prometheus: enable every where

machines/massicot/kanidm-provision.nix

@@ -18,7 +18,19 @@
       members = [ "xin" ];
     };
     immich-users = {
-      members = [ "xin" "zhuo" ];
+      members = [ "xin" "zhuo" "ycm" ];
+    };
+    grafana-superadmins = {
+      members = [ "xin" ];
+    };
+    grafana-admins = {
+      members = [ "xin" ];
+    };
+    grafana-editors = {
+      members = [ "xin" ];
+    };
+    grafana-users = {
+      members = [ "xin" ];
     };
   };
   persons = {
@@ -31,6 +43,11 @@
       displayName = "Zhuo";
       mailAddresses = [ "13681104320@163.com" ];
     };
+
+    ycm = {
+      displayName = "Chunming";
+      mailAddresses = [ "chunmingyou@gmail.com" ];
+    };
   };
   systems.oauth2 = {
     forgejo = {
@@ -75,5 +92,22 @@
         immich-users = [ "openid" "email" "profile" ];
       };
     };
+    grafana = {
+      displayName = "Grafana";
+      originUrl = "https://grafana.xinyang.life/";
+      scopeMaps = {
+        grafana-users = [ "openid" "email" "profile" "groups" ];
+      };
+      claimMaps = {
+        grafana_role = {
+          joinType = "array";
+          valuesByGroup = {
+            grafana-superadmins = [ "GrafanaAdmin" ];
+            grafana-admins = [ "Admin" ];
+            grafana-editors = [ "Editor" ];
+          };
+        };
+      };
+    };
   };
 }