diff --git a/hosts/marvin/services/grafana.nix b/hosts/marvin/services/grafana.nix
index 70306d87..b7098ab7 100644
--- a/hosts/marvin/services/grafana.nix
+++ b/hosts/marvin/services/grafana.nix
@@ -6,7 +6,7 @@
 }:
 let
   d = self.lib.data.services.grafana;
-  a = self.lib.data.services.authentik;
+  p = self.lib.data.services.pocket-id;
 in
 {
   services.grafana = {
@@ -14,18 +14,18 @@ in
     settings = {
       analytics.reporting_enable = false;
       "auth.generic_oauth" = {
-        name = "central";
+        name = "dishnet Auth";
         icon = "signin";
         enabled = "true";
-        client_id = "89f4607cf446a777a6b25ebde8731cdcb80b04c1";
-        client_secret = "89eccaa8a31104c218df5cfe37c87f0ea0bbddcd1571bddb7f7fbf5a09045efd59c61f1caaa79483ad59aac2c19488b254acdaced47e66a6505865a14a63ac4a";
-        auth_url = "https://${a.extUrl}/application/o/authorize/";
-        token_url = "https://${a.extUrl}/application/o/token/";
-        api_url = "https://${a.extUrl}/application/o/userinfo/";
+        client_id = "e63b892a-e5c8-4b61-a61f-89f25c3d127d";
+        client_secret = "$__file{${config.age.secrets.grafana-oidc-secret.path}}";
+        auth_url = "https://${p.extUrl}/authorize/";
+        token_url = "https://${p.extUrl}/api/oidc/token/";
+        api_url = "https://${p.extUrl}/api/oidc/userinfo/";
         scopes = "openid profile email";
       };
       "auth" = {
-        signout_redirect_url = "https://${a.extUrl}/if/session-end/stathog/";
+        signout_redirect_url = "https://${p.extUrl}/api/oidc/end-session";
         disableLoginForm = true;
       };
       security = {
@@ -49,12 +49,17 @@ in
   };
   age.secrets = {
     grafana-admin = {
-      file = ./secrets/grafana-admin-password.age;
+      file = ./secrets/grafana/admin-password.age;
       owner = "grafana";
       group = "grafana";
     };
     grafana-smtp-password = {
-      file = ./secrets/grafana-smtp-password.age;
+      file = ./secrets/grafana/smtp-password.age;
+      owner = "grafana";
+      group = "grafana";
+    };
+    grafana-oidc-secret = {
+      file = ./secrets/grafana/oidc-secret.age;
       owner = "grafana";
       group = "grafana";
     };
diff --git a/hosts/marvin/services/secrets/grafana-admin-password.age b/hosts/marvin/services/secrets/grafana/admin-password.age
similarity index 100%
rename from hosts/marvin/services/secrets/grafana-admin-password.age
rename to hosts/marvin/services/secrets/grafana/admin-password.age
diff --git a/hosts/marvin/services/secrets/grafana/oidc-secret.age b/hosts/marvin/services/secrets/grafana/oidc-secret.age
new file mode 100644
index 0000000000000000000000000000000000000000..4fe93ce99d7d02d422192857b98445c6104b07a4
GIT binary patch
literal 1067
zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCU7EOe^ybX0K8H_7k{
zO$x{?F|-KCF?UY(clY!4^D+r94$ZVMOLI#}%?b+fvn<InEaq}4@`?)b4$Df;^UN&?
