mirror of
https://github.com/foo-dogsquared/nixos-config.git
synced 2025-02-08 00:19:01 +00:00
Gabriel Arazas
2dbb3ed68c
This resolves some cases where the admin does not have all of their users within the protected domain and some in others.
53 lines
1.5 KiB
Nix
53 lines
1.5 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
let
|
|
inherit (config.services.vouch-proxy.instances."${vouchDomain}") settings;
|
|
vouchDomain = "vouch.${config.networking.domain}";
|
|
authDomain = config.services.kanidm.serverSettings.domain;
|
|
in
|
|
{
|
|
sops.secrets = lib.getSecrets ../../secrets/secrets.yaml {
|
|
"vouch-proxy/jwt/secret" = { };
|
|
"vouch-proxy/client/secret" = { };
|
|
};
|
|
|
|
services.vouch-proxy = {
|
|
enable = true;
|
|
instances."${vouchDomain}".settings = {
|
|
vouch = {
|
|
listen = "127.0.0.1";
|
|
port = 19900;
|
|
|
|
domains = [ "foodogsquared.one" ];
|
|
jwt.secret._secret = config.sops.secrets."vouch-proxy/jwt/secret".path;
|
|
};
|
|
|
|
oauth = rec {
|
|
provider = "oidc";
|
|
client_id = "vouch";
|
|
client_secret._secret = config.sops.secrets."vouch-proxy/client/secret".path;
|
|
code_challenge_method = "S256";
|
|
auth_url = "${authDomain}/ui/oauth2";
|
|
token_url = "${authDomain}/oauth2/token";
|
|
user_info_url = "${authDomain}/oauth2/openid/${client_id}/userinfo";
|
|
scopes = [ "login" "email" ];
|
|
callback_url = "https://${vouchDomain}/auth";
|
|
};
|
|
};
|
|
};
|
|
|
|
services.nginx.virtualHosts."${vouchDomain}" = {
|
|
forceSSL = true;
|
|
enableACME = true;
|
|
acmeRoot = null;
|
|
kTLS = true;
|
|
locations."/" = {
|
|
proxyPass = "http://${settings.vouch.listen}:${builtins.toString settings.vouch.port}";
|
|
extraConfig = ''
|
|
proxy_set_header Host ${vouchDomain};
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
'';
|
|
};
|
|
};
|
|
}
|