Commit 66ad0319 authored by Jelle van der Waa's avatar Jelle van der Waa 🚧
Browse files

Update grafana configuration file

parent 47c788a3
...@@ -28,7 +28,7 @@ ...@@ -28,7 +28,7 @@
#################################### Server #################################### #################################### Server ####################################
[server] [server]
# Protocol (http, https, socket) # Protocol (http, https, h2, socket)
;protocol = http ;protocol = http
# The ip address to bind to, empty will bind to all interfaces # The ip address to bind to, empty will bind to all interfaces
...@@ -48,6 +48,9 @@ domain = {{grafana_domain}} ...@@ -48,6 +48,9 @@ domain = {{grafana_domain}}
# If you use reverse proxy and sub path specify full url (with sub path) # If you use reverse proxy and sub path specify full url (with sub path)
root_url = https://{{grafana_domain}} root_url = https://{{grafana_domain}}
# Serve Grafana from subpath specified in `root_url` setting. By default it is set to `false` for compatibility reasons.
;serve_from_sub_path = false
# Log web requests # Log web requests
;router_logging = false ;router_logging = false
...@@ -84,6 +87,11 @@ enable_gzip = true ...@@ -84,6 +87,11 @@ enable_gzip = true
# For "postgres" only, either "disable", "require" or "verify-full" # For "postgres" only, either "disable", "require" or "verify-full"
;ssl_mode = disable ;ssl_mode = disable
;ca_cert_path =
;client_key_path =
;client_cert_path =
;server_cert_name =
# For "sqlite3" only, path relative to data_path setting # For "sqlite3" only, path relative to data_path setting
;path = grafana.db ;path = grafana.db
...@@ -97,32 +105,21 @@ enable_gzip = true ...@@ -97,32 +105,21 @@ enable_gzip = true
;conn_max_lifetime = 14400 ;conn_max_lifetime = 14400
# Set to true to log the sql calls and execution times. # Set to true to log the sql calls and execution times.
log_queries = ;log_queries =
# For "sqlite3" only. cache mode setting used for connecting to the database. (private, shared) # For "sqlite3" only. cache mode setting used for connecting to the database. (private, shared)
;cache_mode = private ;cache_mode = private
#################################### Session #################################### #################################### Cache server #############################
[session] [remote_cache]
# Either "memory", "file", "redis", "mysql", "postgres", default is "file" # Either "redis", "memcached" or "database" default is "database"
;provider = file ;type = database
# Provider config options
# memory: not have any config yet
# file: session dir path, is relative to grafana data_path
# redis: config like redis server e.g. `addr=127.0.0.1:6379,pool_size=100,db=grafana`
# mysql: go-sql-driver/mysql dsn config string, e.g. `user:password@tcp(127.0.0.1:3306)/database_name`
# postgres: user=a password=b host=localhost port=5432 dbname=c sslmode=disable
;provider_config = sessions
# Session cookie name
;cookie_name = grafana_sess
# If you use session in https only, default is false # cache connectionstring options
;cookie_secure = false # database: will use Grafana primary database.
# redis: config like redis server e.g. `addr=127.0.0.1:6379,pool_size=100,db=0,ssl=false`. Only addr is required. ssl may be 'true', 'false', or 'insecure'.
# Session life time, default is 86400 # memcache: 127.0.0.1:11211
;session_life_time = 86400 ;connstr =
#################################### Data proxy ########################### #################################### Data proxy ###########################
[dataproxy] [dataproxy]
...@@ -133,6 +130,9 @@ log_queries = ...@@ -133,6 +130,9 @@ log_queries =
# How long the data proxy should wait before timing out default is 30 (seconds) # How long the data proxy should wait before timing out default is 30 (seconds)
;timeout = 30 ;timeout = 30
# If enabled and user is not anonymous, data proxy will add X-Grafana-User header with username into the request, default is false.
;send_user_header = false
#################################### Analytics #################################### #################################### Analytics ####################################
[analytics] [analytics]
# Server reporting, sends usage counters to stats.grafana.org every 24 hours. # Server reporting, sends usage counters to stats.grafana.org every 24 hours.
