feat: introduce treefmt and fmt all
This commit is contained in:
parent
80250b0179
commit
27c6c4f9fa
237 changed files with 5440 additions and 5214 deletions
|
|
@ -7,405 +7,417 @@
|
|||
httpsPort,
|
||||
forgejoSshPort,
|
||||
autoStart ? false,
|
||||
}: let
|
||||
}:
|
||||
let
|
||||
domain = "www.stefanjunker.de";
|
||||
in {
|
||||
in
|
||||
{
|
||||
inherit specialArgs;
|
||||
config = {
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
repoFlake,
|
||||
nodeFlake,
|
||||
system,
|
||||
...
|
||||
}: {
|
||||
system.stateVersion = "22.05"; # Did you read the comment?
|
||||
config =
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
repoFlake,
|
||||
nodeFlake,
|
||||
system,
|
||||
...
|
||||
}:
|
||||
{
|
||||
system.stateVersion = "22.05"; # Did you read the comment?
|
||||
|
||||
disabledModules = [
|
||||
"services/misc/forgejo.nix"
|
||||
"services/security/kanidm.nix"
|
||||
];
|
||||
|
||||
imports = [
|
||||
"${nodeFlake.inputs.nixpkgs-unstable}/nixos/modules/services/misc/forgejo.nix"
|
||||
"${repoFlake.inputs.nixpkgs-kanidm}/nixos/modules/services/security/kanidm.nix"
|
||||
|
||||
../profiles/containers/configuration.nix
|
||||
|
||||
repoFlake.inputs.sops-nix.nixosModules.sops
|
||||
];
|
||||
|
||||
sops.defaultSopsFile = ./webserver_secrets.yaml;
|
||||
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
httpPort
|
||||
httpsPort
|
||||
forgejoSshPort
|
||||
];
|
||||
|
||||
sops.age.sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
|
||||
sops.secrets.hedgedoc_environment_file = {
|
||||
sopsFile = ./webserver_secrets.yaml;
|
||||
owner = config.users.users.hedgedoc.name;
|
||||
};
|
||||
|
||||
services.caddy = {
|
||||
enable = true;
|
||||
logFormat = ''
|
||||
level ERROR
|
||||
'';
|
||||
virtualHosts."${domain}" = {
|
||||
extraConfig = ''
|
||||
redir /hedgedoc* https://hedgedoc.${domain}
|
||||
|
||||
file_server /*/* {
|
||||
browse
|
||||
root /var/www/stefanjunker.de/htdocs/caddy
|
||||
pass_thru
|
||||
}
|
||||
|
||||
# respond "Hi"
|
||||
# respond (not /*/*) "Hi"
|
||||
'';
|
||||
};
|
||||
|
||||
virtualHosts."hedgedoc.${domain}" = {
|
||||
extraConfig = ''
|
||||
reverse_proxy http://[::1]:3000
|
||||
'';
|
||||
};
|
||||
|
||||
virtualHosts."authelia.${domain}" = {
|
||||
extraConfig = ''
|
||||
reverse_proxy http://127.0.0.1:${builtins.toString config.services.authelia.instances.default.settings.server.port}
|
||||
'';
|
||||
};
|
||||
|
||||
virtualHosts."lldap.${domain}" = {
|
||||
extraConfig = ''
|
||||
reverse_proxy http://127.0.0.1:${builtins.toString config.services.lldap.settings.http_port}
|
||||
'';
|
||||
};
|
||||
|
||||
virtualHosts."forgejo.${domain}" = {
|
||||
extraConfig = ''
|
||||
reverse_proxy http://127.0.0.1:${builtins.toString config.services.forgejo.settings.server.HTTP_PORT}
|
||||
'';
|
||||
};
|
||||
|
||||
virtualHosts."kanidm.${domain}" = {
|
||||
extraConfig = ''
|
||||
reverse_proxy https://${builtins.toString config.services.kanidm.serverSettings.bindaddress} {
