Mostly changes from Grafana v8.0[1].

[1] https://grafana.com/docs/grafana/latest/whatsnew/whats-new-in-v8-0/

Thorben Günther authored Jul 06, 2021 and Kristian Klausen committed Jul 06, 2021

This reverts commit 649568e7 ("Restrict Grafana access to Arch Linux
Staff group on Keycloak (fixes #151)").

Kristian Klausen authored Jun 06, 2021 and Jelle van der Waa committed Jun 06, 2021

X-Forwarded-For is defined as X-Forwarded-For: <client>, <proxy1>,
<proxy2>, and it was set to $proxy_add_x_forwarded_for which is
basically $http_x_forwarded_for,$remote_addr and headers from the client
can't be trusted!

Fix #292

Kristian Klausen authored Mar 30, 2021 and Jelle van der Waa committed Apr 08, 2021

A extra access_log entry was added with the following commands:
$ cd roles
$ grep -lr access_log | xargs -P 1 -n 1 sed -i '/access_log/ s/\(.*\)\( \)\(\(reduced\|main\);$\)/\1 \3\n\1.json json_\3/'

Kristian Klausen authored Feb 26, 2021 and Jelle van der Waa committed Apr 08, 2021

Fix #263

Jelle van der Waa authored Jul 28, 2020 and Sven-Hendrik Haase committed Sep 09, 2020

Configure Grafana to use Keycloak OpenID Connect for authentication. For
now only DevOps is configured as admin and Arch Staff as general Viewer
roles.

Jelle van der Waa authored Jul 28, 2020 and Sven-Hendrik Haase committed Sep 09, 2020

To show the session IP address in /profile in Grafana the
X-Forwarded-For header has to be set.

https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/#taxing-rewrites

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

For proxy/fastcgi/uwsgi blocks, logging is still set to the old format,
but for everything else (= static data) a reduced format is used that
excludes items that no longer make sense (request_time, remote_user) and
those that are personal information all the time (remote_addr, http_x_forwarded_for).
Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

This is the same as used on luna and as expected by the zabbix nginx
monitoring service.
Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>