server {
        listen 80;
        server_name ~.;
        return 301 https://$host$request_uri;
}

        listen 443;
        server_name *.

;
    if ($http_x_forwarded_proto = 'http') {
            return 301 https://$host$request_uri;
        }

Host *
  UseKeychain yes
  AddKeysToAgent yes
  IdentityFile ~/.ssh/id_rsa

key-direction 1

<tls-auth>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
f745... rest of tls key
-----END OpenVPN Static key V1-----
</tls-auth>

<ca>
-----BEGIN CERTIFICATE-----
MIIG... rest of ca.crt data
-----END CERTIFICATE-----
</ca>

<cert>
-----BEGIN CERTIFICATE-----
MIIH... rest of client/user .crt data
-----END CERTIFICATE-----
</cert>

<key>
-----BEGIN PRIVATE KEY-----
MIIJ... rest of client/user .key data
-----END PRIVATE KEY-----
</key>

ingress:
  enabled: true
  annotations:
    'kubernetes.io/ingress.class': ${var.controller_ingress_class}
    'nginx.ingress.kubernetes.io/auth-type': ${var.auth-type}
    'nginx.ingress.kubernetes.io/auth-secret': ${var.basic_auth_secret_name}
    'nginx.ingress.kubernetes.io/auth-realm': ${var.auth-realm}
    'nginx.ingress.kubernetes.io/configuration-snippet': |
      proxy_set_header X-Remote-User $remote_user;
....
grafana.ini:
  users:
    allow_sign_up: false
    allow_org_create: false
  auth:
    disable_login_form: true
  auth.proxy:
    enabled: true
    header_name: X-Remote-User
    header_property: username
    auto_sign_up: true

auth-type         = "basic"
auth-secret       = "nginx-ingress-auth"
auth-realm        = "Authentication Required - OK"
basic_auth_secret = "${file("basic_auth.txt")}"

htpasswd -nb username long_long_password > basic_auth.txt

$ ps -eo pid,lstart,cmd
  PID CMD                                          STARTED
    1 Tue Jun  7 01:29:38 2016 /sbin/init                  
    2 Tue Jun  7 01:29:38 2016 [kthreadd]                  
    3 Tue Jun  7 01:29:38 2016 [ksoftirqd/0]               
    5 Tue Jun  7 01:29:38 2016 [kworker/0:0H]              
    7 Tue Jun  7 01:29:38 2016 [rcu_sched]                 
    8 Tue Jun  7 01:29:38 2016 [rcu_bh]                    
    9 Tue Jun  7 01:29:38 2016 [migration/0]               
   10 Tue Jun  7 01:29:38 2016 [kdevtmpfs]                 
   11 Tue Jun  7 01:29:38 2016 [netns]                     
  277 Tue Jun  7 01:29:38 2016 [writeback]                 
  279 Tue Jun  7 01:29:38 2016 [crypto]