waffentrager: init

2026-06-24 17:36:41 +00:00 · 2026-06-24 00:06:21 +02:00
parent 29adb6e6b0
commit fb653eb0f4
30 changed files with 1325 additions and 11 deletions
@@ -0,0 +1,87 @@
+{
+  config,
+  pkgs,
+  lib,
+  mkk,
+  ...
+}:
+{
+  options.waffentragerService.auth.lldap.enable = mkk.lib.mkBoolOpt false "Enable lldap";
+  config =
+    let
+      cfg = config.waffentragerService.auth.lldap;
+    in
+    lib.mkIf cfg.enable {
+      waffentragerService.elements.enable = true;
+      waffentragerService.nginx.enable = true;
+      services.nginx.virtualHosts."mamba.podkos.pl" = {
+        forceSSL = true;
+        http3 = true;
+        sslTrustedCertificate = "/var/lib/mnt_acme/mamba.podkos.pl/chain.pem";
+        sslCertificateKey = "/var/lib/mnt_acme/mamba.podkos.pl/key.pem";
+        sslCertificate = "/var/lib/mnt_acme/mamba.podkos.pl/fullchain.pem";
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:17170";
+          extraConfig = ''
+            proxy_set_header    Host                $host;
+            proxy_set_header    X-Real-IP           $remote_addr;
+            proxy_set_header    X-Forwarded-Ssl     on;
+            proxy_set_header    X-Forwarded-For     $proxy_add_x_forwarded_for;
+            proxy_set_header    X-Forwarded-Proto   $scheme;
+
+
+            allow ${mkk.wireguard.ip-masks.main};
+            allow 192.168.100.0/24;
+            deny all;
+          '';
+        };
+      };
+
+      systemd.services.lldap = {
+        requires = [ "elements-mount.service" ];
+        after = [ "elements-mount.service" ];
+        serviceConfig = {
+          DynamicUser = lib.mkForce false;
+          WorkingDirectory = lib.mkForce config.waffentragerService.elements.lldapDir;
+        };
+      };
+      users.groups.lldap = { };
+      users.users.lldap = {
+        group = "lldap";
+        isSystemUser = true;
+      };
+      sops.secrets.jwt = {
+        owner = "lldap";
+        group = "lldap";
+        mode = "0440";
+      };
+      sops.secrets."lldap-database" = {
+        owner = "lldap";
+        group = "lldap";
+      };
+      services.lldap.enable = true;
+      services.lldap.environmentFile = config.sops.templates."lldap.env".path;
+      sops.templates."lldap.env" = {
+        content = ''
+          LLDAP_JWT_SECRET_FILE="${config.sops.secrets.jwt.path}"
+          LLDAP_DATABASE_URL="postgres://lldap:${
+            config.sops.placeholder."lldap-database"
+          }@%2Fvar%2Frun%2Fpostgresql/lldap"
+        '';
+        owner = "lldap";
+        group = "lldap";
+      };
+      services.lldap.silenceForceUserPassResetWarning = true;
+      services.lldap.settings = {
+        ldap_base_dn = "dc=podkos,dc=pl";
+
+        ldap_host = "127.0.0.1";
+        http_url = "https://mamba.podkos.pl";
+        ldap_user_dn = "master";
+        ldap_user_email = "materus@podkos.pl";
+        ldap_port = 3890;
+        key_seed = mkk.waffentrager.lldap.seed;
+        ldap_user_pass_file = config.sops.secrets.LLDAP_LDAP_USER_PASS_FILE.path;
+      };
+    };
+}