119 lines
3.3 KiB
Nix
119 lines
3.3 KiB
Nix
{
|
|
flake,
|
|
lib,
|
|
config,
|
|
pkgs,
|
|
...
|
|
}:
|
|
with lib; let
|
|
psCfg = config.pub-solar;
|
|
xdg = config.home-manager.users."${psCfg.user.name}".xdg;
|
|
in {
|
|
age.secrets."authelia-storage-encryption-key" = {
|
|
file = "${flake.self}/secrets/authelia-storage-encryption-key.age";
|
|
mode = "400";
|
|
owner = "authelia-b12f";
|
|
};
|
|
|
|
age.secrets."authelia-session-secret" = {
|
|
file = "${flake.self}/secrets/authelia-session-secret.age";
|
|
mode = "400";
|
|
owner = "authelia-b12f";
|
|
};
|
|
|
|
age.secrets."authelia-oidc-issuer-private-key" = {
|
|
file = "${flake.self}/secrets/authelia-oidc-issuer-private-key.age";
|
|
mode = "400";
|
|
owner = "authelia-b12f";
|
|
};
|
|
|
|
age.secrets."authelia-oidc-hmac-secret" = {
|
|
file = "${flake.self}/secrets/authelia-oidc-hmac-secret.age";
|
|
mode = "400";
|
|
owner = "authelia-b12f";
|
|
};
|
|
|
|
age.secrets."authelia-jwt-secret" = {
|
|
file = "${flake.self}/secrets/authelia-jwt-secret.age";
|
|
mode = "400";
|
|
owner = "authelia-b12f";
|
|
};
|
|
|
|
age.secrets."authelia-users-file" = {
|
|
file = "${flake.self}/secrets/authelia-users-file.age";
|
|
mode = "400";
|
|
owner = "authelia-b12f";
|
|
};
|
|
|
|
security.acme.certs = {
|
|
"auth.b12f.io" = {};
|
|
};
|
|
|
|
services.nginx.virtualHosts = {
|
|
"auth.b12f.io" = {
|
|
forceSSL = true;
|
|
useACMEHost = "auth.b12f.io";
|
|
locations."/".proxyPass = "http://127.0.0.1:${builtins.toString config.services.authelia.instances.b12f.settings.server.port}";
|
|
listenAdresses = [
|
|
"127.0.0.1"
|
|
"::1"
|
|
"10.13.12.2"
|
|
"fd00:b12f:acab:1312:acab:2::"
|
|
];
|
|
};
|
|
};
|
|
|
|
services.authelia.instances.b12f = {
|
|
enable = true;
|
|
|
|
secrets = {
|
|
storageEncryptionKeyFile = config.age.secrets."authelia-storage-encryption-key".path;
|
|
sessionSecretFile = config.age.secrets."authelia-session-secret".path;
|
|
oidcIssuerPrivateKeyFile = config.age.secrets."authelia-oidc-issuer-private-key".path;
|
|
oidcHmacSecretFile = config.age.secrets."authelia-oidc-hmac-secret".path;
|
|
jwtSecretFile = config.age.secrets."authelia-jwt-secret".path;
|
|
};
|
|
|
|
settings = {
|
|
theme = "light";
|
|
default_2fa_method = "totp";
|
|
log.level = "debug";
|
|
server.disable_healthcheck = true;
|
|
authentication_backend = {
|
|
refresh_interval = "disable";
|
|
password_reset = { disable = true; };
|
|
file = {
|
|
path = config.age.secrets."authelia-users-file".path;
|
|
watch = false;
|
|
};
|
|
};
|
|
duo_api.disable = true;
|
|
webauthn.user_verification = "required";
|
|
totp.issuer: "auth.b12f.io";
|
|
storage.local.path = "/var/lib/authelia/db.sqlite3";
|
|
identity_providers.oidc = {
|
|
authorization_policies.policy_name = {
|
|
default_policy = "two_factor";
|
|
rules = [
|
|
{
|
|
policy = "deny";
|
|
subject = "group:services";
|
|
}
|
|
];
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
services.restic.backups = {
|
|
authelia = {
|
|
paths = [ "/var/lib/authelia" ];
|
|
initialize = true;
|
|
passwordFile = config.age.secrets."restic-password".path;
|
|
# See https://www.hosting.de/blog/verschluesselte-backups-mit-rclone-und-restic-in-nextcloud/
|
|
repository = "rclone:cloud.pub.solar:/backups/Authelia";
|
|
rcloneConfigFile = config.age.secrets."rclone-pie.conf".path;
|
|
};
|
|
};
|
|
}
|