Reverse merge main to dev

.env.grafana.okta.example

@@ -0,0 +1,42 @@
+# Grafana server URL
+GF_SERVER_ROOT_URL=http://localhost:3000
+
+# Optional local admin override
+GF_SECURITY_ADMIN_USER=admin
+GF_SECURITY_ADMIN_PASSWORD=change-me-PLEASE
+
+# Enable Okta auth
+GF_AUTH_OKTA_ENABLED=true
+GF_AUTH_OKTA_NAME=Okta
+GF_AUTH_OKTA_ALLOW_SIGN_UP=true
+GF_AUTH_OKTA_AUTO_LOGIN=false
+
+# Okta OIDC app values
+GF_AUTH_OKTA_CLIENT_ID=your-okta-client-id
+GF_AUTH_OKTA_CLIENT_SECRET=your-okta-client-secret
+GF_AUTH_OKTA_SCOPES=openid profile email groups offline_access
+GF_AUTH_OKTA_AUTH_URL=https://YOUR_OKTA_DOMAIN/oauth2/v1/authorize
+GF_AUTH_OKTA_TOKEN_URL=https://YOUR_OKTA_DOMAIN/oauth2/v1/token
+GF_AUTH_OKTA_API_URL=https://YOUR_OKTA_DOMAIN/oauth2/v1/userinfo
+
+# Enable refresh token flow
+GF_AUTH_OKTA_USE_REFRESH_TOKEN=true
+
+# Enable JWT ID token signature validation
+GF_AUTH_OKTA_VALIDATE_ID_TOKEN=true
+GF_AUTH_OKTA_JWK_SET_URL=https://YOUR_OKTA_DOMAIN/oauth2/v1/keys
+
+# Optional restrictions
+# comma separated lists
+GF_AUTH_OKTA_ALLOWED_DOMAINS=
+GF_AUTH_OKTA_ALLOWED_GROUPS=
+
+# Claim/attribute mapping
+GF_AUTH_OKTA_LOGIN_ATTRIBUTE_PATH=preferred_username
+GF_AUTH_OKTA_NAME_ATTRIBUTE_PATH=name
+GF_AUTH_OKTA_EMAIL_ATTRIBUTE_PATH=email
+GF_AUTH_OKTA_GROUPS_ATTRIBUTE_PATH=groups
+
+# Role mapping
+GF_AUTH_OKTA_ROLE_ATTRIBUTE_PATH=contains(groups[*], 'GrafanaAdmins') && 'Admin' || contains(groups[*], 'GrafanaEditors') && 'Editor' || 'Viewer'
+GF_AUTH_OKTA_SKIP_ORG_ROLE_SYNC=false

.gitignore

@@ -11,4 +11,9 @@ flask_session/
 .claude
 *.code-workspace
 pg/db-init/02-seed_data.sql
-pg/sql/seed_data.local.sql
+pg/sql/seed_data.local.sql
+.env.local*
+.env.production*
+.env.staging*
+.env.development*
+.env.*.production

docker-compose.yaml

@@ -421,14 +421,14 @@ services:
     restart: unless-stopped
     ports:
       - "3000:3000"
+    env_file:
+      - .env.grafana.okta.production
     volumes:
       - ./tools/grafana/provisioning/datasources:/etc/grafana/provisioning/datasources
       - ./tools/grafana/provisioning/dashboards/main.yaml:/etc/grafana/provisioning/dashboards/main.yaml
       - ./tools/grafana/provisioning/dashboards:/var/lib/grafana/dashboards
     environment:
       TZ: "America/Chicago"
-      GF_SECURITY_ADMIN_USER: admin
-      GF_SECURITY_ADMIN_PASSWORD: admin
     depends_on:
       db:
         condition: service_healthy