Update grafana configuration file

roles/grafana/templates/grafana.ini.j2

@@ -28,7 +28,7 @@
 
 #################################### Server ####################################
 [server]
-# Protocol (http, https, socket)
+# Protocol (http, https, h2, socket)
 ;protocol = http
 
 # The ip address to bind to, empty will bind to all interfaces
@@ -48,6 +48,9 @@ domain = {{grafana_domain}}
 # If you use reverse proxy and sub path specify full url (with sub path)
 root_url = https://{{grafana_domain}}
 
+# Serve Grafana from subpath specified in `root_url` setting. By default it is set to `false` for compatibility reasons.
+;serve_from_sub_path = false
+
 # Log web requests
 ;router_logging = false
 
@@ -84,6 +87,11 @@ enable_gzip = true
 # For "postgres" only, either "disable", "require" or "verify-full"
 ;ssl_mode = disable
 
+;ca_cert_path =
+;client_key_path =
+;client_cert_path =
+;server_cert_name =
+
 # For "sqlite3" only, path relative to data_path setting
 ;path = grafana.db
 
@@ -97,32 +105,21 @@ enable_gzip = true
 ;conn_max_lifetime = 14400
 
 # Set to true to log the sql calls and execution times.
-log_queries =
+;log_queries =
 
 # For "sqlite3" only. cache mode setting used for connecting to the database. (private, shared)
 ;cache_mode = private
 
-#################################### Session ####################################
-[session]
-# Either "memory", "file", "redis", "mysql", "postgres", default is "file"
-;provider = file
-
-# Provider config options
-# memory: not have any config yet
-# file: session dir path, is relative to grafana data_path
-# redis: config like redis server e.g. `addr=127.0.0.1:6379,pool_size=100,db=grafana`
-# mysql: go-sql-driver/mysql dsn config string, e.g. `user:password@tcp(127.0.0.1:3306)/database_name`
-# postgres: user=a password=b host=localhost port=5432 dbname=c sslmode=disable
-;provider_config = sessions
-
-# Session cookie name
-;cookie_name = grafana_sess
+#################################### Cache server #############################
+[remote_cache]
+# Either "redis", "memcached" or "database" default is "database"
+;type = database
 
-# If you use session in https only, default is false
-;cookie_secure = false
-
-# Session life time, default is 86400
-;session_life_time = 86400
+# cache connectionstring options
+# database: will use Grafana primary database.
+# redis: config like redis server e.g. `addr=127.0.0.1:6379,pool_size=100,db=0,ssl=false`. Only addr is required. ssl may be 'true', 'false', or 'insecure'.
+# memcache: 127.0.0.1:11211
+;connstr =
 
 #################################### Data proxy ###########################
 [dataproxy]
@@ -133,6 +130,9 @@ log_queries =
 # How long the data proxy should wait before timing out default is 30 (seconds)
 ;timeout = 30
 
+# If enabled and user is not anonymous, data proxy will add X-Grafana-User header with username into the request, default is false.
+;send_user_header = false
+
 #################################### Analytics ####################################
 [analytics]
 # Server reporting, sends usage counters to stats.grafana.org every 24 hours.
@@ -156,6 +156,9 @@ log_queries =
 
 #################################### Security ####################################
 [security]
+# disable creation of admin user on first start of grafana
+;disable_initial_admin_creation = false
+
 # default admin user, created on startup
 admin_user = admin
 
@@ -177,9 +180,36 @@ admin_user = admin
 # set to true if you host Grafana behind HTTPS. default is false.
 cookie_secure = true
 
-# set cookie SameSite attribute. defaults to `lax`. can be set to "lax", "strict" and "none"
+# set cookie SameSite attribute. defaults to `lax`. can be set to "lax", "strict", "none" and "disabled"
 ;cookie_samesite = lax
 
