---
- name: Grafana
  ansible.builtin.import_role:
    name: service
  vars:
    service_name: grafana
    service_container_image: "docker.io/grafana/grafana:latest"
    service_container_mounts:
      - type: volume
        source: data
        destination: /var/lib/grafana
    service_container_http_port: 3000
    service_domains:
      - "{{ grafana_domain }}"
    service_database_type: postgres
    service_postgres_tag: 17-alpine
    service_container_env:
      GF_DATABASE_TYPE: postgres
      GF_DATABASE_HOST: grafana-postgres:5432
      GF_DATABASE_NAME: grafana
      GF_DATABASE_USER: grafana
      GF_DATABASE_PASSWORD__FILE: /run/secrets/postgres
      GF_SERVER_DOMAIN: "{{ grafana_domain }}"
      GF_SERVER_ROOT_URL: "https://{{ grafana_domain }}"

      GF_AUTH_GENERIC_OAUTH_ENABLED: "{{ 'true' if grafana_oauth_name | length > 0 else 'false' }}"
      GF_AUTH_GENERIC_OAUTH_NAME: "{{ grafana_oauth_name }}"
      GF_AUTH_GENERIC_OAUTH_CLIENT_ID: "{{ grafana_oauth_client_id }}"
      GF_AUTH_GENERIC_OAUTH_AUTH_URL: "{{ grafana_oauth_auth_url }}"
      GF_AUTH_GENERIC_OAUTH_TOKEN_URL: "{{ grafana_oauth_token_url }}"
      GF_AUTH_GENERIC_OAUTH_API_URL: "{{ grafana_oauth_userinfo_url }}"
      GF_AUTH_GENERIC_OAUTH_SCOPES: "{{ grafana_oauth_scopes | join(' ') }}"
      GF_AUTH_GENERIC_OAUTH_ALLOW_SIGN_UP: "{{ 'true' if grafana_oauth_allow_sign_up else 'false' }}"
      GF_AUTH_GENERIC_OAUTH_AUTO_LOGIN: "{{ 'true' if grafana_oauth_auto_login else 'false' }}"
      GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH: "{{ grafana_oauth_role_attribute_path }}"
      GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_STRICT: "true"
      GF_AUTH_GENERIC_OAUTH_ALLOW_ASSIGN_GRAFANA_ADMIN: "true"
      GF_AUTH_GENERIC_OAUTH_USE_PKCE: "true"
      GF_AUTH_GENERIC_OAUTH_LOGIN_ATTRIBUTE_PATH: preferred_username