|
||||
transport http {
|
||||
tls_server_name ${config.services.kanidm.serverSettings.domain}
|
||||
}
|
||||
}
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
services.hedgedoc = {
|
||||
enable = true;
|
||||
settings = {
|
||||
domain = "hedgedoc.${domain}";
|
||||
urlPath = "";
|
||||
protocolUseSSL = true;
|
||||
db = {
|
||||
dialect = "sqlite";
|
||||
storage = "/var/lib/hedgedoc/db.hedgedoc.sqlite";
|
||||
};
|
||||
|
||||
allowAnonymous = false;
|
||||
allowAnonymousEdits = false;
|
||||
allowGravatar = false;
|
||||
allowFreeURL = false;
|
||||
defaultPermission = "private";
|
||||
|
||||
allowEmailRegister = false;
|
||||
email = false;
|
||||
|
||||
ldap = {
|
||||
url = "ldap://127.0.0.1:${builtins.toString config.services.lldap.settings.ldap_port}";
|
||||
bindDn = "uid=admin,ou=people,dc=stefanjunker,dc=de";
|
||||
# these are set via the `environmentFile`
|
||||
# bindCredentials = "$LDAP_ADMIN_PASSWORD";
|
||||
searchBase = "ou=people,dc=stefanjunker,dc=de";
|
||||
searchFilter = "(&(memberOf=cn=hedgedoc,ou=groups,dc=stefanjunker,dc=de)(uid={{username}}))";
|
||||
useridField = "uid";
|
||||
};
|
||||
|
||||
oauth2 = let
|
||||
originURL = config.services.kanidm.serverSettings.origin;
|
||||
in {
|
||||
providerName = "kanidm (${originURL})";
|
||||
|
||||
authorizationURL = "${originURL}/ui/oauth2";
|
||||
tokenURL = "${originURL}/oauth2/token";
|
||||
userProfileURL = "${originURL}/oauth2/openid/hedgedoc/userinfo";
|
||||
|
||||
scope = "openid email profile";
|
||||
# rolesClaim = "roles";
|
||||
# accessRole = "role/hedgedoc";
|
||||
|
||||
userProfileUsernameAttr = "name";
|
||||
userProfileDisplayNameAttr = "displayname";
|
||||
userProfileEmailAttr = "email";
|
||||
|
||||
clientID = "hedgedoc";
|
||||
# set via the `environmentFile`
|
||||
# clientSecret = "$CMD_OAUTH2_CLIENT_SECRET";
|
||||
};
|
||||
|
||||
uploadsPath = "/var/lib/hedgedoc/uploads";
|
||||
};
|
||||
|
||||
environmentFile = config.sops.secrets.hedgedoc_environment_file.path;
|
||||
};
|
||||
|
||||
services.jitsi-meet = {
|
||||
enable = false;
|
||||
hostName = "meet.${domain}";
|
||||
config = {
|
||||
prejoinPageEnabled = true;
|
||||
};
|
||||
caddy.enable = true;
|
||||
nginx.enable = false;
|
||||
};
|
||||
|
||||
sops.secrets.authelia_storageEncryptionKey = {
|
||||
sopsFile = ./webserver_secrets.yaml;
|
||||
owner = config.users.users.authelia-default.name;
|
||||
};
|
||||
|
||||
sops.secrets.authelia_jwtSecret = {
|
||||
sopsFile = ./webserver_secrets.yaml;
|
||||
owner = config.users.users.authelia-default.name;
|
||||
};
|
||||
|
||||
services.authelia.instances.default = let
|
||||
baseDir = "/var/lib/authelia-default";
|
||||
in {
|
||||
enable = true;
|
||||
secrets.storageEncryptionKeyFile = config.sops.secrets.authelia_storageEncryptionKey.path;
|
||||
secrets.jwtSecretFile = config.sops.secrets.authelia_jwtSecret.path;
|
||||
settings = {
|
||||
theme = "auto";
|
||||
default_2fa_method = "totp";
