---
volumes:
  grafana-data:
    driver: local

services:
  grafana:
    image: docker.io/grafana/grafana-oss:11.3.0
    container_name: grafana
    ports:
      - 10.0.0.1:3000:3000
    volumes:
      - grafana-data:/var/lib/grafana
      - ${GRAFANA_CONFIG_PATH}:/etc/grafana/grafana.ini
    env_file:
      - .env  # Load all variables from .env automatically
    restart: unless-stopped
    environment:
      # Static configurations (not in .env)
      GF_AUTH_GENERIC_OAUTH_ENABLED: "true"
      GF_AUTH_GENERIC_OAUTH_NAME: authentik
      GF_AUTH_GENERIC_OAUTH_SCOPES: openid profile email
      GF_AUTH_OAUTH_AUTO_LOGIN: "true"
      GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH: >
        contains(groups, 'Grafana Admins') && 'Admin' ||
        contains(groups, 'Grafana Editors') && 'Editor' || 'Viewer'

networks: {}
...