I'm learning Grafana and want to use it for monitoring multiple servers within our anisation. I've made a sample dashboard with template variable Host that allows for quick choice of the server I want to investigate. I've also made multiple users and teams within Grafana with different roles permissions (roughly) representing our anisation employees. The metrics are collected by Prometheus Node Exporter and scraped by Prometheus.

What I want to do is to somehow restrict access to the dashboard's variable Host, so that users could only select some servers they are allowed to monitor and not be able to watch the others.

What I've tried to do is adding a allowedUsers label in Prometheus for each scrape target (server to monitor) and set its value to the comma separated list of users allowed to view this server's metrics (e.g. "user1,user2,user32"). Then I've added additional label filter in Grafana's template variable Host, like this: allowedUsers=~".*${__user.login}.*". It works as I desired: current user could only select hosts for which his/her username is listed in the allowedUser label.

However, this approach doesn't seem adecvate to me. If I had lots of users and servers, then managing this long list of allowedUsers would be a nightmare. It might have been made better by specifying allowedTeams instead and provide Grafana team names, but Grafana doesn't have built-in variable similar to ${__user.login} for obtaining the name of the team the user belongs to.

The question is whether there's a proper solution to this problem instead of this questionable dirty hack? I know I can make a copy of the dashboard for each server I want to monitor and then set permissions for each, but it doesn't seem to be "clean" solution either.

P.S.: I'm aware of enterprise features like RBAC but they are unavailable to me since I'm using OSS version of Grafana.