From 360603a2138619d3b5df8b700b0ccb92152d4af6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ullrich=20Sch=C3=A4fer?= Date: Fri, 24 Apr 2026 18:05:11 +0200 Subject: [PATCH] Default Grafana auto-assign role to Editor MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Users land via GitHub OAuth gated by the trails-cool org allowlist, so Viewer-only is more restrictive than we actually want — no Explore access, no ad-hoc Loki/Prometheus queries. Promote the default role to Editor so new sign-ins get it automatically. Note: GF_USERS_AUTO_ASSIGN_ORG_ROLE only applies to new users on first sign-in. Existing Viewers (including the single current user) need a one-off promotion via the Grafana admin UI. Co-Authored-By: Claude Opus 4.7 (1M context) --- infrastructure/docker-compose.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/infrastructure/docker-compose.yml b/infrastructure/docker-compose.yml index 24b1e71..43f5d48 100644 --- a/infrastructure/docker-compose.yml +++ b/infrastructure/docker-compose.yml @@ -201,6 +201,11 @@ services: GF_AUTH_GITHUB_SCOPES: user:email,read:org GF_AUTH_OAUTH_ALLOW_INSECURE_EMAIL_LOOKUP: "true" GF_AUTH_DISABLE_LOGIN_FORM: "true" + # New GitHub-authenticated users land as Editor, not the default + # Viewer, so they can use Explore (ad-hoc Loki/Prometheus queries) + # without an admin promotion step. Access is already gated by the + # GF_AUTH_GITHUB_ALLOWED_ORGANIZATIONS allowlist above. + GF_USERS_AUTO_ASSIGN_ORG_ROLE: Editor GF_SMTP_ENABLED: "true" GF_SMTP_HOST: ${GF_SMTP_HOST:-} GF_SMTP_USER: ${GF_SMTP_USER:-}