|
||||
log.level = "debug";
|
||||
|
||||
server = {
|
||||
disable_healthcheck = true;
|
||||
host = "127.0.0.1";
|
||||
port = 9091;
|
||||
# path = "authelia";
|
||||
};
|
||||
|
||||
storage = {
|
||||
local.path = "${baseDir}/authelia.sqlite";
|
||||
};
|
||||
|
||||
authentication_backend = {
|
||||
file.path = "${baseDir}/first_factor.yaml";
|
||||
file.search.email = true;
|
||||
file.search.case_insensitive = false;
|
||||
};
|
||||
|
||||
access_control = {
|
||||
default_policy = "one_factor";
|
||||
};
|
||||
|
||||
session.domain = "stefanjunker.de";
|
||||
|
||||
notifier = {
|
||||
disable_startup_check = true;
|
||||
filesystem.filename = "${baseDir}/notification.txt";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
users.groups.lldap = {};
|
||||
users.users.lldap = {
|
||||
isSystemUser = true;
|
||||
group = "lldap";
|
||||
};
|
||||
|
||||
sops.secrets.lldap_jwtSecret = {
|
||||
sopsFile = ./webserver_secrets.yaml;
|
||||
owner = config.users.users.lldap.name;
|
||||
};
|
||||
|
||||
sops.secrets.lldap_adminPassword = {
|
||||
sopsFile = ./webserver_secrets.yaml;
|
||||
owner = config.users.users.lldap.name;
|
||||
};
|
||||
|
||||
sops.secrets.lldap_environmentFile = {
|
||||
sopsFile = ./webserver_secrets.yaml;
|
||||
owner = config.users.users.lldap.name;
|
||||
};
|
||||
|
||||
services.lldap = {
|
||||
enable = true;
|
||||
environment = {
|
||||
LLDAP_JWT_SECRET_FILE = config.sops.secrets.lldap_jwtSecret.path;
|
||||
LLDAP_LDAP_USER_PASS_FILE = config.sops.secrets.lldap_adminPassword.path;
|
||||
};
|
||||
environmentFile = config.sops.secrets.lldap_environmentFile.path;
|
||||
|
||||
settings = {
|
||||
verbose = true;
|
||||
|
||||
ldap_base_dn = "dc=stefanjunker,dc=de";
|
||||
http_url = "https://lldap.${domain}";
|
||||
|
||||
## Options to configure SMTP parameters, to send password reset emails.
|
||||
## To set these options from environment variables, use the following format
|
||||
## (example with "password"): LLDAP_SMTP_OPTIONS__PASSWORD
|
||||
smtp_options = {
|
||||
## Whether to enabled password reset via email, from LLDAP.
|
||||
enable_password_reset = true;
|
||||
|
||||
# port = 465;
|
||||
## How the connection is encrypted, either "NONE" (no encryption), "TLS" or "STARTTLS".
|
||||
# smtp_encryption = "TLS";
|
||||
};
|
||||
|
||||
# database_url = "sqlite:///var/lib/lldap/users.db?mode=rwc";
|
||||
};
|
||||
};
|
||||
|
||||
sops.secrets.FORGEJO_JWT_SECRET = {};
|
||||
sops.secrets.FORGEJO_INTERNAL_TOKEN = {};
|
||||
sops.secrets.FORGEJO_SECRET_KEY = {};
|
||||
|
||||
services.forgejo = {
|
||||
enable = true;
|
||||
package = nodeFlake.inputs.nixpkgs-unstable.legacyPackages.${pkgs.system}.forgejo;
|
||||
settings = {
|
||||
service.DISABLE_REGISTRATION = true;
|
||||
server.HTTP_ADDR = "127.0.0.1";
|
||||
server.START_SSH_SERVER = true;
|
||||
server.SSH_PORT = forgejoSshPort;
|
||||
server.ROOT_URL = "https://forgejo.${domain}";
|
||||
server.HTTP_PORT = 3001;
