From 955e01095a2168fdef79e92231244650363cbdf7 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Wed, 12 Oct 2022 20:45:15 +0200
Subject: [PATCH 1/2] grafana: 9.1.7 -> 9.2.0

ChangeLog: https://github.com/grafana/grafana/releases/tag/v9.2.0

Also fixed the test: the default value for the admin email address is
now `admin@localhost`[1].

[1] https://github.com/grafana/grafana/commit/39102c6656a5b7a11ffc8530d1f5c7598ef99038
---
 nixos/tests/grafana.nix                     | 9 ++++++---
 pkgs/servers/monitoring/grafana/default.nix | 8 ++++----
 2 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/nixos/tests/grafana.nix b/nixos/tests/grafana.nix
index 174d664d8772..5364f0ca8b0b 100644
--- a/nixos/tests/grafana.nix
+++ b/nixos/tests/grafana.nix
@@ -81,8 +81,11 @@ in {
     with subtest("Successful API query as admin user with sqlite db"):
         sqlite.wait_for_unit("grafana.service")
         sqlite.wait_for_open_port(3000)
+        print(sqlite.succeed(
+            "curl -sSfN -u testadmin:snakeoilpwd http://127.0.0.1:3000/api/org/users -i"
+        ))
         sqlite.succeed(
-            "curl -sSfN -u testadmin:snakeoilpwd http://127.0.0.1:3000/api/org/users | grep testadmin\@localhost"
+            "curl -sSfN -u testadmin:snakeoilpwd http://127.0.0.1:3000/api/org/users | grep admin\@localhost"
         )
         sqlite.shutdown()
 
@@ -92,7 +95,7 @@ in {
         postgresql.wait_for_open_port(3000)
         postgresql.wait_for_open_port(5432)
         postgresql.succeed(
-            "curl -sSfN -u testadmin:snakeoilpwd http://127.0.0.1:3000/api/org/users | grep testadmin\@localhost"
+            "curl -sSfN -u testadmin:snakeoilpwd http://127.0.0.1:3000/api/org/users | grep admin\@localhost"
         )
         postgresql.shutdown()
 
@@ -102,7 +105,7 @@ in {
         mysql.wait_for_open_port(3000)
         mysql.wait_for_open_port(3306)
         mysql.succeed(
-            "curl -sSfN -u testadmin:snakeoilpwd http://127.0.0.1:3000/api/org/users | grep testadmin\@localhost"
+            "curl -sSfN -u testadmin:snakeoilpwd http://127.0.0.1:3000/api/org/users | grep admin\@localhost"
         )
         mysql.shutdown()
   '';
diff --git a/pkgs/servers/monitoring/grafana/default.nix b/pkgs/servers/monitoring/grafana/default.nix
index 3e9c9150f03c..bf810d98ae54 100644
--- a/pkgs/servers/monitoring/grafana/default.nix
+++ b/pkgs/servers/monitoring/grafana/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "grafana";
-  version = "9.1.7";
+  version = "9.2.0";
 
   excludedPackages = [ "alert_webhook_listener" "clean-swagger" "release_publisher" "slow_proxy" "slow_proxy_mac" "macaron" "devenv" ];
 
@@ -10,15 +10,15 @@ buildGoModule rec {
     rev = "v${version}";
     owner = "grafana";
     repo = "grafana";
-    sha256 = "sha256-dlQlzX3aGZzBOb0V6ogB8yuoC8Dt18O8nKcJAQ9bfvs=";
+    sha256 = "sha256-cfm+BfzSMtkDMkiDH7rsoh/tEofmqWhuUz1slk+FaOI=";
   };
 
   srcStatic = fetchurl {
     url = "https://dl.grafana.com/oss/release/grafana-${version}.linux-amd64.tar.gz";
-    sha256 = "sha256-ioXc9UfbNRz/RCdnFfaEDRxtamR8st9Wc1LQ6wdl8SE=";
+    sha256 = "sha256-qJnqIog5DQXI8MAZtb2USkb5UwY7c05nDBt2mf13BJ8=";
   };
 
-  vendorSha256 = "sha256-frY84+Tp9qVj9Xs9l0c0u1YyYywMbXO4KS0AF5mpnhQ=";
+  vendorSha256 = "sha256-SYDkKB/D+uWHoeGAcYJmYxLhMOw458vkmFJlLbcrf2k=";
 
   nativeBuildInputs = [ wire ];
 

From 0df6c52026a2adc58e1adff0baedbfc35c818f2b Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Thu, 13 Oct 2022 10:28:29 +0200
Subject: [PATCH 2/2] nixos/grafana: ensure that declarative prometheus
 data-sources don't use direct access

Support for that was permanently dropped in Grafana 9.2.0, see also
https://github.com/grafana/grafana/commit/f30795b0884dd3485423a12d7d7d0860453967a7
---
 nixos/modules/services/monitoring/grafana.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/nixos/modules/services/monitoring/grafana.nix b/nixos/modules/services/monitoring/grafana.nix
index fd3418b8f6bd..15ca11a2e164 100644
--- a/nixos/modules/services/monitoring/grafana.nix
+++ b/nixos/modules/services/monitoring/grafana.nix
@@ -720,6 +720,12 @@ in {
         assertion = cfg.smtp.password != opt.smtp.password.default -> cfg.smtp.passwordFile == null;
         message = "Cannot set both password and passwordFile";
       }
+      {
+        assertion = all
+          ({ type, access, ... }: type == "prometheus" -> access != "direct")
+          cfg.provision.datasources;
+        message = "For datasources of type `prometheus`, the `direct` access mode is not supported anymore (since Grafana 9.2.0)";
+      }
     ];
 
     systemd.services.grafana = {