...@@ -156,6 +156,9 @@ log_queries = ...@@ -156,6 +156,9 @@ log_queries =
#################################### Security #################################### #################################### Security ####################################
[security] [security]
# disable creation of admin user on first start of grafana
;disable_initial_admin_creation = false
# default admin user, created on startup # default admin user, created on startup
admin_user = admin admin_user = admin
...@@ -177,9 +180,36 @@ admin_user = admin ...@@ -177,9 +180,36 @@ admin_user = admin
# set to true if you host Grafana behind HTTPS. default is false. # set to true if you host Grafana behind HTTPS. default is false.
cookie_secure = true cookie_secure = true
# set cookie SameSite attribute. defaults to `lax`. can be set to "lax", "strict" and "none" # set cookie SameSite attribute. defaults to `lax`. can be set to "lax", "strict", "none" and "disabled"
;cookie_samesite = lax ;cookie_samesite = lax
# set to true if you want to allow browsers to render Grafana in a <frame>, <iframe>, <embed> or <object>. default is false.
;allow_embedding = false
# Set to true if you want to enable http strict transport security (HSTS) response header.
# This is only sent when HTTPS is enabled in this configuration.
# HSTS tells browsers that the site should only be accessed using HTTPS.
# The default version will change to true in the next minor release, 6.3.
strict_transport_security = true
# Sets how long a browser should cache HSTS. Only applied if strict_transport_security is enabled.
strict_transport_security_max_age_seconds = 86400
# Set to true if to enable HSTS preloading option. Only applied if strict_transport_security is enabled.
;strict_transport_security_preload = false
# Set to true if to enable the HSTS includeSubDomains option. Only applied if strict_transport_security is enabled.
;strict_transport_security_subdomains = false
# Set to true to enable the X-Content-Type-Options response header.
# The X-Content-Type-Options response HTTP header is a marker used by the server to indicate that the MIME types advertised
# in the Content-Type headers should not be changed and be followed. The default will change to true in the next minor release, 6.3.
x_content_type_options = true
# Set to true to enable the X-XSS-Protection header, which tells browsers to stop pages from loading
# when they detect reflected cross-site scripting (XSS) attacks. The default will change to true in the next minor release, 6.3.
x_xss_protection = true
#################################### Snapshots ########################### #################################### Snapshots ###########################
[snapshots] [snapshots]
# snapshot sharing options # snapshot sharing options
...@@ -187,6 +217,10 @@ cookie_secure = true ...@@ -187,6 +217,10 @@ cookie_secure = true
;external_snapshot_url = https://snapshots-origin.raintank.io ;external_snapshot_url = https://snapshots-origin.raintank.io
;external_snapshot_name = Publish to snapshot.raintank.io ;external_snapshot_name = Publish to snapshot.raintank.io
# Set true to enable this Grafana instance act as an external snapshot server and allow unauthenticated requests for
# creating and deleting snapshots.
;public_mode = false
# remove expired snapshot # remove expired snapshot
;snapshot_remove_expired = true ;snapshot_remove_expired = true
...@@ -195,6 +229,10 @@ cookie_secure = true ...@@ -195,6 +229,10 @@ cookie_secure = true
# Number dashboard versions to keep (per dashboard). Default: 20, Minimum: 1 # Number dashboard versions to keep (per dashboard). Default: 20, Minimum: 1
;versions_to_keep = 20 ;versions_to_keep = 20
# Minimum dashboard refresh interval. When set, this will restrict users to set the refresh interval of a dashboard lower than given interval. Per default this is not set/unrestricted.
# The interval string is a possibly signed sequence of decimal numbers, followed by a unit suffix (ms, s, m, h, d), e.g. 30s or 1m.
;min_refresh_interval =
#################################### Users ############################### #################################### Users ###############################
[users] [users]
# disable user signup / registration # disable user signup / registration
...@@ -206,11 +244,18 @@ allow_sign_up = false ...@@ -206,11 +244,18 @@ allow_sign_up = false
# Set to true to automatically assign new users to the default organization (id 1) # Set to true to automatically assign new users to the default organization (id 1)
;auto_assign_org = true ;auto_assign_org = true
# Set this value to automatically add new users to the provided organization (if auto_assign_org above is set to true)
;auto_assign_org_id = 1
# Default role new users will be automatically assigned (if disabled above is set to true) # Default role new users will be automatically assigned (if disabled above is set to true)
;auto_assign_org_role = Viewer ;auto_assign_org_role = Viewer
# Require email validation before sign up completes
;verify_email_enabled = false
# Background text for the user field on the login page # Background text for the user field on the login page
;login_hint = email or username ;login_hint = email or username
;password_hint = password
# Default UI theme ("dark" or "light") # Default UI theme ("dark" or "light")
;default_theme = dark ;default_theme = dark
...@@ -223,6 +268,9 @@ allow_sign_up = false ...@@ -223,6 +268,9 @@ allow_sign_up = false
# Viewers can edit/inspect dashboard settings in the browser. But not save the dashboard. # Viewers can edit/inspect dashboard settings in the browser. But not save the dashboard.