|
||||
|
||||
# TODO: how do i get a 3072 length SSH key with the yubikey?
|
||||
"ssh.minimum_key_sizes".RSA = 2048;
|
||||
};
|
||||
secrets = {
|
||||
oauth2.JWT_SECRET = lib.mkForce config.sops.secrets.FORGEJO_JWT_SECRET.path;
|
||||
security.INTERNAL_TOKEN = lib.mkForce config.sops.secrets.FORGEJO_INTERNAL_TOKEN.path;
|
||||
security.SECRET_KEY = lib.mkForce config.sops.secrets.FORGEJO_SECRET_KEY.path;
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.lldap.serviceConfig.User = config.users.users.lldap.name;
|
||||
systemd.services.lldap.serviceConfig.Group = config.users.groups.lldap.name;
|
||||
systemd.services.lldap.serviceConfig.DynamicUser = lib.mkForce false;
|
||||
|
||||
# combine a path watcher with a service that transfers the certs by caddy to kanidm
|
||||
systemd.paths.kanidm-tls-watch = {
|
||||
enable = true;
|
||||
requiredBy = ["kanidm.service"];
|
||||
pathConfig = {
|
||||
PathChanged = [
|
||||
"${config.services.caddy.dataDir}/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/${config.services.kanidm.serverSettings.domain}/${config.services.kanidm.serverSettings.domain}.key"
|
||||
"${config.services.caddy.dataDir}/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/${config.services.kanidm.serverSettings.domain}/${config.services.kanidm.serverSettings.domain}.crt"
|
||||
];
|
||||
Unit = "kanidm-tls-update.service";
|
||||
};
|
||||
};
|
||||
systemd.services.kanidm-tls-update = let
|
||||
dbDir =
|
||||
builtins.dirOf
|
||||
config.services.kanidm.serverSettings.db_path;
|
||||
in {
|
||||
enable = true;
|
||||
requiredBy = ["kanidm.service"];
|
||||
unitConfig = {
|
||||
# ConditionPathExists = [
|
||||
# "${config.services.caddy.dataDir}/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/${config.services.kanidm.serverSettings.domain}/${config.services.kanidm.serverSettings.domain}.key"
|
||||
# "${config.services.caddy.dataDir}/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/${config.services.kanidm.serverSettings.domain}/${config.services.kanidm.serverSettings.domain}.crt"
|
||||
# ];
|
||||
};
|
||||
serviceConfig.Type = "oneshot";
|
||||
script = let
|
||||
tlsDir = builtins.dirOf config.services.kanidm.serverSettings.tls_key;
|
||||
in ''
|
||||
set -xe
|
||||
|
||||
cat "${config.services.caddy.dataDir}/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/${config.services.kanidm.serverSettings.domain}/${config.services.kanidm.serverSettings.domain}.key" > tls.key
|
||||
cat "${config.services.caddy.dataDir}/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/${config.services.kanidm.serverSettings.domain}/${config.services.kanidm.serverSettings.domain}.crt" > tls.chain
|
||||
|
||||
chown ${config.systemd.services.kanidm.serviceConfig.User}:${config.systemd.services.kanidm.serviceConfig.Group} tls.{key,chain}
|
||||
chmod 400 tls.{key,chain}
|
||||
|
||||
# create the kanidm directory in case it's missing
|
||||
if [[ ! -d ${tlsDir} ]]; then
|
||||
mkdir -p ${tlsDir}
|
||||
chown -R ${config.systemd.services.kanidm.serviceConfig.User}:${config.systemd.services.kanidm.serviceConfig.Group} ${tlsDir}
|
||||
chmod 700 ${tlsDir}
|
||||
fi
|
||||
|
||||
mv tls.key ${config.services.kanidm.serverSettings.tls_key}
|
||||
mv tls.chain ${config.services.kanidm.serverSettings.tls_chain}
|
||||
|
||||
if [[ ! -d ${dbDir} ]]; then
|
||||
mkdir -p ${dbDir}
|
||||
chown -R ${config.systemd.services.kanidm.serviceConfig.User}:${config.systemd.services.kanidm.serviceConfig.Group} ${dbDir}
|
||||
chmod 700 ${dbDir}
|
||||
fi
|
||||
'';
|
||||
};
|
||||
|
||||
systemd.services.kanidm.serviceConfig = let
|
||||
dbDir =
|
||||
builtins.dirOf
|
||||
config.services.kanidm.serverSettings.db_path;
|
||||
# stateDir = "/var/lib/${config.systemd.services.kanidm.serviceConfig.StateDirectory}";
|
||||
in {
|
||||
# ExecStartPre = ''
|
||||
# mkdir -p ${dbDir}
|
||||
