Skip to content

Commit 7c83e3c

Browse files
IogaMasterIogaMaster
committed
current
1 parent 713622f commit 7c83e3c

4 files changed

Lines changed: 83 additions & 63 deletions

File tree

‎hosts/equinox/config.nix‎

Lines changed: 14 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -23,38 +23,22 @@ in {
2323
};
2424
services = {
2525
vaultwarden.enable = true;
26-
vault.enable = true;
26+
vault = {
27+
enable = true;
28+
consulServerAddress = "192.168.25.131";
29+
};
2730
};
2831
apps.tools.git.enable = true;
2932
};
3033

31-
# services.jellyfin = {
32-
# enable = true;
33-
# openFirewall = true; # Not strictly needed if Caddy is on the same machine
34-
# };
35-
#
36-
# networking.firewall.allowedTCPPorts = [
37-
# 8096 # Jellyfin
38-
# 8301 # Consul Gossip
39-
# 8300 # Consul RPC
40-
# ];
41-
#
42-
# services.consul = {
43-
# enable = true;
44-
# extraConfig = {
45-
# server = false;
46-
# retry_join = [ "192.168.25.131" ];
47-
# bind_addr = ''{{ GetPrivateInterfaces | attr "address" }}'';
48-
# services = [{
49-
# name = "jellyfin";
50-
# port = 8096;
51-
# tags = [ "media" "public" ];
52-
# check = {
53-
# http = "http://127.0.0.1:8096/health";
54-
# interval = "10s";
55-
# timeout = "1s";
56-
# };
57-
# }];
58-
# };
59-
# };
34+
services.jellyfin = {
35+
enable = true;
36+
openFirewall = true; # Not strictly needed if Caddy is on the same machine
37+
};
38+
39+
networking.firewall.allowedTCPPorts = [
40+
8096 # Jellyfin
41+
8301 # Consul Gossip
42+
8300 # Consul RPC
43+
];
6044
}

‎modules/services/authelia.nix‎

Lines changed: 26 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -9,21 +9,24 @@ lib.mkModule args "ioga.services.authelia" {
99
user = "authelia-${cfg.instanceName}";
1010
group = "authelia-${cfg.instanceName}";
1111
};
12+
1213
services.authelia.instances.${cfg.instanceName} = {
1314
enable = true;
15+
1416
secrets = {
1517
jwtSecretFile = "${secrets.authelia}/jwtSecretFile";
1618
sessionSecretFile = "${secrets.authelia}/sessionSecretFile";
1719
storageEncryptionKeyFile =
1820
"${secrets.authelia}/storageEncryptionKeyFile";
21+
oidcHmacSecretFile = "${secrets.authelia}/oidcHmac";
22+
oidcIssuerPrivateKeyFile = "${secrets.authelia}/oidcKey";
1923
};
2024

2125
settings = {
2226
theme = "dark";
2327
server.address = "tcp://0.0.0.0:9091";
2428

25-
authentication_backend.file.path =
26-
"/var/lib/authelia-${cfg.instanceName}/users.yml";
29+
authentication_backend.file.path = "${secrets.authelia}/users.yml";
2730
storage.local.path = "/var/lib/authelia-${cfg.instanceName}/db.sqlite3";
2831
notifier.filesystem.filename =
2932
"/var/lib/authelia-${cfg.instanceName}/emails.txt";
@@ -42,6 +45,23 @@ lib.mkModule args "ioga.services.authelia" {
4245
];
4346
};
4447

48+
identity_providers.oidc = {
49+
clients = [{
50+
client_id = "vault";
51+
client_name = "HashiCorp Vault";
52+
public = false;
53+
client_secret =
54+
''{{ secret "${secrets.authelia}/clientSecretHash" }}'';
55+
authorization_policy = "two_factor";
56+
redirect_uris = [
57+
"https://vault.ioga.dev"
58+
"http://localhost:8250/oidc/callback"
59+
];
60+
scopes = [ "openid" "profile" "email" "groups" ];
61+
userinfo_signed_response_alg = "none";
62+
}];
63+
};
64+
4565
session.cookies = [{
4666
inherit (cfg) domain;
4767
authelia_url = "https://auth.${cfg.domain}";
@@ -52,23 +72,10 @@ lib.mkModule args "ioga.services.authelia" {
5272

