From d2f03736fa05c4ebbedf52bd1d2f175f1d24bae9 Mon Sep 17 00:00:00 2001
From: jochens <jschoubben@gmail.com>
Date: Wed, 30 Sep 2026 13:02:11 +0200
Subject: [PATCH] grafana: its InfluxDB data source comes from the influxdb-api
 provision

ace's grafana reads InfluxDB through a data source somebody typed into
its database: a LAN address, a database InfluxDB 2 does not have, and a
password for a v1 user of an earlier instance. Nothing in the mesh knew
it existed, so migrating influxdb could only break it further.

grafana now requires influxdb-api, contributes read access, and the mesh
renders a provisioning file grafana reads at start: the address, port,
org's default bucket (as the InfluxQL database) and its own login from
the binding, the password by $__file from the pair credential the mesh
delivers, 0400 for grafana's uid 472. It is a data source of its own
name and uid, read-only in the UI and not the default, so the data
source a person made is never overwritten; a changed binding or a
rotated password restarts grafana, which re-reads the file.

Includes #152 (merged into this branch): influxdb provides influxdb-api.
---
 modules/grafana/module.json | 35 ++++++++++++++++++++++++++++++-----
 1 file changed, 30 insertions(+), 5 deletions(-)

diff --git a/modules/grafana/module.json b/modules/grafana/module.json
index 469c216..9980b0d 100644
--- a/modules/grafana/module.json
+++ b/modules/grafana/module.json
@@ -62,6 +62,21 @@
       "mode": "0644",
       "content": "GF_SERVER_ROOT_URL=https://${bound:route:name}\nGF_AUTH_GENERIC_OAUTH_ENABLED=true\nGF_AUTH_GENERIC_OAUTH_NAME=Keycloak\nGF_AUTH_GENERIC_OAUTH_CLIENT_ID=${bound:oidc-client:as}\nGF_AUTH_GENERIC_OAUTH_CLIENT_SECRET__FILE=/run/secrets/oidc-client\nGF_AUTH_GENERIC_OAUTH_SCOPES=openid email profile roles\nGF_AUTH_GENERIC_OAUTH_AUTH_URL=${bound:oidc-client:issuer}${bound:oidc-client:authorization-path}\nGF_AUTH_GENERIC_OAUTH_TOKEN_URL=${bound:oidc-client:issuer}${bound:oidc-client:token-path}\nGF_AUTH_GENERIC_OAUTH_API_URL=${bound:oidc-client:issuer}${bound:oidc-client:userinfo-path}\nGF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH=contains(roles[*], 'admin') && 'Admin' || contains(realm_access.roles[*], 'admin') && 'Admin' || 'Viewer'\nGF_AUTH_GENERIC_OAUTH_USE_PKCE=true\nGF_AUTH_GENERIC_OAUTH_ALLOW_SIGN_UP=true\nGF_AUTH_GENERIC_OAUTH_ALLOW_ASSIGN_GRAFANA_ADMIN=true\n"
     },
+    {
+      "id": "influxdb-secret",
+      "type": "file",
+      "path": "${dir:state}/influxdb-api.secret",
+      "mode": "0400",
+      "owner": "472:472",
+      "content": "${secret:influxdb-api}"
+    },
+    {
+      "id": "influxdb-datasource",
+      "type": "file",
+      "path": "${dir:state}/datasource-influxdb.yaml",
+      "mode": "0644",
+      "content": "apiVersion: 1\n# Written by the mesh from grafana's influxdb-api binding; grafana reads it at start. Its own name and\n# uid, so a data source somebody made in the UI is never overwritten, and read-only in the UI because\n# the mesh resets it. The password is read from the file the mesh delivers, never written here.\ndatasources:\n  - name: InfluxDB (mesh)\n    uid: mesh-influxdb-api\n    type: influxdb\n    access: proxy\n    url: ${bound:influxdb-api:scheme}://${bound:influxdb-api:at}:${bound:influxdb-api:port}\n    user: ${bound:influxdb-api:as}\n    isDefault: false\n    editable: false\n    jsonData:\n      dbName: ${bound:influxdb-api:bucket}\n      httpMode: POST\n    secureJsonData:\n      password: $__file{/run/secrets/influxdb-api}\n"
+    },
     {
       "id": "server",
       "type": "container",
@@ -73,7 +88,9 @@
       "volumes": [
         "${dir:data}:/var/lib/grafana",
         "${dir:state}/admin.secret:/run/secrets/admin:ro",
-        "${dir:state}/oidc-client.secret:/run/secrets/oidc-client:ro"
+        "${dir:state}/oidc-client.secret:/run/secrets/oidc-client:ro",
+        "${dir:state}/influxdb-api.secret:/run/secrets/influxdb-api:ro",
+        "${dir:state}/datasource-influxdb.yaml:/etc/grafana/provisioning/datasources/mesh-influxdb.yaml:ro"
       ],
       "env": {
         "GF_SECURITY_ADMIN_PASSWORD__FILE": "/run/secrets/admin"
@@ -83,7 +100,9 @@
       ],
       "restart-on": [
         "oidc-env",
-        "oidc-secret"
+        "oidc-secret",
+        "influxdb-datasource",
+        "influxdb-secret"
       ]
     },
     {
@@ -116,7 +135,8 @@
   ],
   "requires": [
     "route",
-    "oidc-client"
+    "oidc-client",
+    "influxdb-api"
   ],
   "contributes": {
     "route": {
@@ -127,14 +147,19 @@
       "label": "grafana",
       "endpoint": "web",
       "callback": "/login/generic_oauth"
+    },
+    "influxdb-api": {
+      "access": "read"
     }
   },
   "binds": {
     "route": "${dir:state}/route.json",
-    "oidc-client": "${dir:state}/oidc.json"
+    "oidc-client": "${dir:state}/oidc.json",
+    "influxdb-api": "${dir:state}/influxdb.json"
   },
   "secrets": {
-    "oidc-client": "/var/lib/mesh/grafana/oidc-client"
+    "oidc-client": "/var/lib/mesh/grafana/oidc-client",
+    "influxdb-api": "/var/lib/mesh/grafana/influxdb-api"
   },
   "build": {
     "on": [