# '';
|
||||
BindPaths = [
|
||||
dbDir
|
||||
# stateDir
|
||||
disabledModules = [
|
||||
"services/misc/forgejo.nix"
|
||||
"services/security/kanidm.nix"
|
||||
];
|
||||
};
|
||||
|
||||
services.kanidm = let
|
||||
dataDir = "/var/lib/kanidm";
|
||||
in {
|
||||
package = repoFlake.inputs.nixpkgs-kanidm.legacyPackages.${pkgs.system}.kanidm;
|
||||
imports = [
|
||||
"${nodeFlake.inputs.nixpkgs-unstable}/nixos/modules/services/misc/forgejo.nix"
|
||||
"${repoFlake.inputs.nixpkgs-kanidm}/nixos/modules/services/security/kanidm.nix"
|
||||
|
||||
enablePam = false;
|
||||
enableClient = false;
|
||||
../profiles/containers/configuration.nix
|
||||
|
||||
enableServer = true;
|
||||
serverSettings = {
|
||||
role = "WriteReplica";
|
||||
log_level = "debug";
|
||||
repoFlake.inputs.sops-nix.nixosModules.sops
|
||||
];
|
||||
|
||||
domain = "kanidm.${domain}";
|
||||
origin = "https://kanidm.${domain}";
|
||||
sops.defaultSopsFile = ./webserver_secrets.yaml;
|
||||
|
||||
db_path = "${dataDir}/db/kanidm.db";
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
httpPort
|
||||
httpsPort
|
||||
forgejoSshPort
|
||||
];
|
||||
|
||||
bindaddress = "127.0.0.1:8444";
|
||||
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
sops.secrets.hedgedoc_environment_file = {
|
||||
sopsFile = ./webserver_secrets.yaml;
|
||||
owner = config.users.users.hedgedoc.name;
|
||||
};
|
||||
|
||||
# don't expose ldap
|
||||
# ldapbindaddress = "[::1]:6636";
|
||||
services.caddy = {
|
||||
enable = true;
|
||||
logFormat = ''
|
||||
level ERROR
|
||||
'';
|
||||
virtualHosts."${domain}" = {
|
||||
extraConfig = ''
|
||||
redir /hedgedoc* https://hedgedoc.${domain}
|
||||
|
||||
tls_key = "${dataDir}/tls/tls.key";
|
||||
tls_chain = "${dataDir}/tls/tls.chain";
|
||||
file_server /*/* {
|
||||
browse
|
||||
root /var/www/stefanjunker.de/htdocs/caddy
|
||||
pass_thru
|
||||
}
|
||||
|
||||
online_backup = {
|
||||
schedule = "00 06 * * *";
|
||||
# respond "Hi"
|
||||
# respond (not /*/*) "Hi"
|
||||
'';
|
||||
};
|
||||
|
||||
virtualHosts."hedgedoc.${domain}" = {
|
||||
extraConfig = ''
|
||||
reverse_proxy http://[::1]:3000
|
||||
'';
|
||||
};
|
||||
|
||||
virtualHosts."authelia.${domain}" = {
|
||||
extraConfig = ''
|
||||
reverse_proxy http://127.0.0.1:${builtins.toString config.services.authelia.instances.default.settings.server.port}
|
||||
'';
|
||||
};
|
||||
|
||||
virtualHosts."lldap.${domain}" = {
|
||||
extraConfig = ''
|
||||
reverse_proxy http://127.0.0.1:${builtins.toString config.services.lldap.settings.http_port}
|
||||
'';
|
||||
};
|
||||
|
||||
virtualHosts."forgejo.${domain}" = {
|
||||
extraConfig = ''
|
||||
reverse_proxy http://127.0.0.1:${builtins.toString config.services.forgejo.settings.server.HTTP_PORT}
|
||||
'';
|
||||
};
|
||||
|
||||
virtualHosts."kanidm.${domain}" = {
|
||||
extraConfig = ''
|
||||
reverse_proxy https://${builtins.toString config.services.kanidm.serverSettings.bindaddress} {
|
||||
transport http {
|
||||
tls_server_name ${config.services.kanidm.serverSettings.domain}
|
||||
}
|
||||
}
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
services.hedgedoc = {
|
||||
enable = true;
|
||||
settings = {
|
||||
domain = "hedgedoc.${domain}";
|
||||
urlPath = "";
|
||||
protocolUseSSL = true;
|
||||
db = {
|
||||
dialect = "sqlite";
|
||||
storage = "/var/lib/hedgedoc/db.hedgedoc.sqlite";
|
||||
};
|
||||
|
||||
allowAnonymous = false;
|
||||
allowAnonymousEdits = false;
|
||||
allowGravatar = false;
|
||||
allowFreeURL = false;
|
||||
defaultPermission = "private";
|
||||
|
||||
allowEmailRegister = false;
|
||||
email = false;
|
||||
|
||||
ldap = {
|
||||
url = "ldap://127.0.0.1:${builtins.toString config.services.lldap.settings.ldap_port}";
|
||||
bindDn = "uid=admin,ou=people,dc=stefanjunker,dc=de";
|
||||
# these are set via the `environmentFile`
|
||||
