Restrict Grafana anonymous access #28

New issue

Closed

opened 2026-07-25 19:37:15 +00:00 by lab · 0 comments

lab commented

2026-07-25 19:37:15 +00:00

Owner

Grafana currently allows anonymous viewer access:

auth.anonymous:
  enabled: true
  org_role: Viewer

Since Grafana is behind Caddy but has no forward_auth, it's technically internet-exposed.

Options

Disable anonymous auth entirely (recommended while Grafana still runs)
Add forward_auth to the Grafana Caddy route
Keep anonymous but restrict to internal IPs only

Steps

Update monitoring/values.yaml to set auth.anonymous.enabled: false
helm upgrade kube-prometheus-stack prometheus-community/kube-prometheus-stack -n monitoring -f monitoring/values.yaml

Update (2026-08-01)

Grafana is being retired in favor of Beszel + Uptime Kuma (see #11). This issue is short-term only: apply the minimal fix (option 1) while the stack runs in parallel, and it becomes moot on teardown (step 9 of #11) -- no need to invest in forward_auth for a service that's leaving.

Grafana currently allows anonymous viewer access: ```yaml auth.anonymous: enabled: true org_role: Viewer ``` Since Grafana is behind Caddy but has no `forward_auth`, it's technically internet-exposed. ## Options 1. Disable anonymous auth entirely (recommended while Grafana still runs) 2. Add `forward_auth` to the Grafana Caddy route 3. Keep anonymous but restrict to internal IPs only ## Steps 1. Update `monitoring/values.yaml` to set `auth.anonymous.enabled: false` 2. `helm upgrade kube-prometheus-stack prometheus-community/kube-prometheus-stack -n monitoring -f monitoring/values.yaml` ## Update (2026-08-01) Grafana is being **retired** in favor of Beszel + Uptime Kuma (see #11). This issue is short-term only: apply the minimal fix (option 1) while the stack runs in parallel, and it becomes **moot on teardown** (step 9 of #11) -- no need to invest in forward_auth for a service that's leaving.