+# set to true if you want to allow browsers to render Grafana in a <frame>, <iframe>, <embed> or <object>. default is false.
+;allow_embedding = false
+
+# Set to true if you want to enable http strict transport security (HSTS) response header.
+# This is only sent when HTTPS is enabled in this configuration.
+# HSTS tells browsers that the site should only be accessed using HTTPS.
+# The default version will change to true in the next minor release, 6.3.
+strict_transport_security = true
+
+# Sets how long a browser should cache HSTS. Only applied if strict_transport_security is enabled.
+strict_transport_security_max_age_seconds = 86400
+
+# Set to true if to enable HSTS preloading option. Only applied if strict_transport_security is enabled.
+;strict_transport_security_preload = false
+
+# Set to true if to enable the HSTS includeSubDomains option. Only applied if strict_transport_security is enabled.
+;strict_transport_security_subdomains = false
+
+# Set to true to enable the X-Content-Type-Options response header.
+# The X-Content-Type-Options response HTTP header is a marker used by the server to indicate that the MIME types advertised
+# in the Content-Type headers should not be changed and be followed. The default will change to true in the next minor release, 6.3.
+x_content_type_options = true
+
+# Set to true to enable the X-XSS-Protection header, which tells browsers to stop pages from loading
+# when they detect reflected cross-site scripting (XSS) attacks. The default will change to true in the next minor release, 6.3.
+x_xss_protection = true
+
 #################################### Snapshots ###########################
 [snapshots]
 # snapshot sharing options
@@ -187,6 +217,10 @@ cookie_secure = true
 ;external_snapshot_url = https://snapshots-origin.raintank.io
 ;external_snapshot_name = Publish to snapshot.raintank.io
 
+# Set true to enable this Grafana instance act as an external snapshot server and allow unauthenticated requests for
+# creating and deleting snapshots.
+;public_mode = false
+
 # remove expired snapshot
 ;snapshot_remove_expired = true
 
@@ -195,6 +229,10 @@ cookie_secure = true
 # Number dashboard versions to keep (per dashboard). Default: 20, Minimum: 1
 ;versions_to_keep = 20
 
+# Minimum dashboard refresh interval. When set, this will restrict users to set the refresh interval of a dashboard lower than given interval. Per default this is not set/unrestricted.
+# The interval string is a possibly signed sequence of decimal numbers, followed by a unit suffix (ms, s, m, h, d), e.g. 30s or 1m.
+;min_refresh_interval =
+
 #################################### Users ###############################
 [users]
 # disable user signup / registration
@@ -206,11 +244,18 @@ allow_sign_up = false
 # Set to true to automatically assign new users to the default organization (id 1)
 ;auto_assign_org = true
 
+# Set this value to automatically add new users to the provided organization (if auto_assign_org above is set to true)
+;auto_assign_org_id = 1
+
 # Default role new users will be automatically assigned (if disabled above is set to true)
 ;auto_assign_org_role = Viewer
 
+# Require email validation before sign up completes
+;verify_email_enabled = false
+
 # Background text for the user field on the login page
 ;login_hint = email or username
+;password_hint = password
 
 # Default UI theme ("dark" or "light")
 ;default_theme = dark
@@ -223,6 +268,9 @@ allow_sign_up = false
 # Viewers can edit/inspect dashboard settings in the browser. But not save the dashboard.
 ;viewers_can_edit = false
 
+# Editors can administrate dashboard, folders and teams they create
+;editors_can_admin = false
+
 [auth]
 # Login cookie name
 ;login_cookie_name = grafana_session
@@ -249,6 +297,9 @@ allow_sign_up = false
 # This setting is ignored if multiple OAuth providers are configured.
 ;oauth_auto_login = false
 
+# limit of api_key seconds to live before expiration
+;api_key_max_seconds_to_live = -1
+
 #################################### Anonymous Auth ######################
 [auth.anonymous]
 # enable anonymous access
@@ -270,9 +321,23 @@ allow_sign_up = false
 ;auth_url = https://github.com/login/oauth/authorize
 ;token_url = https://github.com/login/oauth/access_token
 ;api_url = https://api.github.com/user
+;allowed_domains =
 ;team_ids =
 ;allowed_organizations =
 
+#################################### GitLab Auth #########################
+[auth.gitlab]
+;enabled = false
+;allow_sign_up = true
+;client_id = some_id
+;client_secret = some_secret
+;scopes = api
+;auth_url = https://gitlab.com/oauth/authorize
+;token_url = https://gitlab.com/oauth/token
+;api_url = https://gitlab.com/api/v4
+;allowed_domains =
+;allowed_groups =
+
 #################################### Google Auth ##########################
 [auth.google]
 ;enabled = false
@@ -284,6 +349,29 @@ allow_sign_up = false
 ;token_url = https://accounts.google.com/o/oauth2/token
 ;api_url = https://www.googleapis.com/oauth2/v1/userinfo
 ;allowed_domains =
+;hosted_domain =
+
+#################################### Grafana.com Auth ####################
+[auth.grafana_com]
+;enabled = false
+;allow_sign_up = true
+;client_id = some_id
+;client_secret = some_secret
+;scopes = user:email
+;allowed_organizations =
+
+#################################### Azure AD OAuth #######################
+[auth.azuread]
+;name = Azure AD
+;enabled = false
+;allow_sign_up = true
+;client_id = some_client_id
+;client_secret = some_client_secret
+;scopes = openid email profile
+;auth_url = https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/authorize
+;token_url = https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/token
+;allowed_domains =
+;allowed_groups =
 