# bindCredentials = "$LDAP_ADMIN_PASSWORD";
|
||||
searchBase = "ou=people,dc=stefanjunker,dc=de";
|
||||
searchFilter = "(&(memberOf=cn=hedgedoc,ou=groups,dc=stefanjunker,dc=de)(uid={{username}}))";
|
||||
useridField = "uid";
|
||||
};
|
||||
|
||||
oauth2 =
|
||||
let
|
||||
originURL = config.services.kanidm.serverSettings.origin;
|
||||
in
|
||||
{
|
||||
providerName = "kanidm (${originURL})";
|
||||
|
||||
authorizationURL = "${originURL}/ui/oauth2";
|
||||
tokenURL = "${originURL}/oauth2/token";
|
||||
userProfileURL = "${originURL}/oauth2/openid/hedgedoc/userinfo";
|
||||
|
||||
scope = "openid email profile";
|
||||
# rolesClaim = "roles";
|
||||
# accessRole = "role/hedgedoc";
|
||||
|
||||
userProfileUsernameAttr = "name";
|
||||
userProfileDisplayNameAttr = "displayname";
|
||||
userProfileEmailAttr = "email";
|
||||
|
||||
clientID = "hedgedoc";
|
||||
# set via the `environmentFile`
|
||||
# clientSecret = "$CMD_OAUTH2_CLIENT_SECRET";
|
||||
};
|
||||
|
||||
uploadsPath = "/var/lib/hedgedoc/uploads";
|
||||
};
|
||||
|
||||
environmentFile = config.sops.secrets.hedgedoc_environment_file.path;
|
||||
};
|
||||
|
||||
services.jitsi-meet = {
|
||||
enable = false;
|
||||
hostName = "meet.${domain}";
|
||||
config = {
|
||||
prejoinPageEnabled = true;
|
||||
};
|
||||
caddy.enable = true;
|
||||
nginx.enable = false;
|
||||
};
|
||||
|
||||
sops.secrets.authelia_storageEncryptionKey = {
|
||||
sopsFile = ./webserver_secrets.yaml;
|
||||
owner = config.users.users.authelia-default.name;
|
||||
};
|
||||
|
||||
sops.secrets.authelia_jwtSecret = {
|
||||
sopsFile = ./webserver_secrets.yaml;
|
||||
owner = config.users.users.authelia-default.name;
|
||||
};
|
||||
|
||||
services.authelia.instances.default =
|
||||
let
|
||||
baseDir = "/var/lib/authelia-default";
|
||||
in
|
||||
{
|
||||
enable = true;
|
||||
secrets.storageEncryptionKeyFile = config.sops.secrets.authelia_storageEncryptionKey.path;
|
||||
secrets.jwtSecretFile = config.sops.secrets.authelia_jwtSecret.path;
|
||||
settings = {
|
||||
theme = "auto";
|
||||
default_2fa_method = "totp";
|
||||
log.level = "debug";
|
||||
|
||||
server = {
|
||||
disable_healthcheck = true;
|
||||
host = "127.0.0.1";
|
||||
port = 9091;
|
||||
# path = "authelia";
|
||||
};
|
||||
|
||||
storage = {
|
||||
local.path = "${baseDir}/authelia.sqlite";
|
||||
};
|
||||
|
||||
authentication_backend = {
|
||||
file.path = "${baseDir}/first_factor.yaml";
|
||||
file.search.email = true;
|
||||
file.search.case_insensitive = false;
|
||||
};
|
||||
|
||||
access_control = {
|
||||
default_policy = "one_factor";
|
||||
};
|
||||
|
||||
session.domain = "stefanjunker.de";
|
||||
|
||||
notifier = {
|
||||
disable_startup_check = true;
|
||||
filesystem.filename = "${baseDir}/notification.txt";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
users.groups.lldap = { };
|
||||
users.users.lldap = {
|
||||
isSystemUser = true;
|
||||
group = "lldap";
|
||||
};
|
||||
|
||||
sops.secrets.lldap_jwtSecret = {
|
||||
sopsFile = ./webserver_secrets.yaml;
|
||||
owner = config.users.users.lldap.name;
|
||||
};
|
||||
|
||||
sops.secrets.lldap_adminPassword = {
|
||||
sopsFile = ./webserver_secrets.yaml;
|
||||
owner = config.users.users.lldap.name;
|
||||
};
|
||||
|
||||
sops.secrets.lldap_environmentFile = {
|
||||
sopsFile = ./webserver_secrets.yaml;
|
||||
owner = config.users.users.lldap.name;
|
||||
};
|
||||
|
||||
services.lldap = {
|
||||
enable = true;
|
||||
environment = {
|
||||
LLDAP_JWT_SECRET_FILE = config.sops.secrets.lldap_jwtSecret.path;
|
||||
LLDAP_LDAP_USER_PASS_FILE = config.sops.secrets.lldap_adminPassword.path;
|
||||
};
|
||||
environmentFile = config.sops.secrets.lldap_environmentFile.path;
|
||||
|
||||
settings = {
|
||||
verbose = true;
|
||||
|
||||
ldap_base_dn = "dc=stefanjunker,dc=de";
|
||||
http_url = "https://lldap.${domain}";
