Hello matt,
What is the status of the changes you been working?
I am in same boat where I want to put some dashboards as sys dashboard and do not allow users to delete or change the dashboard. Further I also want to restrict the dashboards which are listed on click of open icon. You are correct we can achieve this using nginx + lua.
If you still in process of development then you can share the endpoints and json with me. I have good understanding of nginx + lua. You can take a look at my old github repo where i have a Single Sign on Code entirely on Lua inside nginx.
Infact i plan to integrate this further in ES and Kibana and intercept just the calls at nginx live restrict the access. I need assistance in json request and response. I have a php front end where i integrate the kibana in iframe and i intended to extend the same and manage roles inside mysql database using php (or any other tool).
As you can see from the code in my SSO module that I can recraft the whole json inside the lua.
I m yet to start with the kibana work. If you are ready to collaborate we can start working on a module togather on github for fine grained access control of both ES and Kibana.
regards