Feature request: add basic auth for Grafana (port 3000) access about teslamate HOT 8 CLOSED

Genial. That worked!

from teslamate.

Thanks! Glad you like it.

When running on a cloud server, I would also feel very uncomfortable about exposing grafana and/or teslamate to the internet. Especially with the default docker-compose config the database user used by grafana is not restricted to read access only. Also, the API tokens are stored in the database. Therefore, with the default setup the tokens could be retrieved through grafana.

Personally, I would not want to rely on authentication provided by grafana. So there are two alternatives in my opinion:

1. don't publicly expose any port at all and instead use a VPN (e.g. wireguard) to connect to the server.
2. use a reverse-proxy that provides proper HTTPS and HTTP basic access authentication e.g. nginx or Traefik. The latter has everything built-in and requires a minimal config.

from teslamate.

I run behind a reverse proxy (letsencrypt-companion) but grafana does support quite a few different auth mechanisms. You can specify those options in your docker config as env vars.

from teslamate.

thanks for the ideas

from teslamate.

How would _ set GF_AUTH_ANONYMOUS_ENABLED to false, so that Grafana only works with a valid login? And, btw, how could I add a user to Grafana? I am geeting "Permission denied", when trying that under admin...

from teslamate.

Add GF_AUTH_ANONYMOUS_ENABLED to the docker-compose file:

  grafana:
    image: teslamate/grafana:latest
    environment:
      - DATABASE_USER=teslamate
      - DATABASE_PASS=secret
      - DATABASE_NAME=teslamate
      - DATABASE_HOST=db
      - GF_AUTH_ANONYMOUS_ENABLED=false
    ports:
      - 3000:3000
    volumes:
      - teslamate-grafana-data:/var/lib/grafana

To create a new user login with the default admin user (password is admin) first.

from teslamate.

Thanks, great. How could I add another user then?

from teslamate.

Did you try that: https://community.grafana.com/t/previous-page-next-page-add-users-without-having-to-send-an-invite/11460

from teslamate.