 #################################### Generic OAuth ##########################
 [auth.generic_oauth]
@@ -293,28 +381,64 @@ allow_sign_up = false
 ;client_id = some_id
 ;client_secret = some_secret
 ;scopes = user:email,read:org
+;email_attribute_name = email:primary
+;email_attribute_path =
 ;auth_url = https://foo.bar/login/oauth/authorize
 ;token_url = https://foo.bar/login/oauth/access_token
 ;api_url = https://foo.bar/user
+;allowed_domains =
 ;team_ids =
 ;allowed_organizations =
+;role_attribute_path =
 ;tls_skip_verify_insecure = false
 ;tls_client_cert =
 ;tls_client_key =
 ;tls_client_ca =
 
-; Set to true to enable sending client_id and client_secret via POST body instead of Basic authentication HTTP header
-; This might be required if the OAuth provider is not RFC6749 compliant, only supporting credentials passed via POST payload
-;send_client_credentials_via_post = false
-
-#################################### Grafana.com Auth ####################
-[auth.grafana_com]
+#################################### SAML Auth ###########################
+[auth.saml] # Enterprise only
+# Defaults to false. If true, the feature is enabled.
 ;enabled = false
-;allow_sign_up = true
-;client_id = some_id
-;client_secret = some_secret
-;scopes = user:email
-;allowed_organizations =
+
+# Base64-encoded public X.509 certificate. Used to sign requests to the IdP
+;certificate =
+
+# Path to the public X.509 certificate. Used to sign requests to the IdP
+;certificate_path =
+
+# Base64-encoded private key. Used to decrypt assertions from the IdP
+;private_key =
+
+;# Path to the private key. Used to decrypt assertions from the IdP
+;private_key_path =
+
+# Base64-encoded IdP SAML metadata XML. Used to verify and obtain binding locations from the IdP
+;idp_metadata =
+
+# Path to the SAML metadata XML. Used to verify and obtain binding locations from the IdP
+;idp_metadata_path =
+
+# URL to fetch SAML IdP metadata. Used to verify and obtain binding locations from the IdP
+;idp_metadata_url =
+
+# Duration, since the IdP issued a response and the SP is allowed to process it. Defaults to 90 seconds.
+;max_issue_delay = 90s
+
+# Duration, for how long the SP's metadata should be valid. Defaults to 48 hours.
+;metadata_valid_duration = 48h
+
+# Friendly name or name of the attribute within the SAML assertion to use as the user's name
+;assertion_attribute_name = displayName
+
+# Friendly name or name of the attribute within the SAML assertion to use as the user's login handle
+;assertion_attribute_login = mail
+
+# Friendly name or name of the attribute within the SAML assertion to use as the user's email
+;assertion_attribute_email = mail
+
+#################################### Basic Auth ##########################
+[auth.basic]
+;enabled = true
 
 #################################### Auth Proxy ##########################
 [auth.proxy]
@@ -322,13 +446,11 @@ allow_sign_up = false
 ;header_name = X-WEBAUTH-USER
 ;header_property = username
 ;auto_sign_up = true
-;ldap_sync_ttl = 60
+;sync_ttl = 60
 ;whitelist = 192.168.1.1, 192.168.2.1
 ;headers = Email:X-User-Email, Name:X-User-Name
-
-#################################### Basic Auth ##########################
-[auth.basic]
-;enabled = true
+# Read the auth proxy docs for details on what the setting below enables
+;enable_login_token = false
 
 #################################### Auth LDAP ##########################
 [auth.ldap]
@@ -336,12 +458,17 @@ allow_sign_up = false
 ;config_file = /etc/grafana/ldap.toml
 ;allow_sign_up = true
 
+# LDAP backround sync (Enterprise only)
+# At 1 am every day
+;sync_cron = "0 0 1 * * *"
+;active_sync_enabled = true
+
 #################################### SMTP / Emailing ##########################
 [smtp]
 ;enabled = false
 ;host = localhost:25
 ;user =
-# If the password contains # or ; you have to wrap it with trippel quotes. Ex """#password;"""
+# If the password contains # or ; you have to wrap it with triple quotes. Ex """#password;"""
 ;password =
 ;cert_file =
 ;key_file =
@@ -353,6 +480,7 @@ allow_sign_up = false
 
 [emails]
 ;welcome_email_on_sign_up = false
+;templates_pattern = emails/*.html
 
 #################################### Logging ##########################
 [log]
@@ -411,6 +539,41 @@ mode = syslog
 # Syslog tag. By default, the process' argv[0] is used.
 ;tag =
 