;viewers_can_edit = false ;viewers_can_edit = false
# Editors can administrate dashboard, folders and teams they create
;editors_can_admin = false
[auth] [auth]
# Login cookie name # Login cookie name
;login_cookie_name = grafana_session ;login_cookie_name = grafana_session
...@@ -249,6 +297,9 @@ allow_sign_up = false ...@@ -249,6 +297,9 @@ allow_sign_up = false
# This setting is ignored if multiple OAuth providers are configured. # This setting is ignored if multiple OAuth providers are configured.
;oauth_auto_login = false ;oauth_auto_login = false
# limit of api_key seconds to live before expiration
;api_key_max_seconds_to_live = -1
#################################### Anonymous Auth ###################### #################################### Anonymous Auth ######################
[auth.anonymous] [auth.anonymous]
# enable anonymous access # enable anonymous access
...@@ -270,9 +321,23 @@ allow_sign_up = false ...@@ -270,9 +321,23 @@ allow_sign_up = false
;auth_url = https://github.com/login/oauth/authorize ;auth_url = https://github.com/login/oauth/authorize
;token_url = https://github.com/login/oauth/access_token ;token_url = https://github.com/login/oauth/access_token
;api_url = https://api.github.com/user ;api_url = https://api.github.com/user
;allowed_domains =
;team_ids = ;team_ids =
;allowed_organizations = ;allowed_organizations =
#################################### GitLab Auth #########################
[auth.gitlab]
;enabled = false
;allow_sign_up = true
;client_id = some_id
;client_secret = some_secret
;scopes = api
;auth_url = https://gitlab.com/oauth/authorize
;token_url = https://gitlab.com/oauth/token
;api_url = https://gitlab.com/api/v4
;allowed_domains =
;allowed_groups =
#################################### Google Auth ########################## #################################### Google Auth ##########################
[auth.google] [auth.google]
;enabled = false ;enabled = false
...@@ -284,6 +349,29 @@ allow_sign_up = false ...@@ -284,6 +349,29 @@ allow_sign_up = false
;token_url = https://accounts.google.com/o/oauth2/token ;token_url = https://accounts.google.com/o/oauth2/token
;api_url = https://www.googleapis.com/oauth2/v1/userinfo ;api_url = https://www.googleapis.com/oauth2/v1/userinfo
;allowed_domains = ;allowed_domains =
;hosted_domain =
#################################### Grafana.com Auth ####################
[auth.grafana_com]
;enabled = false
;allow_sign_up = true
;client_id = some_id
;client_secret = some_secret
;scopes = user:email
;allowed_organizations =
#################################### Azure AD OAuth #######################
[auth.azuread]
;name = Azure AD
;enabled = false
;allow_sign_up = true
;client_id = some_client_id
;client_secret = some_client_secret
;scopes = openid email profile
;auth_url = https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/authorize
;token_url = https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/token
;allowed_domains =
;allowed_groups =
#################################### Generic OAuth ########################## #################################### Generic OAuth ##########################
[auth.generic_oauth] [auth.generic_oauth]
...@@ -293,28 +381,64 @@ allow_sign_up = false ...@@ -293,28 +381,64 @@ allow_sign_up = false
;client_id = some_id ;client_id = some_id
;client_secret = some_secret ;client_secret = some_secret
;scopes = user:email,read:org ;scopes = user:email,read:org
;email_attribute_name = email:primary
;email_attribute_path =
;auth_url = https://foo.bar/login/oauth/authorize ;auth_url = https://foo.bar/login/oauth/authorize
;token_url = https://foo.bar/login/oauth/access_token ;token_url = https://foo.bar/login/oauth/access_token
;api_url = https://foo.bar/user ;api_url = https://foo.bar/user
;allowed_domains =
;team_ids = ;team_ids =
;allowed_organizations = ;allowed_organizations =
;role_attribute_path =
;tls_skip_verify_insecure = false ;tls_skip_verify_insecure = false
;tls_client_cert = ;tls_client_cert =
;tls_client_key = ;tls_client_key =
;tls_client_ca = ;tls_client_ca =
; Set to true to enable sending client_id and client_secret via POST body instead of Basic authentication HTTP header #################################### SAML Auth ###########################
; This might be required if the OAuth provider is not RFC6749 compliant, only supporting credentials passed via POST payload [auth.saml] # Enterprise only
;send_client_credentials_via_post = false # Defaults to false. If true, the feature is enabled.
