# {{ cephadm_managed }}
[users]
  default_theme = light
{% if anonymous_access %}
[auth.anonymous]
  enabled = true
  org_name = 'Main Org.'
  org_role = 'Viewer'
{% endif %}
[server]
  domain = '{{ domain }}'
  protocol = {{ protocol }}
  cert_file = /etc/grafana/certs/cert_file
  cert_key = /etc/grafana/certs/cert_key
  http_port = {{ http_port }}
  http_addr = {{ http_addr }}
{% if mgmt_gw_enabled %}
  root_url = %(protocol)s://%(domain)s:%(http_port)s/grafana/
  serve_from_sub_path = true
{% endif %}
[snapshots]
  external_enabled = false
[security]
{% if not initial_admin_password %}
  disable_initial_admin_creation = true
{% else %}
  admin_user = admin
  admin_password = {{ initial_admin_password }}
{% endif %}
  cookie_secure = true
  cookie_samesite = none
  allow_embedding = true
{% if oauth2_enabled %}
[auth]
  disable_login_form = true
[auth.proxy]
  enabled = true
  header_name = X-WEBAUTH-USER
  header_property = username
  auto_sign_up = true
  sync_ttl = 15
  whitelist = {{ mgmt_gw_ips }}
  headers_encoded = false
  enable_login_token = false
  headers = Role:X-WEBAUTH-ROLE
{% endif %}