zi^>cwN-+*e)%UTe@(K43bt&^tPBhIba!WDF3x(NMRGg@g=9ZWl;>eYh;$)cSZ;=>b
z;87J)6&RRP6ke9;Y-pKiSd|-|?dKX)W?*4b>~87nWSX2)UYQ%{<&$J==$BV!UZ7oS
zSyI52<K|uN=vk!gS?23oVqRiUlxvY=Tppb2WL}!B9aV1ZU*J(-;g{}N;S*$RmR{iN
z9;BV-l3|qX9qgZBX<VGi<zC=k7^R&VR$1&4>=B`DUgG3aTu>PqT4iozmRRVPWtQjX
z5^R!^5}u!=T~Jt<magsUt!<i-ol$6#R+*Ze#Z_cl;a%b#=A2yQ>FJ!El4WcfSsIb<
zRTk=D7HE>5?Ca-d?qryf6qynhVD6LWWNMmLS(XwWYNBmgSgIeGZNimoq@84vXOZq5
z6lxNX<Ly=!sP9wkmFMG;Xq@kvXc$l#m|7T+?3j@gl^jq}oNrJNlAKkXnBtKW?3iO1
z>}SLkmT&3o7jBl8=VIiWU2am~R8$gFQsQn>8W56|;#E@YW#N=o9#tG3?2>I<>0YdD
z;1ihR?&@u5Y2js9Viu6am0OVSWfB#d=xQ8Mk?G+T<W;V1VyNxto@?Ul<>+MOsU6{I
zT9Te^>{<~K;pXU=ndn~b8ldeRn4IERZW-og!sVBit{+tDWnr4`Y*CSEoE=b7UJ<EZ
z5D@Mg=9UrQ>KznR7;2J}8Icwdmha}~A8uKkSCwNK5NhC7R$5XKP{L*Eky=(-k>OF|
zomgPtT40iGXc(1U>E)Xq=I-R59_F4=Y?<L0YFcD!5gb$$8EF<_8mVvKo}3kB5N=Ui
zoM*um>gSwpVdhzAT9Ou;?jMwGp`TmmpKFvA9GK->o|NJdZk$t;mFSX~k?39+?&9cD
zWL9qK=~iUuW0LFZUs+<o72#4^?w99hrfp$TTH#%qZ>U`uUR99n8yQ&@s_&oYVPWW)
z>u+FK5n65nOUJNWQ(lmp;^C;^oKoRy;FlFpnU&&hVQx`WR2h<O?&50XmL8d8n(V4w
zT;y9AVeIAM5uVPKnUo$B?&oZ(U!Ix~nqF*Pr5)++mYI`e<W*_po1Gn*<>_dk?OdrJ
z9_GrWtE;P!YgiB(UYKl@p6*v<kXq^-=#gBWp5t6t>~H3oWLRucmSXOjo9tv!5T4F8
z@8_X~Nr|(*Og-Nix^4e)3#|hujL+#kmQQu><V$B*pw(nn#D8Vpk2lS>TW7}bKGAtJ
V!CS0-`vO7NU&1R4&L3n?1pqGQWw8JN

literal 0
HcmV?d00001

diff --git a/hosts/marvin/services/secrets/grafana-smtp-password.age b/hosts/marvin/services/secrets/grafana/smtp-password.age
similarity index 100%
rename from hosts/marvin/services/secrets/grafana-smtp-password.age
rename to hosts/marvin/services/secrets/grafana/smtp-password.age
diff --git a/hosts/marvin/services/secrets/secrets.nix b/hosts/marvin/services/secrets/secrets.nix
index b6e6358b..462f3a72 100644
--- a/hosts/marvin/services/secrets/secrets.nix
+++ b/hosts/marvin/services/secrets/secrets.nix
@@ -25,8 +25,9 @@ in
   "forgejo/oauth2-jwt-secret.age".publicKeys = marvinDefault;
   "forgejo/secret-key.age".publicKeys = marvinDefault;
   "golink-authkey.age".publicKeys = marvinDefault;
-  "grafana-admin-password.age".publicKeys = marvinDefault;
-  "grafana-smtp-password.age".publicKeys = marvinDefault;
+  "grafana/admin-password.age".publicKeys = marvinDefault;
+  "grafana/oidc-secret.age".publicKeys = marvinDefault;
+  "grafana/smtp-password.age".publicKeys = marvinDefault;
   "immich/oauth-secret.age".publicKeys = marvinDefault;
   "immich/mail-pw.age".publicKeys = marvinDefault;
   "jellyfin-exporter-config.age".publicKeys = marvinDefault;