109 lines
2.6 KiB
Nix
109 lines
2.6 KiB
Nix
{ config, lib, libC, ... }:
|
|
|
|
{
|
|
c3d2.deployment.server = "server10";
|
|
|
|
system.stateVersion = "22.05";
|
|
|
|
networking = {
|
|
hostName = "auth";
|
|
firewall.allowedTCPPorts = [
|
|
636 # ldaps
|
|
];
|
|
};
|
|
|
|
services = {
|
|
backup = {
|
|
enable = true;
|
|
paths = [ "/var/lib/portunus/" ];
|
|
};
|
|
|
|
nginx = {
|
|
enable = true;
|
|
virtualHosts."auth.c3d2.de" = {
|
|
forceSSL = true;
|
|
enableACME = true;
|
|
listen = libC.defaultListen;
|
|
locations = {
|
|
"/".proxyPass = "http://127.0.0.1:${toString config.services.portunus.port}";
|
|
"/dex".proxyPass = "http://127.0.0.1:${toString config.services.portunus.dex.port}";
|
|
};
|
|
};
|
|
};
|
|
|
|
portunus = {
|
|
enable = true;
|
|
dex = {
|
|
enable = true;
|
|
oidcClients = [{
|
|
callbackURL = "https://grafana.hq.c3d2.de/login/generic_oauth";
|
|
id = "grafana";
|
|
}];
|
|
};
|
|
ldap = {
|
|
searchUserName = "search";
|
|
suffix = "dc=c3d2,dc=de";
|
|
tls = true;
|
|
};
|
|
port = 5555;
|
|
removeAddGroup = true;
|
|
seedGroups = true;
|
|
seedSettings = {
|
|
groups = [
|
|
{
|
|
long_name = "Portunus Administrators";
|
|
name = "admins";
|
|
members = [ "admin" ];
|
|
permissions.portunus.is_admin = true;
|
|
}
|
|
{
|
|
long_name = "Search";
|
|
name = "search";
|
|
members = [ "search" ];
|
|
permissions.ldap.can_read = true;
|
|
}
|
|
];
|
|
users = [
|
|
{
|
|
family_name = "Administrator";
|
|
given_name = "Initial";
|
|
login_name = "admin";
|
|
password.from_command = [ "/usr/bin/env" "cat" "/run/secrets/portunus/users/admin-password" ];
|
|
}
|
|
{
|
|
email = "search@c3d2.de";
|
|
family_name = "-";
|
|
given_name = "Search";
|
|
login_name = "search";
|
|
password.from_command = [ "/usr/bin/env" "cat" "/run/secrets/portunus/users/search-password" ];
|
|
}
|
|
];
|
|
};
|
|
};
|
|
};
|
|
|
|
sops = {
|
|
defaultSopsFile = ./secrets.yaml;
|
|
secrets = {
|
|
"dex/environment".owner = "dex";
|
|
"portunus/users/admin-password".owner = "portunus";
|
|
"portunus/users/search-password".owner = "portunus";
|
|
};
|
|
};
|
|
|
|
systemd.services.dex.serviceConfig = {
|
|
DynamicUser = lib.mkForce false;
|
|
EnvironmentFile = config.sops.secrets."dex/environment".path;
|
|
StateDirectory = "dex";
|
|
User = "dex";
|
|
};
|
|
|
|
users = {
|
|
groups.dex = { };
|
|
users.dex = {
|
|
group = "dex";
|
|
isSystemUser = true;
|
|
};
|
|
};
|
|
}
|