[server]
# Allow embedding Manage in iframes
root_url = %(protocol)s://%(domain)s:%(http_port)s/
serve_from_sub_path = false

[security]
allow_embedding = true
cookie_samesite = lax

[auth]
disable_login_form = false
disable_signout_menu = false

[auth.generic_oauth]
enabled = true
name = Authentik
allow_sign_up = true
client_id = ${GF_AUTH_GENERIC_OAUTH_CLIENT_ID}
client_secret = ${GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET}
scopes = openid profile email
auth_url = ${GF_AUTH_GENERIC_OAUTH_AUTH_URL}
token_url = ${GF_AUTH_GENERIC_OAUTH_TOKEN_URL}
api_url = ${GF_AUTH_GENERIC_OAUTH_API_URL}
role_attribute_path = "contains(groups[*], 'grafana-admins') && 'Admin' || contains(groups[*], 'grafana-editors') && 'Editor' || 'Viewer'"

[users]
auto_assign_org = true
auto_assign_org_role = Viewer

[dataproxy]
# Keep dashboard queries responsive in the iframe
timeout = 30