{"id":13620286,"url":"https://github.com/supabase/cloudflare-access-grafana","last_synced_at":"2025-10-01T10:31:31.168Z","repository":{"id":51297171,"uuid":"355859192","full_name":"supabase/cloudflare-access-grafana","owner":"supabase","description":"Small proxy for automatically login users from Cloudflare Access into Grafana","archived":false,"fork":true,"pushed_at":"2024-03-13T21:07:39.000Z","size":57,"stargazers_count":8,"open_issues_count":2,"forks_count":3,"subscribers_count":2,"default_branch":"master","last_synced_at":"2024-04-15T02:15:11.324Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":"jorgelbg/cloudflare-access-grafana","license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/supabase.png","metadata":{"funding":{"github":["supabase"],"patreon":null,"open_collective":null,"ko_fi":null,"tidelift":null,"community_bridge":null,"liberapay":null,"issuehunt":null,"otechie":null,"custom":null},"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2021-04-08T10:20:30.000Z","updated_at":"2023-09-04T14:13:15.000Z","dependencies_parsed_at":"2023-09-23T00:51:45.115Z","dependency_job_id":null,"html_url":"https://github.com/supabase/cloudflare-access-grafana","commit_stats":{"total_commits":18,"total_committers":4,"mean_commits":4.5,"dds":"0.33333333333333337","last_synced_commit":"c7cda7251252302e33e9d4b22a6592d3909177af"},"previous_names":[],"tags_count":3,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/supabase%2Fcloudflare-access-grafana","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/supabase%2Fcloudflare-access-grafana/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/supabase%2Fcloudflare-access-grafana/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/supabase%2Fcloudflare-access-grafana/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/supabase","download_url":"https://codeload.github.com/supabase/cloudflare-access-grafana/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":219874984,"owners_count":16554634,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-01T21:00:54.116Z","updated_at":"2025-10-01T10:31:30.871Z","avatar_url":"https://github.com/supabase.png","language":"Go","funding_links":["https://github.com/sponsors/supabase"],"categories":["Go"],"sub_categories":[],"readme":"# cloudflare-access-grafana\n\n![Docker pulls](https://badgen.net/docker/pulls/jorgelbg/cloudflare-access-grafana?icon=docker\u0026color=purple)\n\n\u003cp align=\"center\"\u003e\n    \u003cimg class=\"center\" src=\"docs/logo.svg\" width=\"150\" alt=\"cloudflare access grafana logo\"/\u003e\n\u003c/p\u003e\n\ncloudflare-access-grafana is an HTTP proxy implemented to run as transparently behind [Cloudflare\nAccess](https://teams.cloudflare.com/access/) and forward the email of the signed-in user to Grafana.\nRunning this small proxy between Cloudflare Access and your Grafana instance allows you to\nautomatically sign in the authenticated user from Cloudflare Access into Grafana.\n\n## 📥 Installation / Getting started\n\nTo accomplish this Grafana has to run in with the [Auth Proxy\nAuthentication](https://grafana.com/docs/grafana/latest/auth/auth-proxy/) mode enabled. This will\ndelegate the authentication to another component: Cloudflare Access + cloudflare-access-grafana in\nthis case.\n\nA minimal `grafana.ini` config could look like this:\n\n```ini\n[users]\nallow_sign_up = false\nauto_assign_org = true\nauto_assign_org_role = Editor\n\n[auth.proxy]\nenabled = true\nheader_name = X-WEBAUTH-USER\nheader_property = email\nauto_sign_up = true\n```\n\nRunning a Grafana docker container with the previous configuration can be done with the following command:\n\n```shell\n$ docker run --rm --name grafana -i -p 3000:3000 -v $(pwd)/grafana.ini:/etc/grafana/grafana.ini --name grafana grafana/grafana\n```\n\nIn this case, the `header_property` set to `email` is important because the email is the claim\nthat we get from the JWT token provided by Cloudflare Access. `header_name` can be configured to any\ndesired value and will need to match the `FORWARDHEADER` environment variable passed into\ncloudflare-access-grafana.\n\nYou can copy the template from [.env.template](.env.template) into your environment file and adjust\nthe required values. Now you can run the cloudflare-access-grafana container with the following command:\n\n```\n$ cp .env.template .env\n$ docker run --rm -d --env-file $(pwd)/.env --name cloudflare-proxy -p 3001:3001 jorgelbg/cloudflare-access-grafana\n```\n\nThis will start the proxy on the specified address and it will start to listen for incoming requests.\nWhen a new HTTP request is received it will validate the JWT token, extract the `email` claim from\nthe token and forward to the specified host the header with the email address. Grafana will then\nautomatically signup/sign in (depending on the configuration) the user.\n\n\u003e Additional configuration on the Cloudflare Access is required to route your subdomain/DNS entry\n\u003e into the cloudflare-access-grafana instance. Grafana doesn't need to be accessible externally since\n\u003e all requests will go through the proxy.\n\n## 👾 Known Issues\n\nSince the authentication is no longer on the Grafana side, the logout action will not work as\nexpected. Although it will execute normally, you will find yourself logged in again. This happens\nbecause the current user has not been logged out of Cloudflare Access.\n\n## 🛠 Configuration\n\nAll the configuration options are passed to cloudflare-access-proxy as environment variables:\n\n* `AUTHDOMAIN`: This is your cloudflare authentication domain. Normally in the form of `https://\u003cyour-own-domain\u003e.cloudflareaccess.com`.\n* `POLICYAUD`: Application Audience (AUD) Tag.\n* `FORWARDHEADER`: The header to be forwarded to Grafana to indicate which user is currently logged in.\n* `FORWARDHOST`: URL where the Grafana instance (with `auth.proxy` enabled) is running.\n* `ADDR`: Address where the cloudflare-access-proxy will listen for incoming connections.\n\n## 👨🏻‍💻 Developing\n\n```shell\ngit clone https://github.com/jorgelbg/cloudflare-access-grafana\ncd cloudflare-access-grafana/\nmake\n```\n\nThis will build a binary placed in `bin/github.com/jorgelbg/cloudflare-access-grafana` for your native platform.\n\nIf you want to build a new Docker image use the following command:\n\n```shell\nmake docker\n```\n\n## 🤚🏻 Contributing\n\nIf you'd like to contribute, please fork the repository and use a feature\nbranch. Pull requests are warmly welcome.\n\n## 🚀 Links\n\n- The project logo is based on [Cloudflare icon](https://icons8.com/icons/set/cloudflare) by [Icons8](https://icons8.com). And the [Grafana icon](https://grafana.com/).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsupabase%2Fcloudflare-access-grafana","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsupabase%2Fcloudflare-access-grafana","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsupabase%2Fcloudflare-access-grafana/lists"}