5373
systemd.services."authelia-${cfg.instanceName}" = {
5474
serviceConfig.StateDirectory = "authelia-${cfg.instanceName}";
55-
preStart = # bash
56-
''
57-
USER_DB="/var/lib/authelia-${cfg.instanceName}/users.yml"
58-
PASS=$(cat ${secrets.authelia}/adminPassword)
59-
HASHED_PASSWORD=$(${pkgs.authelia}/bin/authelia crypto hash generate argon2 --password "$PASS" | ${pkgs.gawk}/bin/awk '/Digest:/ {print $2}')
60-
if [ ! -s "$USER_DB" ]; then
61-
echo "${''
62-
users:
63-
admin:
64-
displayname: "Admin"
65-
password: "$HASHED_PASSWORD"
66-
email: "admin@${cfg.domain}"
67-
groups: [admins]''}" > "$USER_DB"
68-
chmod 600 "$USER_DB"
69-
chown authelia-${cfg.instanceName}:authelia-${cfg.instanceName} "$USER_DB"
70-
fi
71-
'';
75+
76+
# 4. Enable the 'template' filter via environment variable
77+
# This allows Authelia to process the {{ secret }} syntax in the config file.
78+
environment.X_AUTHELIA_CONFIG_FILTERS = "template";
7279
};
7380
};
7481
}

‎modules/services/reverse_proxy.nix‎

Lines changed: 15 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -30,25 +30,29 @@ lib.mkModule args "ioga.services.reverse_proxy" {
3030
forward_auth 0.0.0.0:9091 {
3131
uri /api/authz/forward-auth
3232
copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
33-
# Important for session cookie logic
34-
header_up X-Forwarded-Proto {scheme}
35-
header_up X-Forwarded-Host {host}
33+
header_up X-Forwarded-Proto https # cloudflare tunnel gives http
34+
header_up Host {host}
3635
}
3736
}
38-
37+
(consul_router) {
38+
reverse_proxy {
39+
dynamic srv {
40+
name "{labels.2}.service.consul"
41+
resolvers 127.0.0.1:8600
42+
}
43+
transport http {
44+
resolvers 127.0.0.1:8600
45+
}
46+
header_up Host {host}
47+
}
48+
}
3949
http://auth.${cfg.domain} {
4050
reverse_proxy 0.0.0.0:9091
4151
}
4252
4353
http://*.${cfg.domain} {
4454
import authelia_auth
45-
46-
reverse_proxy {
47-
dynamic srv {
48-
name "{labels.2}.service.consul"
49-
resolvers 127.0.0.1:8600
50-
}
51-
}
55+
import consul_router
5256
}
5357
'';
5458
};

‎modules/services/vault.nix‎

Lines changed: 28 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,14 @@
11
{ lib, pkgs, secrets, ... }@args:
22
lib.mkModule args "ioga.services.vault" {
3+
options = with lib; { consulServerAddress = mkOpt' types.str ""; };
34
config = { cfg }: {
4-
environment.systemPackages = with pkgs; [ vault-bin ];
5-
6-
environment.persist.directories = [ "/run/secrets/vault" ];
75
systemd.services.vault.serviceConfig.EnvironmentFile =
86
"/run/secrets/vault/environment"; # only way to get the secret into the service
7+
environment = {
8+
systemPackages = with pkgs; [ vault-bin ];
9+
persist.directories = [ "/run/secrets/vault" ];
10+
variables = { VAULT_ADDR = "https://vault.ioga.dev"; };
11+
};
912

1013
services.vault = {
1114
enable = true;
@@ -24,6 +27,28 @@ lib.mkModule args "ioga.services.vault" {
2427
ui = true
2528
'';
2629
};
30+
systemd.services.vault.environment = {
31+
VAULT_ADDR = "https://vault.ioga.dev";
32+
};
33+
34+
services.consul = {
35+
enable = true;
36+
extraConfig = {
37+
server = false;
38+
retry_join = [ cfg.consulServerAddress ];
39+
bind_addr = ''{{ GetPrivateInterfaces | attr "address" }}'';
40+
services = [{
41+
name = "vault";
42+
port = 8200;
43+
tags = [ "public" ];
44+
check = {
45+
http = "http://127.0.0.1:8200/v1/sys/health";
46+
interval = "10s";
47+
timeout = "1s";
48+
};
49+
}];
50+
};
51+
};
2752

2853
networking.firewall.allowedTCPPorts = [ 8200 ];
2954
};

0 commit comments

Comments
 (0)