How to disable SSL verification for proxy-mode in datasource plugins

[dbodky]

Hello everybody,

I am currently trying to write my own datasource plugin by following this guide from the docs, but I am getting the following error messages in my logs:

logger=data-proxy-log userId=0 orgId=1 uname= 
path=/api/datasources/proxy/uid/b89157b7-f08b-4ff4-8128-0e14c7b5afb7/
testsource/v1 remote_addr=172.24.0.1 referer=http://grafana.staged-by-discourse.com/datasources/edit/b89157b7-f08b-4ff4-8128
-0e14c7b5afb7 t=2023-07-03T12:30:05.085512256Z level=error 
msg="Proxy request failed" err="tls: failed to verify certificate: x509: 
cannot validate certificate for 10.77.14.47 because it doesn't contain any IP SANs"

As you can see I am using a self-signed certificate and access the API via IP - this is a common scenario for us so I’d really need to know if I can deactivate SSL verification in my call to getBackendSrv().dataSourceRequest(), which currently looks like this (implemented in the healtcheck):

async testDatasource() {
    const routePath = "/testsource";
    const fullUrl = this.url + routePath + "/v1";

    console.log(fullUrl);
    const result = await getBackendSrv().datasourceRequest({
      method: "GET",
      url: fullUrl,
      responseType: "json",
      headers: {
        "Accept": "application/json",
      },
    });

    if (result.status !== 200) {
      return {
        status: 'error',
        message: 'Error',

      };
    } else {
      return {
        status: 'success',
        message: 'Success',
      };
    }
  }

Edit: I did some digging in the official source code and found lots of information e.g. on the Prometheus datasource’s ConfigEditor.ts - could I reuse code from there, since it’s a similar scenario (Grafana connecting to an instance with an unknown certificate on my behalf)?

Any help is highly appreciated,
Best regards,
Daniel

[mikhailvolkov]

I believe, you can connect using http:// instead of HTTPS, then certificates won’t be an issue.
We are using let’s encrypt with certbot to get certificates for a secure HTTPS connections and have no problems with proxy mode.

[dbodky]

This won’t work unfortunately as the API endpoint enforces HTTPS on its end. In a similar fashion, creating a (valid) certificate for the API will mess up other parts of the stack, as the tool behind it functions as its own CA.