+#################################### Usage Quotas ########################
+[quota]
+; enabled = false
+
+#### set quotas to -1 to make unlimited. ####
+# limit number of users per Org.
+; org_user = 10
+
+# limit number of dashboards per Org.
+; org_dashboard = 100
+
+# limit number of data_sources per Org.
+; org_data_source = 10
+
+# limit number of api_keys per Org.
+; org_api_key = 10
+
+# limit number of orgs a user can create.
+; user_org = 10
+
+# Global limit of users.
+; global_user = -1
+
+# global limit of orgs.
+; global_org = -1
+
+# global limit of dashboards
+; global_dashboard = -1
+
+# global limit of api_keys
+; global_api_key = -1
+
+# global limit on number of logged in users.
+; global_session = -1
+
 #################################### Alerting ############################
 [alerting]
 # Disable alerting engine & UI features
@@ -428,6 +591,19 @@ enabled = false
 # This limit will protect the server from render overloading and make sure notifications are sent out quickly
 ;concurrent_render_limit = 5
 
+
+# Default setting for alert calculation timeout. Default value is 30
+;evaluation_timeout_seconds = 30
+
+# Default setting for alert notification timeout. Default value is 30
+;notification_timeout_seconds = 30
+
+# Default setting for max attempts to sending alert notifications. Default value is 3
+;max_attempts = 3
+
+# Makes it possible to enforce a minimal interval between evaluations, to reduce load on the backend
+;min_interval_seconds = 1
+
 #################################### Explore #############################
 [explore]
 # Enable the Explore section
@@ -438,9 +614,14 @@ enabled = false
 [metrics]
 # Disable / Enable internal metrics
 ;enabled           = true
-
-# Publish interval
+# Graphite Publish interval
 ;interval_seconds  = 10
+# Disable total stats (stat_totals_*) metrics to be generated
+;disable_total_stats = false
+
+#If both are set, basic auth will be required for the metrics endpoint.
+; basic_auth_username =
+; basic_auth_password =
 
 # Send internal metrics to Graphite
 [metrics.graphite]
@@ -448,6 +629,11 @@ enabled = false
 ;address =
 ;prefix = prod.grafana.%(instance_name)s.
 
+#################################### Grafana.com integration  ##########################
+# Url used to import dashboards directly from Grafana.com
+[grafana_com]
+;url = https://grafana.com
+
 #################################### Distributed tracing ############
 [tracing.jaeger]
 # Enable by setting the address sending traces to jaeger (ex localhost:6831)
@@ -464,11 +650,11 @@ enabled = false
 # and indicates the initial sampling rate before the actual one
 # is received from the mothership
 ;sampler_param = 1
-
-#################################### Grafana.com integration  ##########################
-# Url used to import dashboards directly from Grafana.com
-[grafana_com]
-;url = https://grafana.com
+# Whether or not to use Zipkin propagation (x-b3- HTTP headers).
+;zipkin_propagation = false
+# Setting this to true disables shared RPC spans.
+# Not disabling is the most common setting when using Zipkin elsewhere in your infrastructure.
+;disable_shared_zipkin_spans = false
 
 #################################### External image storage ##########################
 [external_image_storage]
@@ -477,6 +663,8 @@ enabled = false
 ;provider =
 
 [external_image_storage.s3]
+;endpoint =
+;path_style_access =
 ;bucket =
 ;region =
 ;path =
@@ -503,11 +691,24 @@ enabled = false
 # does not require any configuration
 
 [rendering]
-# Options to configure external image rendering server like https://github.com/grafana/grafana-image-renderer
+# Options to configure a remote HTTP image rendering service, e.g. using https://github.com/grafana/grafana-image-renderer.
+# URL to a remote HTTP image renderer service, e.g. http://localhost:8081/render, will enable Grafana to render panels and dashboards to PNG-images using HTTP requests to an external service.
 ;server_url =
+# If the remote HTTP image renderer service runs on a different server than the Grafana server you may have to configure this to a URL where Grafana is reachable, e.g. http://grafana.domain/.
 ;callback_url =
 
+[panels]
+# If set to true Grafana will allow script tags in text panels. Not recommended as it enable XSS vulnerabilities.
+;disable_sanitize_html = false
+
+[plugins]
+;enable_alpha = false
+;app_tls_skip_verify_insecure = false
+
 [enterprise]
 # Path to a valid Grafana Enterprise license.jwt file
 ;license_path =
 
+[feature_toggles]
+# enable features, separated by spaces
+;enable =