2, TLS1.3. If nothing is set TLS1.2 would be taken
 ;min_tls_version = ""
 
 # The ip address to bind to, empty will bind to all interfaces
 http_addr = 127.0.0.1
 
-# The http port  to use
+# The http port to use
 ;http_port = 3000
 
 # The public facing domain name used to access grafana from a browser
@@ -67,6 +67,9 @@ root_url = https://{{grafana_domain}}
 ;cert_file =
 ;cert_key =
 
+# optional password to be used to decrypt key file
+;cert_pass =
+
 # Certificates file watch interval
 ;certs_watch_interval =
 
@@ -94,6 +97,10 @@ root_url = https://{{grafana_domain}}
 #exampleHeader1 = exampleValue1
 #exampleHeader2 = exampleValue2
 
+[environment]
+# Sets whether the local file system is available for Grafana to use. Default is true for backward compatibility.
+;local_file_system_available = true
+
 #################################### GRPC Server #########################
 ;[grpc_server]
 ;network = "tcp"
@@ -103,6 +110,8 @@ root_url = https://{{grafana_domain}}
 ;key_file =
 ;max_recv_msg_size =
 ;max_send_msg_size =
+# this will log the request and response for each unary gRPC call
+;enable_logging = false
 
 #################################### Database ####################################
 [database]
@@ -116,11 +125,22 @@ root_url = https://{{grafana_domain}}
 ;user = root
 # If the password contains # or ; you have to wrap it with triple quotes. Ex """#password;"""
 ;password =
-
 # Use either URL or the previous fields to configure the database
 # Example: mysql://user:secret@host:port/database
 ;url =
 
+# Max idle conn setting default is 2
+;max_idle_conn = 2
+
+# Max conn setting default is 0 (mean not set)
+;max_open_conn =
+
+# Connection Max Lifetime default is 14400 (means 14400 seconds or 4 hours)
+;conn_max_lifetime = 14400
+
+# Set to true to log the sql calls and execution times.
+;log_queries =
+
 # For "postgres", use either "disable", "require" or "verify-full"
 # For "mysql", use either "true", "false", or "skip-verify".
 ;ssl_mode = disable
@@ -146,18 +166,6 @@ path = ":memory"
 ;path = grafana.db
 {% endif %}
 
-# Max idle conn setting default is 2
-;max_idle_conn = 2
-
-# Max conn setting default is 0 (mean not set)
-;max_open_conn =
-
-# Connection Max Lifetime default is 14400 (means 14400 seconds or 4 hours)
-;conn_max_lifetime = 14400
-
-# Set to true to log the sql calls and execution times.
-;log_queries =
-
 # For "sqlite3" only. cache mode setting used for connecting to the database. (private, shared)
 ;cache_mode = private
 
@@ -179,11 +187,6 @@ path = ":memory"
 # Set to true to add metrics and tracing for database queries.
 ;instrument_queries = false
 
-################################### Data sources #########################
-[datasources]
-# Upper limit of data sources that Grafana will return. This limit is a temporary configuration and it will be deprecated when pagination will be introduced on the list data sources API.
-;datasource_limit = 5000
-
 #################################### Cache server #############################
 [remote_cache]
 # Either "redis", "memcached" or "database" default is "database"
@@ -304,9 +307,18 @@ check_for_updates = false
 # Intercom secret, optional, used to hash user_id before passing to Intercom via Rudderstack
 ;intercom_secret =
 
+# Application Insights connection string. Specify an URL string to enable this feature.
+;application_insights_connection_string =
+
+# Optional. Specifies an Application Insights endpoint URL where the endpoint string is wrapped in backticks ``.
+;application_insights_endpoint_url =
+
 # Controls if the UI contains any links to user feedback forms
 ;feedback_links_enabled = true
 
