Grafana basic auth option visibility

[mrchoc]

Is there a reason why grafana basic auth is disabled by default? At the very least in the setup documentation the option should be explicitly disabled. If teslamate is intended to be hosted locally and not exposed to the internet, I see no reason why this option should be hidden.

teslamate/grafana/Dockerfile

Line 7 in 85b45f2

GF_AUTH_BASIC_ENABLED=false \

I personally spent a lot of time jumping between this repo and the one from grafana to figure out what was the issue. If others have experience this personally, I believe it might save some people's time to include the option in the documentation. Please let me know your thoughts.

[brianmay]

For justification see #104

"Allows hiding Grafana behind a basic-auth-secured reverse proxy without interfering with Grafana auth."

The decision was made years ago; Not actually sure if this justification applies anymore.

[mrchoc]

Thank you for the link, I missed that PR as I only searched in discussions.

It's probably possible for Traefik to not pass headers down to the application. Anyway, that PR assumed that the Grafana api isn't used, which is not the case.

[JakobLichterfeld]

Is there a reason why grafana basic auth is disabled by default?

TeslaMate is not meant to run accessible from the internet, as stated everywhere in the docs. If you choose to do so:

This setup is recommended only if you are running TeslaMate on your home network, as otherwise your Tesla API tokens might be at risk. If you intend to access TeslaMate from the Internet, the recommended way is to use a secure connection (such as a VPN, Cloudflare Tunnel, Tailscale, Zero Tier and a reverse proxy for portless access) for secured access to your TeslaMate instance outside your home network. Alternatively, you can use a reverse proxy (such as Traefik, Apache2 or Caddy) with appropriate hardening to secure your TeslaMate instance before expose it to the internet, check out the advanced guides with Traefik for an example how to use Traefik with TeslaMate. Or you can use the advanced guides with Apache to set up TeslaMate with Apache2, TLS and HTTP Basic Auth.
source: https://docs.teslamate.org/docs/installation/docker/

We use API Token in manual installations, see #4764

[mrchoc]

if teslamate is not meant to be publicly accessible, wouldn't enabling grafana basic auth by default make more sense? nonetheless, my point is that the env var that disables grafana basic auth should be made known/accessible and not hidden in the dockerfile.

[JakobLichterfeld]

if teslamate is not meant to be publicly accessible, wouldn't enabling grafana basic auth by default make more sense?

From an UX standpoint? No.

You are free to set basic auth the way you want, see advanced guides.

[mrchoc]

this option prevents grafana's api from using basic auth, which some applications depend on