|
||||
|
||||
## Options to configure SMTP parameters, to send password reset emails.
|
||||
## To set these options from environment variables, use the following format
|
||||
## (example with "password"): LLDAP_SMTP_OPTIONS__PASSWORD
|
||||
smtp_options = {
|
||||
## Whether to enabled password reset via email, from LLDAP.
|
||||
enable_password_reset = true;
|
||||
|
||||
# port = 465;
|
||||
## How the connection is encrypted, either "NONE" (no encryption), "TLS" or "STARTTLS".
|
||||
# smtp_encryption = "TLS";
|
||||
};
|
||||
|
||||
# database_url = "sqlite:///var/lib/lldap/users.db?mode=rwc";
|
||||
};
|
||||
};
|
||||
|
||||
sops.secrets.FORGEJO_JWT_SECRET = { };
|
||||
sops.secrets.FORGEJO_INTERNAL_TOKEN = { };
|
||||
sops.secrets.FORGEJO_SECRET_KEY = { };
|
||||
|
||||
services.forgejo = {
|
||||
enable = true;
|
||||
package = nodeFlake.inputs.nixpkgs-unstable.legacyPackages.${pkgs.system}.forgejo;
|
||||
settings = {
|
||||
service.DISABLE_REGISTRATION = true;
|
||||
server.HTTP_ADDR = "127.0.0.1";
|
||||
server.START_SSH_SERVER = true;
|
||||
server.SSH_PORT = forgejoSshPort;
|
||||
server.ROOT_URL = "https://forgejo.${domain}";
|
||||
server.HTTP_PORT = 3001;
|
||||
|
||||
# TODO: how do i get a 3072 length SSH key with the yubikey?
|
||||
"ssh.minimum_key_sizes".RSA = 2048;
|
||||
};
|
||||
secrets = {
|
||||
oauth2.JWT_SECRET = lib.mkForce config.sops.secrets.FORGEJO_JWT_SECRET.path;
|
||||
security.INTERNAL_TOKEN = lib.mkForce config.sops.secrets.FORGEJO_INTERNAL_TOKEN.path;
|
||||
security.SECRET_KEY = lib.mkForce config.sops.secrets.FORGEJO_SECRET_KEY.path;
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.lldap.serviceConfig.User = config.users.users.lldap.name;
|
||||
systemd.services.lldap.serviceConfig.Group = config.users.groups.lldap.name;
|
||||
systemd.services.lldap.serviceConfig.DynamicUser = lib.mkForce false;
|
||||
|
||||
# combine a path watcher with a service that transfers the certs by caddy to kanidm
|
||||
systemd.paths.kanidm-tls-watch = {
|
||||
enable = true;
|
||||
requiredBy = [ "kanidm.service" ];
|
||||
pathConfig = {
|
||||
PathChanged = [
|
||||
"${config.services.caddy.dataDir}/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/${config.services.kanidm.serverSettings.domain}/${config.services.kanidm.serverSettings.domain}.key"
|
||||
"${config.services.caddy.dataDir}/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/${config.services.kanidm.serverSettings.domain}/${config.services.kanidm.serverSettings.domain}.crt"
|
||||
];
|
||||
Unit = "kanidm-tls-update.service";
|
||||
};
|
||||
};
|
||||
systemd.services.kanidm-tls-update =
|
||||
let
|
||||
dbDir = builtins.dirOf config.services.kanidm.serverSettings.db_path;
|
||||
in
|
||||
{
|
||||
enable = true;
|
||||
requiredBy = [ "kanidm.service" ];
|
||||
unitConfig = {
|
||||
# ConditionPathExists = [
|
||||
# "${config.services.caddy.dataDir}/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/${config.services.kanidm.serverSettings.domain}/${config.services.kanidm.serverSettings.domain}.key"
|
