grafana: anonymous access is enabled by default with no variable to disable it, and the template overwrites any manual change

[planitron]

Summary

roles/infra/templates/grafana/grafana.ini.j2 hardcodes:

[auth.anonymous]
enabled = true

There is no Pigsty variable to change this. roles/infra/defaults/main.yml exposes eight grafana_* settings (grafana_enabled, grafana_port, grafana_clean, grafana_admin_username, grafana_admin_password, grafana_auth_proxy, grafana_pgurl, grafana_view_password) and none of them covers anonymous access — grep -c anonymous roles/infra/defaults/main.yml returns 0.

The consequence is that every dashboard is readable without any login by anyone who can reach port 3000: metrics, database names, table names, slow query samples. It also makes grafana_view_password pointless, since nobody needs to authenticate to view the data it is meant to protect.

Editing /etc/grafana/grafana.ini on the node does not help: the file is rendered from the template, so the change is silently reverted on the next ./infra.yml -t grafana_config — and after any Pigsty upgrade. The only way to make it stick today is to patch the template itself, which has to be re-applied on every version bump.

Why this is worth a variable

In #326 ("How to protect the infra portal from the public"), the maintainer already recommends exactly this:

you can revoke Viewer privileges from anonymous to prevent them access any info

The advice is sound, but Pigsty currently offers no supported way to apply it persistently. This issue is not asking to change the default — only to make the documented recommendation expressible in the inventory.

Environment

Pigsty	v4.4.0 and v4.5.0 (verified in the v4.5.0 tag)
File	roles/infra/templates/grafana/grafana.ini.j2
Defaults	roles/infra/defaults/main.yml

Verified on the released tag, not from memory:

$ curl -s https://raw.githubusercontent.com/pgsty/pigsty/v4.5.0/roles/infra/templates/grafana/grafana.ini.j2 \
  | grep -A3 'auth.anonymous'
enabled = true

$ curl -s https://raw.githubusercontent.com/pgsty/pigsty/v4.5.0/roles/infra/defaults/main.yml \
  | grep -ci anonymous
0

Suggested fix

Add two variables to roles/infra/defaults/main.yml, keeping the current behaviour as the default so nothing breaks for existing users:

grafana_anonymous_enabled: true      # allow anonymous read access to dashboards?
grafana_anonymous_role: Viewer       # org role granted to anonymous users

and template them:

[auth.anonymous]
enabled = {{ grafana_anonymous_enabled | default(true) | lower }}
org_role = {{ grafana_anonymous_role | default('Viewer') }}

Operators who expose Grafana on a shared or semi-trusted network can then set grafana_anonymous_enabled: false in their inventory, and the setting survives replays and upgrades.

A stricter default (false) would arguably be the safer choice for a monitoring stack that ships with a well-known admin password, but that is a separate decision — this request is only about making the value configurable.