{ lib, config, pkgs, flake, ... }: with lib; let psCfg = config.pub-solar; xdg = config.home-manager.users."${psCfg.user.name}".xdg; in { disabledModules = [ "services/security/authelia.nix" ]; imports = [ "${flake.inputs.authelia-438}/nixos/modules/services/security/authelia.nix" ]; age.secrets."authelia-storage-encryption-key" = { file = "${flake.self}/secrets/authelia-storage-encryption-key.age"; mode = "400"; owner = "authelia-b12f"; }; age.secrets."authelia-session-secret" = { file = "${flake.self}/secrets/authelia-session-secret.age"; mode = "400"; owner = "authelia-b12f"; }; age.secrets."authelia-jwt-secret" = { file = "${flake.self}/secrets/authelia-jwt-secret.age"; mode = "400"; owner = "authelia-b12f"; }; age.secrets."authelia-users-file" = { file = "${flake.self}/secrets/authelia-users-file.age"; mode = "400"; owner = "authelia-b12f"; }; age.secrets."mail@b12f.io-password" = { file = "${flake.self}/secrets/mail@b12f.io-password.age"; mode = "400"; owner = "authelia-b12f"; }; security.acme.certs = { "auth.b12f.io" = {}; }; services.nginx.virtualHosts = { "auth.b12f.io" = { forceSSL = true; useACMEHost = "auth.b12f.io"; locations."/".proxyPass = "http://${config.services.authelia.instances.b12f.settings.server.address}"; locations."/".extraConfig = "include /etc/nginx/conf-available/proxy.conf;"; locations."/api/verify".proxyPass = "http://${config.services.authelia.instances.b12f.settings.server.address}"; locations."/api/authz".proxyPass = "http://${config.services.authelia.instances.b12f.settings.server.address}"; }; }; services.authelia.instances.b12f = { enable = true; secrets = { storageEncryptionKeyFile = config.age.secrets."authelia-storage-encryption-key".path; sessionSecretFile = config.age.secrets."authelia-session-secret".path; jwtSecretFile = config.age.secrets."authelia-jwt-secret".path; }; settings = { theme = "light"; default_2fa_method = "webauthn"; log.level = "debug"; server = { address = "127.0.0.1:9092"; endpoints.authz.auth-request.implementation = "AuthRequest"; }; authentication_backend = { refresh_interval = "disable"; password_reset = {disable = true;}; file = { path = config.age.secrets."authelia-users-file".path; watch = false; }; }; duo_api.disable = true; webauthn.user_verification = "required"; totp.issuer = "auth.b12f.io"; storage.local.path = "/var/lib/authelia-b12f/db.sqlite3"; access_control.default_policy = "two_factor"; session.cookies = [ { domain = "b12f.io"; authelia_url = "https://auth.b12f.io"; } ]; notifier.smtp = { host = "mail.b12f.io"; port = 587; username = "mail@b12f.io"; sender = "auth.b12f.io "; identifier = "auth@b12f.io"; subject = "[auth.b12f.io] {title}"; }; }; }; systemd.services.authelia-b12f.environment.AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE = config.age.secrets."mail@b12f.io-password".path; services.restic.backups = { authelia = { paths = ["/var/lib/authelia-b12f"]; initialize = true; passwordFile = config.age.secrets."restic-password".path; # See https://www.hosting.de/blog/verschluesselte-backups-mit-rclone-und-restic-in-nextcloud/ repository = "rclone:cloud.pub.solar:/backups/Authelia"; rcloneConfigFile = config.age.secrets."rclone-pie.conf".path; }; }; }