||||
# "${config.services.caddy.dataDir}/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/${config.services.kanidm.serverSettings.domain}/${config.services.kanidm.serverSettings.domain}.crt"
|
||||
# ];
|
||||
};
|
||||
serviceConfig.Type = "oneshot";
|
||||
script =
|
||||
let
|
||||
tlsDir = builtins.dirOf config.services.kanidm.serverSettings.tls_key;
|
||||
in
|
||||
''
|
||||
set -xe
|
||||
|
||||
cat "${config.services.caddy.dataDir}/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/${config.services.kanidm.serverSettings.domain}/${config.services.kanidm.serverSettings.domain}.key" > tls.key
|
||||
cat "${config.services.caddy.dataDir}/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/${config.services.kanidm.serverSettings.domain}/${config.services.kanidm.serverSettings.domain}.crt" > tls.chain
|
||||
|
||||
chown ${config.systemd.services.kanidm.serviceConfig.User}:${config.systemd.services.kanidm.serviceConfig.Group} tls.{key,chain}
|
||||
chmod 400 tls.{key,chain}
|
||||
|
||||
# create the kanidm directory in case it's missing
|
||||
if [[ ! -d ${tlsDir} ]]; then
|
||||
mkdir -p ${tlsDir}
|
||||
chown -R ${config.systemd.services.kanidm.serviceConfig.User}:${config.systemd.services.kanidm.serviceConfig.Group} ${tlsDir}
|
||||
chmod 700 ${tlsDir}
|
||||
fi
|
||||
|
||||
mv tls.key ${config.services.kanidm.serverSettings.tls_key}
|
||||
mv tls.chain ${config.services.kanidm.serverSettings.tls_chain}
|
||||
|
||||
if [[ ! -d ${dbDir} ]]; then
|
||||
mkdir -p ${dbDir}
|
||||
chown -R ${config.systemd.services.kanidm.serviceConfig.User}:${config.systemd.services.kanidm.serviceConfig.Group} ${dbDir}
|
||||
chmod 700 ${dbDir}
|
||||
fi
|
||||
'';
|
||||
};
|
||||
|
||||
systemd.services.kanidm.serviceConfig =
|
||||
let
|
||||
dbDir = builtins.dirOf config.services.kanidm.serverSettings.db_path;
|
||||
in
|
||||
# stateDir = "/var/lib/${config.systemd.services.kanidm.serviceConfig.StateDirectory}";
|
||||
{
|
||||
# ExecStartPre = ''
|
||||
# mkdir -p ${dbDir}
|
||||
# '';
|
||||
BindPaths = [
|
||||
dbDir
|
||||
# stateDir
|
||||
];
|
||||
};
|
||||
|
||||
services.kanidm =
|
||||
let
|
||||
dataDir = "/var/lib/kanidm";
|
||||
in
|
||||
{
|
||||
package = repoFlake.inputs.nixpkgs-kanidm.legacyPackages.${pkgs.system}.kanidm;
|
||||
|
||||
enablePam = false;
|
||||
enableClient = false;
|
||||
|
||||
enableServer = true;
|
||||
serverSettings = {
|
||||
role = "WriteReplica";
|
||||
log_level = "debug";
|
||||
|
||||
domain = "kanidm.${domain}";
|
||||
origin = "https://kanidm.${domain}";
|
||||
|
||||
db_path = "${dataDir}/db/kanidm.db";
|
||||
|
||||
bindaddress = "127.0.0.1:8444";
|
||||
|
||||
# don't expose ldap
|
||||
# ldapbindaddress = "[::1]:6636";
|
||||
|
||||
tls_key = "${dataDir}/tls/tls.key";
|
||||
tls_chain = "${dataDir}/tls/tls.chain";
|
||||
|
||||
online_backup = {
|
||||
schedule = "00 06 * * *";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
inherit autoStart;
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue