81 lines
3.0 KiB
Nix
81 lines
3.0 KiB
Nix
|
{ config, pkgs, lib, materusArg, ... }:
|
||
|
|
{
|
||
|
|
options.waffentragerService.auth.authelia.enable = materusArg.pkgs.lib.mkBoolOpt false "Enable authelia";
|
||
|
|
config =
|
||
|
|
let
|
||
|
|
cfg = config.waffentragerService.auth.authelia;
|
||
|
|
port = 9091;
|
||
|
|
in
|
||
|
|
lib.mkIf cfg.enable {
|
||
|
|
sops.secrets."authelia-storagekey" = { owner = "authelia"; };
|
||
|
|
sops.secrets."authelia-database" = { owner = "authelia"; };
|
||
|
|
sops.secrets."ldap-master" = { owner = "authelia"; };
|
||
|
|
users.users.authelia = {
|
||
|
|
group = "lldap";
|
||
|
|
isSystemUser = true;
|
||
|
|
};
|
||
|
|
services.authelia.instances.main = {
|
||
|
|
enable = true;
|
||
|
|
user = "authelia";
|
||
|
|
environmentVariables = {
|
||
|
|
AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PASSWORD_FILE = config.sops.secrets."ldap-master".path;
|
||
|
|
AUTHELIA_STORAGE_POSTGRES_PASSWORD_FILE = config.sops.secrets."authelia-database".path;
|
||
|
|
};
|
||
|
|
secrets = {
|
||
|
|
jwtSecretFile = config.sops.secrets.jwt.path;
|
||
|
|
storageEncryptionKeyFile = config.sops.secrets."authelia-storagekey".path;
|
||
|
|
};
|
||
|
|
settings = {
|
||
|
|
access_control = {
|
||
|
|
default_policy = "one_factor";
|
||
|
|
};
|
||
|
|
authentication_backend = {
|
||
|
|
ldap.url = "ldap://127.0.0.1:3890";
|
||
|
|
ldap.implementation = "custom";
|
||
|
|
ldap.base_dn = config.services.lldap.settings.ldap_base_dn;
|
||
|
|
ldap.user = "CN=master,ou=people,DC=podkos,DC=pl";
|
||
|
|
ldap.additional_users_dn = "OU=people";
|
||
|
|
ldap.users_filter = "(&({username_attribute}={input})(objectClass=person))";
|
||
|
|
ldap.additional_groups_dn = "OU=groups";
|
||
|
|
ldap.groups_filter = "(&(member={dn})(objectClass=groupOfNames))";
|
||
|
|
};
|
||
|
|
storage = {
|
||
|
|
postgres.host = "/var/run/postgresql";
|
||
|
|
postgres.port = "5432";
|
||
|
|
postgres.database = "authelia";
|
||
|
|
postgres.username = "authelia";
|
||
|
|
|
||
|
|
};
|
||
|
|
notifier = {
|
||
|
|
disable_startup_check = false;
|
||
|
|
filesystem.filename = "/tmp/test_notification.txt";
|
||
|
|
};
|
||
|
|
session = {
|
||
|
|
name = "materus-session";
|
||
|
|
domain = "materus.pl";
|
||
|
|
};
|
||
|
|
|
||
|
|
default_redirection_url = "https://materus.pl";
|
||
|
|
server.port = port;
|
||
|
|
};
|
||
|
|
};
|
||
|
|
services.nginx.virtualHosts."gatekeeper.materus.pl" = {
|
||
|
|
forceSSL = true;
|
||
|
|
http3 = true;
|
||
|
|
sslTrustedCertificate = "/var/lib/mnt_acme/materus.pl/chain.pem";
|
||
|
|
sslCertificateKey = "/var/lib/mnt_acme/materus.pl/key.pem";
|
||
|
|
sslCertificate = "/var/lib/mnt_acme/materus.pl/fullchain.pem";
|
||
|
|
locations."/" = {
|
||
|
|
proxyPass = "http://127.0.0.1:${builtins.toString port}";
|
||
|
|
extraConfig = ''
|
||
|
|
proxy_set_header Host $host;
|
||
|
|
proxy_set_header X-Real-IP $remote_addr;
|
||
|
|
proxy_set_header X-Forwarded-Ssl on;
|
||
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
||
|
|
'';
|
||
|
|
};
|
||
|
|
};
|
||
|
|
};
|
||
|
|
}
|