+# Static context that is being added to analytics events
+;reporting_static_context = grafanaInstance=12, os=linux
+
 #################################### Security ####################################
 [security]
 # disable creation of admin user on first start of grafana
@@ -387,6 +399,7 @@ cookie_samesite = strict
 # $NONCE in the template includes a random nonce.
 # $ROOT_PATH is server.root_url without the protocol.
 ;content_security_policy_report_only_template = """script-src 'self' 'unsafe-eval' 'unsafe-inline' 'strict-dynamic' $NONCE;object-src 'none';font-src 'self';style-src 'self' 'unsafe-inline' blob:;img-src * data:;base-uri 'self';connect-src 'self' grafana.com ws://$ROOT_PATH wss://$ROOT_PATH;manifest-src 'self';media-src 'none';form-action 'self';"""
+
 # Controls if old angular plugins are supported or not.
 ;angular_support_enabled = false
 
@@ -425,10 +438,7 @@ cookie_samesite = strict
 # creating and deleting snapshots.
 ;public_mode = false
 
-# remove expired snapshot
-;snapshot_remove_expired = true
-
-#################################### Dashboards History ##################
+#################################### Dashboards ##################
 [dashboards]
 # Number dashboard versions to keep (per dashboard). Default: 20, Minimum: 1
 ;versions_to_keep = 20
@@ -444,6 +454,30 @@ default_home_dashboard_path = /var/lib/grafana/public-dashboards/archive.json
 ;default_home_dashboard_path =
 {% endif %}
 
+################################### Data sources #########################
+[datasources]
+# Upper limit of data sources that Grafana will return. This limit is a temporary configuration and it will be deprecated when pagination will be introduced on the list data sources API.
+;datasource_limit = 5000
+
+# Number of queries to be executed concurrently. Only for the datasource supports concurrency.
+# For now only Loki and InfluxDB (with influxql) are supporting concurrency behind the feature flags.
+# Check datasource documentations for enabling concurrency.
+;concurrent_query_count = 10
+
+################################### SQL Data Sources #####################
+[sql_datasources]
+# Default maximum number of open connections maintained in the connection pool
+# when connecting to SQL based data sources
+;max_open_conns_default = 100
+
+# Default maximum number of idle connections maintained in the connection pool
+# when connecting to SQL based data sources
+;max_idle_conns_default = 100
+
+# Default maximum connection lifetime used when connecting
+# to SQL based data sources.
+;max_conn_lifetime_default = 14400
+
 #################################### Users ###############################
 [users]
 # disable user signup / registration
@@ -471,7 +505,7 @@ allow_sign_up = false
 ;login_hint = email or username
 ;password_hint = password
 
-# Default UI theme ("dark" or "light")
+# Default UI theme ("dark", "light" or "system")
 ;default_theme = dark
 
 # Default UI language (supported IETF language tag, such as en-US)
@@ -497,6 +531,9 @@ viewers_can_edit = true
 # The duration in time a verification email, used to update the email address of a user, remains valid before expiring. This setting should be expressed as a duration. Examples: 6h (hours), 2d (days), 1w (week). Default is 1h (1 hour).
 ;verification_email_max_lifetime_duration = 1h
 
+# Frequency of updating a user's last seen time. The minimum supported duration is 5m (5 minutes). The maximum supported duration is 1h (1 hour).
+;last_seen_update_interval = 15m
+
 # Enter a comma-separated list of users login to hide them in the Grafana UI. These users are shown to Grafana admins and themselves.
 ; hidden_users =
 
@@ -566,9 +603,6 @@ signout_redirect_url = https://accounts.archlinux.org/realms/archlinux/protocol/
 # Set to true to enable Azure authentication option for HTTP-based datasources.
 ;azure_auth_enabled = false
 
-# Set to skip the organization role from JWT login and use system's role assignment instead.
-; skip_org_role_sync = false
-
 # Use email lookup in addition to the unique ID provided by the IdP
 ;oauth_allow_insecure_email_lookup = false
 
@@ -597,6 +631,9 @@ org_role = Viewer
 # mask the Grafana version number for unauthenticated users
 hide_version = true
 
+# number of devices in total
+;device_limit =
+
 #################################### GitHub Auth ##########################
 [auth.github]
 ;name = GitHub
@@ -619,6 +656,12 @@ hide_version = true
 ;org_mapping =
 ;allow_assign_grafana_admin = false
 ;skip_org_role_sync = false
+;tls_skip_verify_insecure = false
+;tls_client_cert =
+;tls_client_key =
+;tls_client_ca =
+# GitHub OAuth apps does not provide refresh tokens and the access tokens never expires.
+;use_refresh_token = false
 
 #################################### GitLab Auth #########################
 [auth.gitlab]
@@ -646,6 +689,7 @@ hide_version = true
 ;tls_client_key =
 ;tls_client_ca =
 ;use_pkce = true
+;use_refresh_token = true
 
 #################################### Google Auth ##########################
 [auth.google]
@@ -670,7 +714,12 @@ hide_version = true
 ;org_mapping =
 ;allow_assign_grafana_admin = false
 ;skip_org_role_sync = false
+;tls_skip_verify_insecure = false
+;tls_client_cert =
+;tls_client_key =
+;tls_client_ca =
 ;use_pkce = true
+;use_refresh_token = true
 
 #################################### Grafana.com Auth ####################
 [auth.grafana_com]
@@ -684,6 +733,7 @@ hide_version = true
 ;scopes = user:email
 ;allowed_organizations =
 ;skip_org_role_sync = false
+;use_refresh_token = false
 
 #################################### Azure AD OAuth #######################
 [auth.azuread]
@@ -702,10 +752,12 @@ hide_version = true
 ;allowed_groups =
 ;allowed_organizations =
 ;role_attribute_strict = false
+;org_mapping =
 ;allow_assign_grafana_admin = false
 ;use_pkce = true
 # prevent synchronizing users organization roles
 ;skip_org_role_sync = false
+;use_refresh_token = true
 
 #################################### Okta OAuth #######################
 [auth.okta]
@@ -728,13 +780,19 @@ hide_version = true
 ; org_mapping =
 ;allow_assign_grafana_admin = false
 ;skip_org_role_sync = false
+;tls_skip_verify_insecure = false
+;tls_client_cert =
+;tls_client_key =
+;tls_client_ca =
 ;use_pkce = true
+;use_refresh_token = true
 
 {% if not grafana_anonymous_access %}
 #################################### Generic OAuth ##########################
 [auth.generic_oauth]
-enabled = true
 name = OAuth
+;icon = signin
+enabled = true
 allow_sign_up = true
 auto_login = true
 client_id = openid_grafana
@@ -745,6 +803,9 @@ email_attribute_name = email:primary
 email_attribute_path = email
 ;login_attribute_path =
 ;name_attribute_path =
+role_attribute_path = contains(roles[*], 'DevOps') && 'Admin'
+role_attribute_strict = true
+;groups_attribute_path =
 ;id_token_attribute_name =
 auth_url = https://accounts.archlinux.org/realms/archlinux/protocol/openid-connect/auth
 token_url = https://accounts.archlinux.org/realms/archlinux/protocol/openid-connect/token
@@ -754,11 +815,8 @@ api_url = https://accounts.archlinux.org/realms/archlinux/protocol/openid-connec
 ;allowed_domains =
 ;team_ids =
 ;allowed_organizations =
-role_attribute_path = contains(roles[*], 'DevOps') && 'Admin'
-role_attribute_strict = true
 ;org_attribute_path =
 ;org_mapping =
-;groups_attribute_path =
 ;team_ids_attribute_path =
 ;tls_skip_verify_insecure = false
 ;tls_client_cert =
@@ -767,6 +825,8 @@ role_attribute_strict = true
 ;use_pkce = false
 ;auth_style =
 ;allow_assign_grafana_admin = false
+;skip_org_role_sync = false
+;use_refresh_token = false
 {% endif %}
 
 #################################### Basic Auth ##########################
@@ -791,6 +851,7 @@ role_attribute_strict = true
 #################################### Auth JWT ##########################
 [auth.jwt]
 ;enabled = true
+;enable_login_token = false
 ;header_name = X-JWT-Assertion
 ;email_claim = sub
 ;username_claim = sub
@@ -804,11 +865,13 @@ role_attribute_strict = true
 # Use in conjunction with key_file in case the JWT token's header specifies a key ID in "kid" field
 ;key_id = some-key-id
 ;role_attribute_path =
-;groups_attribute_path =
 ;role_attribute_strict = false
+;groups_attribute_path =
 ;auto_sign_up = false
 ;url_login = false
 ;allow_assign_grafana_admin = false
+;skip_org_role_sync = false
+;signout_redirect_url =
 
 #################################### Auth LDAP ##########################
 [auth.ldap]
@@ -930,6 +993,10 @@ role_attribute_strict = true
 # By default this will include all Grafana Labs owned Azure plugins, or those that make use of Azure settings (Azure Monitor, Azure Data Explorer, Prometheus, MSSQL).
 ;forward_settings_to_plugins = grafana-azure-monitor-datasource, prometheus, grafana-azure-data-explorer-datasource, mssql
 
+# Specifies whether Entra password auth can be used for the MSSQL data source
+# Disabled by default, needs to be explicitly enabled
+;azure_entra_password_credentials_enabled = false
+
 #################################### Role-based Access Control ###########
 [rbac]
 ;permission_cache = true
@@ -1052,6 +1119,9 @@ mode = syslog
 # Should webvitals instrumentation be enabled, only affects Grafana Javascript Agent
 ;instrumentations_webvitals_enabled = false
 
+# Should tracing instrumentation be enabled, only affects Grafana Javascript Agent
+;instrumentations_tracing_enabled = false
+
 # Api Key, only applies to Grafana Javascript Agent provider
 ;api_key = testApiKey
 
@@ -1096,6 +1166,9 @@ mode = syslog
 # global limit of alerts
 ;global_alert_rule = -1
 
+# global limit of files uploaded to the SQL DB
+;global_file = 1000
+
 # global limit of correlations
 ; global_correlations = -1
 
@@ -1103,6 +1176,11 @@ mode = syslog
 # This is not strictly enforced yet, but will be enforced over time.
 ;alerting_rule_group_rules = 100
 
+# Limit the number of query evaluation results per alert rule.
+# If the condition query of an alert rule produces more results than this limit,
+# the evaluation results in an error.
+;alerting_rule_evaluation_results = -1
+
 #################################### Unified Alerting ####################
 [unified_alerting]
 #Enable the Unified Alerting sub-system and interface. When enabled we'll migrate all of your alert rules and notification channels to the new system. New alert rules will be created and your notification channels will be converted into an Alertmanager configuration. Previous data is preserved to enable backwards compatibility but new data is removed.```
@@ -1119,6 +1197,13 @@ mode = syslog
 # The interval string is a possibly signed sequence of decimal numbers, followed by a unit suffix (ms, s, m, h, d), e.g. 30s or 1m.
 ;alertmanager_config_poll_interval = 60s
 
+
+# Maximum number of active and pending silences that a tenant can have at once. Default: 0 (no limit).
+;alertmanager_max_silences_count =
+
+# Maximum silence size in bytes. Default: 0 (no limit).
+;alertmanager_max_silence_size_bytes =
+
 # Set to true when using redis in cluster mode.
 ;ha_redis_cluster_mode_enabled = false
 
@@ -1200,6 +1285,10 @@ mode = syslog
 # The interval string is a possibly signed sequence of decimal numbers, followed by a unit suffix (ms, s, m, h, d), e.g. 30s or 1m.
 ;ha_gossip_interval = "200ms"
 
+# Length of time to attempt to reconnect to a lost peer. Recommended to be short (<15m) when Grafana is running in a Kubernetes cluster.
+# The string is a possibly signed sequence of decimal numbers, followed by a unit suffix (ms, s, m, h, d), e.g. 30s or 1m.
+;ha_reconnect_timeout = 6h
+
 # The interval between gossip full state syncs. Setting this interval lower (more frequent) will increase convergence speeds
 # across larger clusters at the expense of increased bandwidth usage.
 # The interval string is a possibly signed sequence of decimal numbers, followed by a unit suffix (ms, s, m, h, d), e.g. 30s or 1m.
@@ -1235,6 +1324,38 @@ mode = syslog
 # Retention period for Alertmanager notification log entries.
 ;notification_log_retention = 5d
 
+# Duration for which a resolved alert state transition will continue to be sent to the Alertmanager.
+;resolved_alert_retention = 15m
+
+[unified_alerting.screenshots]
+# Enable screenshots in notifications. You must have either installed the Grafana image rendering
+# plugin, or set up Grafana to use a remote rendering service.
+# For more information on configuration options, refer to [rendering].
+;capture = false
+
+# The timeout for capturing screenshots. If a screenshot cannot be captured within the timeout then
+# the notification is sent without a screenshot. The maximum duration is 30 seconds. This timeout
+# should be less than the minimum Interval of all Evaluation Groups to avoid back pressure on alert
+# rule evaluation.
+;capture_timeout = 10s
+
+# The maximum number of screenshots that can be taken at the same time. This option is different from
+# concurrent_render_request_limit as max_concurrent_screenshots sets the number of concurrent screenshots
+# that can be taken at the same time for all firing alerts where as concurrent_render_request_limit sets
+# the total number of concurrent screenshots across all Grafana services.
+;max_concurrent_screenshots = 5
+
+# Uploads screenshots to the local Grafana server or remote storage such as Azure, S3 and GCS. Please
+# see [external_image_storage] for further configuration options. If this option is false then
+# screenshots will be persisted to disk for up to temp_data_lifetime.
+;upload_external_image_storage = false
+
+[unified_alerting.reserved_labels]
+# Comma-separated list of reserved labels added by the Grafana Alerting engine that should be disabled.
+# For example: `disabled_labels=grafana_folder`
+disabled_labels =
+
+
 [unified_alerting.reserved_labels]
 # Comma-separated list of reserved labels added by the Grafana Alerting engine that should be disabled.
 # For example: `disabled_labels=grafana_folder`
@@ -1289,6 +1410,12 @@ mode = syslog
 # Optional max query length for queries sent to Loki. Default is 721h which matches the default Loki value.
 ; loki_max_query_length = 360h
 
+# For "loki" only.
+# Maximum size in bytes for queries sent to Loki. This limit is applied to user provided filters as well as system defined ones, e.g. applied by access control.
+# If filter exceeds the limit, API returns error with code "alerting.state-history.loki.requestTooLong".
+# Default is 64kb
+;loki_max_query_size = 65536
+
 [unified_alerting.state_history.external_labels]
 # Optional extra labels to attach to outbound state history records or log streams.
 # Any number of label key-value-pairs can be provided.
@@ -1305,6 +1432,24 @@ max_age =
 # Configures max number of alert annotations that Grafana stores. Default value is 0, which keeps all alert annotations.
 max_annotations_to_keep =
 
+#################################### Recording Rules #####################
+[recording_rules]
+# Target URL (including write path) for recording rules.
+url =
+
+# Optional username for basic authentication on recording rule write requests. Can be left blank to disable basic auth
+basic_auth_username =
+
+# Optional assword for basic authentication on recording rule write requests. Can be left blank.
+basic_auth_password =
+
+# Request timeout for recording rule writes.
+timeout = 30s
+
+# Optional custom headers to include in recording rule write requests.
+[recording_rules.custom_headers]
+# exampleHeader = exampleValue
+
 #################################### Annotations #########################
 [annotations]
 # Configures the batch size for the annotation clean-up job. This setting is used for dashboard, API, and alert annotations.
@@ -1365,6 +1510,11 @@ max_annotations_to_keep =
 # Enable the Query history
 ;enabled = true
 
+#################################### Short Links #############################
+[short_links]
+# Short links which are never accessed will be deleted as cleanup. Time is in days. Default is 7 days. Max is 365. 0 means they will be deleted approximately every 10 minutes.
+;expire_time = 7
+
 #################################### Internal Grafana Metrics ##########################
 # Metrics available at HTTP URL /metrics and /metrics/plugins/:pluginId
 [metrics]
@@ -1472,14 +1622,16 @@ max_annotations_to_keep =
 
 [external_image_storage.webdav]
 ;url =
-;public_url =
 ;username =
 ;password =
+;public_url =
 
 [external_image_storage.gcs]
 ;key_file =
 ;bucket =
 ;path =
+;enable_signed_urls = false
+;signed_url_expiration =
 
 [external_image_storage.azure_blob]
 ;account_name =
@@ -1506,6 +1658,12 @@ max_annotations_to_keep =
 # Default is 5m. This should be more than enough for most deployments.
 # Change the value only if image rendering is failing and you see `Failed to get the render key from cache` in Grafana logs.
 ;render_key_lifetime = 5m
+# Default width for panel screenshot
+;default_image_width = 1000
+# Default height for panel screenshot
+;default_image_height = 500
+# Default scale for panel screenshot
+;default_image_scale = 1
 
 [panels]
 # If set to true Grafana will allow script tags in text panels. Not recommended as it enable XSS vulnerabilities.
@@ -1585,6 +1743,10 @@ max_annotations_to_keep =
 # Default is false. This can be useful to enable (true) when troubleshooting.
 ;rendering_dumpio =
 
+# Instruct headless browser instance whether to register metrics for the duration of every rendering step. Default is false.
+# This can be useful to enable (true) when optimizing the rendering mode settings to improve the plugin performance or when troubleshooting.
+;rendering_timing_metrics =
+
 # Additional arguments to pass to the headless browser instance. Default is --no-sandbox. The list of Chromium flags can be found
 # here (https://peter.sh/experiments/chromium-command-line-switches/). Multiple arguments is separated with comma-character.
 ;rendering_args =
@@ -1618,14 +1780,6 @@ max_annotations_to_keep =
 ;grpc_host =
 ;grpc_port =
 
-[support_bundles]
-# Enable support bundle creation (default: true)
-#enabled = true
-# Only server admins can generate and view support bundles (default: true)
-#server_admin_only = true
-# If set, bundles will be encrypted with the provided public keys separated by whitespace
-#public_keys = ""
-
 [enterprise]
 # Path to a valid Grafana Enterprise license.jwt file
 ;license_path =
@@ -1678,6 +1832,15 @@ max_annotations_to_keep =
 # Enable or disable loading other base map layers
 ;enable_custom_baselayers = true
 
+#################################### Support Bundles #####################################
+[support_bundles]
+# Enable support bundle creation (default: true)
+#enabled = true
+# Only server admins can generate and view support bundles (default: true)
+#server_admin_only = true
+# If set, bundles will be encrypted with the provided public keys separated by whitespace
+#public_keys = ""
+
 # Move an app plugin referenced by its id (including all its pages) to a specific navigation section
 [navigation.app_sections]
 # The following will move an app plugin with the id of `my-app-id` under the `cfg` section
@@ -1718,3 +1881,36 @@ max_annotations_to_keep =
 [public_dashboards]
 # Set to false to disable public dashboards
 ;enabled = true
+
+###################################### Cloud Migration ######################################
+[cloud_migration]
+# Set to true to enable target-side migration UI
+;is_target = false
+# Token used to send requests to grafana com
+;gcom_api_token = ""
+# How long to wait for a request sent to gms to start a snapshot to complete
+;start_snapshot_timeout = 5s
+# How long to wait for a request sent to gms to validate a key to complete
+;validate_key_timeout = 5s
+# How long to wait for a request sent to gms to get a snapshot status to complete
+;get_snapshot_status_timeout = 5s
+# How long to wait for a request sent to gms to create a presigned upload url
+;create_upload_url_timeout = 5s
+# How long to wait for a request sent to gms to report an event
+;report_event_timeout = 5s
+# How long to wait for a request to fetch an instance to complete
+;fetch_instance_timeout = 5s
+# How long to wait for a request to create an access policy to complete
+;create_access_policy_timeout = 5s
+# How long to wait for a request to create to fetch an access policy to complete
+;fetch_access_policy_timeout = 5s
+# How long to wait for a request to create to delete an access policy to complete
+;delete_access_policy_timeout = 5s
+# The domain name used to access cms
+;domain = grafana-dev.net
+# Folder used to store snapshot files. Defaults to the home dir
+;snapshot_folder = ""
+# Link to form to give feedback on the feature
+;feedback_url = ""
+# How frequently should the frontend UI poll for changes while resources are migrating
+;frontend_poll_interval = 2s