mirror of
https://github.com/foo-dogsquared/nixos-config.git
synced 2025-01-31 22:57:55 +00:00
Gabriel Arazas
2632b75bf2
Even though this is unlikely to be scaled further, we're just being good sysadmins (or at least roleplaying as one).
62 lines
1.7 KiB
Nix
62 lines
1.7 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
let
|
|
inherit (config.services.vouch-proxy.instances."${vouchDomain}") settings;
|
|
vouchDomain = "vouch.${config.networking.domain}";
|
|
authDomain = config.services.kanidm.serverSettings.domain;
|
|
in
|
|
{
|
|
sops.secrets = lib.getSecrets ../../secrets/secrets.yaml {
|
|
"vouch-proxy/jwt/secret" = { };
|
|
"vouch-proxy/client/secret" = { };
|
|
};
|
|
|
|
services.vouch-proxy = {
|
|
enable = true;
|
|
instances."${vouchDomain}".settings = {
|
|
vouch = {
|
|
listen = "127.0.0.1";
|
|
port = 19900;
|
|
|
|
domains = [ "foodogsquared.one" ];
|
|
jwt.secret._secret = config.sops.secrets."vouch-proxy/jwt/secret".path;
|
|
};
|
|
|
|
oauth = rec {
|
|
provider = "oidc";
|
|
client_id = "vouch";
|
|
client_secret._secret = config.sops.secrets."vouch-proxy/client/secret".path;
|
|
code_challenge_method = "S256";
|
|
auth_url = "${authDomain}/ui/oauth2";
|
|
token_url = "${authDomain}/oauth2/token";
|
|
user_info_url = "${authDomain}/oauth2/openid/${client_id}/userinfo";
|
|
scopes = [ "login" "email" ];
|
|
callback_url = "https://${vouchDomain}/auth";
|
|
};
|
|
};
|
|
};
|
|
|
|
services.nginx.virtualHosts."${vouchDomain}" = {
|
|
forceSSL = true;
|
|
enableACME = true;
|
|
acmeRoot = null;
|
|
kTLS = true;
|
|
locations."/" = {
|
|
proxyPass = "http://vouch-proxy";
|
|
extraConfig = ''
|
|
proxy_set_header Host ${vouchDomain};
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
'';
|
|
};
|
|
};
|
|
|
|
services.nginx.upstreams."vouch-proxy" = {
|
|
extraConfig = ''
|
|
zone apps;
|
|
'';
|
|
servers = {
|
|
"${settings.vouch.listen}:${builtins.toString settings.vouch.port}" = { };
|
|
};
|
|
};
|
|
}
|