#################################### Grafana.com Auth ####################
[auth.grafana_com]
;enabled = false ;enabled = false
;allow_sign_up = true
;client_id = some_id # Base64-encoded public X.509 certificate. Used to sign requests to the IdP
;client_secret = some_secret ;certificate =
;scopes = user:email
;allowed_organizations = # Path to the public X.509 certificate. Used to sign requests to the IdP
;certificate_path =
# Base64-encoded private key. Used to decrypt assertions from the IdP
;private_key =
;# Path to the private key. Used to decrypt assertions from the IdP
;private_key_path =
# Base64-encoded IdP SAML metadata XML. Used to verify and obtain binding locations from the IdP
;idp_metadata =
# Path to the SAML metadata XML. Used to verify and obtain binding locations from the IdP
;idp_metadata_path =
# URL to fetch SAML IdP metadata. Used to verify and obtain binding locations from the IdP
;idp_metadata_url =
# Duration, since the IdP issued a response and the SP is allowed to process it. Defaults to 90 seconds.
;max_issue_delay = 90s
# Duration, for how long the SP's metadata should be valid. Defaults to 48 hours.
;metadata_valid_duration = 48h
# Friendly name or name of the attribute within the SAML assertion to use as the user's name
;assertion_attribute_name = displayName
# Friendly name or name of the attribute within the SAML assertion to use as the user's login handle
;assertion_attribute_login = mail
# Friendly name or name of the attribute within the SAML assertion to use as the user's email
;assertion_attribute_email = mail
#################################### Basic Auth ##########################
[auth.basic]
;enabled = true
#################################### Auth Proxy ########################## #################################### Auth Proxy ##########################
[auth.proxy] [auth.proxy]
...@@ -322,13 +446,11 @@ allow_sign_up = false ...@@ -322,13 +446,11 @@ allow_sign_up = false
;header_name = X-WEBAUTH-USER ;header_name = X-WEBAUTH-USER
;header_property = username ;header_property = username
;auto_sign_up = true ;auto_sign_up = true
;ldap_sync_ttl = 60 ;sync_ttl = 60
;whitelist = 192.168.1.1, 192.168.2.1 ;whitelist = 192.168.1.1, 192.168.2.1
;headers = Email:X-User-Email, Name:X-User-Name ;headers = Email:X-User-Email, Name:X-User-Name
# Read the auth proxy docs for details on what the setting below enables
#################################### Basic Auth ########################## ;enable_login_token = false
[auth.basic]
;enabled = true
#################################### Auth LDAP ########################## #################################### Auth LDAP ##########################
[auth.ldap] [auth.ldap]
...@@ -336,12 +458,17 @@ allow_sign_up = false ...@@ -336,12 +458,17 @@ allow_sign_up = false
;config_file = /etc/grafana/ldap.toml ;config_file = /etc/grafana/ldap.toml
;allow_sign_up = true ;allow_sign_up = true
# LDAP backround sync (Enterprise only)
# At 1 am every day
;sync_cron = "0 0 1 * * *"
;active_sync_enabled = true
#################################### SMTP / Emailing ########################## #################################### SMTP / Emailing ##########################
[smtp] [smtp]
;enabled = false ;enabled = false
;host = localhost:25 ;host = localhost:25
;user = ;user =
# If the password contains # or ; you have to wrap it with trippel quotes. Ex """#password;""" # If the password contains # or ; you have to wrap it with triple quotes. Ex """#password;"""
;password = ;password =
;cert_file = ;cert_file =
;key_file = ;key_file =
...@@ -353,6 +480,7 @@ allow_sign_up = false ...@@ -353,6 +480,7 @@ allow_sign_up = false
[emails] [emails]
;welcome_email_on_sign_up = false ;welcome_email_on_sign_up = false
;templates_pattern = emails/*.html
#################################### Logging ########################## #################################### Logging ##########################
[log] [log]
...@@ -411,6 +539,41 @@ mode = syslog ...@@ -411,6 +539,41 @@ mode = syslog
# Syslog tag. By default, the process' argv[0] is used. # Syslog tag. By default, the process' argv[0] is used.
;tag = ;tag =
#################################### Usage Quotas ########################
[quota]
; enabled = false
#### set quotas to -1 to make unlimited. ####
# limit number of users per Org.
; org_user = 10
# limit number of dashboards per Org.
; org_dashboard = 100
# limit number of data_sources per Org.
; org_data_source = 10
# limit number of api_keys per Org.
; org_api_key = 10
# limit number of orgs a user can create.
; user_org = 10
# Global limit of users.
; global_user = -1
# global limit of orgs.
; global_org = -1
# global limit of dashboards
; global_dashboard = -1
# global limit of api_keys
; global_api_key = -1
# global limit on number of logged in users.
; global_session = -1
#################################### Alerting ############################ #################################### Alerting ############################
[alerting] [alerting]
# Disable alerting engine & UI features # Disable alerting engine & UI features
...@@ -428,6 +591,19 @@ enabled = false ...@@ -428,6 +591,19 @@ enabled = false
# This limit will protect the server from render overloading and make sure notifications are sent out quickly # This limit will protect the server from render overloading and make sure notifications are sent out quickly
;concurrent_render_limit = 5 ;concurrent_render_limit = 5
# Default setting for alert calculation timeout. Default value is 30
;evaluation_timeout_seconds = 30
# Default setting for alert notification timeout. Default value is 30
;notification_timeout_seconds = 30
# Default setting for max attempts to sending alert notifications. Default value is 3
;max_attempts = 3
# Makes it possible to enforce a minimal interval between evaluations, to reduce load on the backend
;min_interval_seconds = 1
#################################### Explore ############################# #################################### Explore #############################
[explore] [explore]
# Enable the Explore section # Enable the Explore section
...@@ -438,9 +614,14 @@ enabled = false ...@@ -438,9 +614,14 @@ enabled = false
[metrics] [metrics]
# Disable / Enable internal metrics # Disable / Enable internal metrics
;enabled = true ;enabled = true
# Graphite Publish interval
# Publish interval
;interval_seconds = 10 ;interval_seconds = 10
# Disable total stats (stat_totals_*) metrics to be generated
;disable_total_stats = false
#If both are set, basic auth will be required for the metrics endpoint.
; basic_auth_username =
; basic_auth_password =
# Send internal metrics to Graphite # Send internal metrics to Graphite
[metrics.graphite] [metrics.graphite]
...@@ -448,6 +629,11 @@ enabled = false ...@@ -448,6 +629,11 @@ enabled = false
;address = ;address =
;prefix = prod.grafana.%(instance_name)s. ;prefix = prod.grafana.%(instance_name)s.
#################################### Grafana.com integration ##########################
# Url used to import dashboards directly from Grafana.com
[grafana_com]
;url = https://grafana.com
#################################### Distributed tracing ############ #################################### Distributed tracing ############
[tracing.jaeger] [tracing.jaeger]
# Enable by setting the address sending traces to jaeger (ex localhost:6831) # Enable by setting the address sending traces to jaeger (ex localhost:6831)
...@@ -464,11 +650,11 @@ enabled = false ...@@ -464,11 +650,11 @@ enabled = false
# and indicates the initial sampling rate before the actual one # and indicates the initial sampling rate before the actual one
# is received from the mothership # is received from the mothership
;sampler_param = 1 ;sampler_param = 1
# Whether or not to use Zipkin propagation (x-b3- HTTP headers).
#################################### Grafana.com integration ########################## ;zipkin_propagation = false
# Url used to import dashboards directly from Grafana.com # Setting this to true disables shared RPC spans.
[grafana_com] # Not disabling is the most common setting when using Zipkin elsewhere in your infrastructure.
;url = https://grafana.com ;disable_shared_zipkin_spans = false
#################################### External image storage ########################## #################################### External image storage ##########################
[external_image_storage] [external_image_storage]
...@@ -477,6 +663,8 @@ enabled = false ...@@ -477,6 +663,8 @@ enabled = false
;provider = ;provider =
[external_image_storage.s3] [external_image_storage.s3]
;endpoint =
;path_style_access =
;bucket = ;bucket =
;region = ;region =
;path = ;path =
...@@ -503,11 +691,24 @@ enabled = false ...@@ -503,11 +691,24 @@ enabled = false
# does not require any configuration # does not require any configuration
[rendering] [rendering]
# Options to configure external image rendering server like https://github.com/grafana/grafana-image-renderer # Options to configure a remote HTTP image rendering service, e.g. using https://github.com/grafana/grafana-image-renderer.
# URL to a remote HTTP image renderer service, e.g. http://localhost:8081/render, will enable Grafana to render panels and dashboards to PNG-images using HTTP requests to an external service.
;server_url = ;server_url =
# If the remote HTTP image renderer service runs on a different server than the Grafana server you may have to configure this to a URL where Grafana is reachable, e.g. http://grafana.domain/.
;callback_url = ;callback_url =
[panels]
# If set to true Grafana will allow script tags in text panels. Not recommended as it enable XSS vulnerabilities.
;disable_sanitize_html = false
[plugins]
;enable_alpha = false
;app_tls_skip_verify_insecure = false
[enterprise] [enterprise]
# Path to a valid Grafana Enterprise license.jwt file # Path to a valid Grafana Enterprise license.jwt file
;license_path = ;license_path =
[feature_toggles]
# enable features, separated by spaces
;enable =
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment