Default admin username.

The email of the default Grafana Admin, created on startup.

Secret key used for signing

Set to true if you host Grafana behind HTTPS.

Default admin password

When false, the HTTP header X-Frame-Options: deny will be set in Grafana HTTP responses which will instruct browsers to not allow rendering Grafana in a <frame>, <iframe>, <embed> or <object>

Set to true to disable the use of Gravatar for user profile images.

Sets the SameSite cookie attribute and prevents the browser from sending this cookie along with cross-site requests

Set to true to enable the X-XSS-Protection header, which tells browsers to stop pages from loading when they detect reflected cross-site scripting (XSS) attacks.

Note: this is the default in Grafana, it's turned off here since it's recommended to not use this header anymore.

List of additional allowed URLs to pass by the CSRF check

Set to false to disable the X-Content-Type-Options response header

List of allowed headers to be set by the user

Set to true to add the Content-Security-Policy header to your requests

Set to true if you want to enable HTTP Strict-Transport-Security (HSTS) response header

Define a whitelist of allowed IP addresses or domains, with ports, to be used in data source URLs with the Grafana data source proxy

Disable creation of admin user on first start of Grafana.

Set to true to enable HSTS preloading option

Set to true to add the Content-Security-Policy-Report-Only header to your requests

Set to true to disable brute force login protection.

Set to true to enable HSTS includeSubDomains option

Sets how long a browser should cache HSTS in seconds