gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos/grafana: improve handling of dropped default value for settings.secret_key

Browse Source 
Addresses https://github.com/NixOS/nixpkgs/pull/484374#issuecomment-3929726911
This commit is contained in:
Maximilian Bosch
2026-02-28 14:55:32 +01:00
parent ee4304932d
commit 701e6785a3
2 changed files with 19 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nixos/doc/manual/release-notes/rl-2605.section.md
+6
View File
@@ -94,6 +94,12 @@ of pulling the upstream container image from Docker Hub. If you want the old beh
- `services.oauth2-proxy.clientSecret` and `services.oauth2-proxy.cookie.secret` have been replaced with `services.oauth2-proxy.clientSecretFile` and `services.oauth2-proxy.cookie.secretFile` respectively. This was done to ensure secrets don't get made world-readable.
- [`services.grafana.settings.security.secret_key`](#opt-services.grafana.settings.security.secret_key) doesn't have a
default value anymore. Please generate your own key or hard-code the old one explicitly.
See the [upstream docs](https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#secret_key) and
the [instructions on how to rotate](https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-database-encryption/#re-encrypt-secrets)
for further information.
- Ethercalc and its associated module have been removed, as the package is unmaintained and cannot be installed from source with npm now.
- `services.cgit` before always had the git-http-backend and its "export all" setting enabled, which sidestepped any access control configured in cgit's settings. Now you have to make a decision and either enable or disable `services.cgit.gitHttpBackend.checkExportOkFiles` (or disable the git-http-backend).
nixos/modules/services/monitoring/grafana.nix
+13 -1
View File
@@ -889,7 +889,8 @@ in
to work around that. Look at the documentation for details:
<https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#file-provider>
'';
type = types.str;
type = types.nullOr types.str;
default = null;
};
disable_gravatar = mkOption {
@@ -2060,6 +2061,17 @@ in
|| cfg.provision.alerting.muteTimings.path == null;
message = "Cannot set both mute timings settings and mute timings path";
}
{
assertion = cfg.settings.security.secret_key != null;
message = ''
Grafana's secret key (services.grafana.settings.security.secret_key) doesn't have a default
value anymore. Please generate your own and use a file-provider on this option! See also
https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#secret_key
for more information.
See https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-database-encryption/#re-encrypt-secrets on how to re-encrypt.
'';
}
];
systemd.services.grafana = {