mirror of
https://github.com/nickolaj-jepsen/nixos.git
synced 2026-01-22 16:16:50 +01:00
refactor: split overloaded modules
This commit is contained in:
Nickolaj Jepsen
parent
234ab50a2c
commit
15f5c2552d
15 changed files with 638 additions and 586 deletions
|
|
@ -8,7 +8,7 @@
|
|||
./audiobookshelf.nix
|
||||
./freshrss.nix
|
||||
./glance.nix
|
||||
./home-assistant.nix
|
||||
./home-assistant
|
||||
./jellyfin.nix
|
||||
./nextcloud.nix
|
||||
./nginx.nix
|
||||
|
|
@ -19,7 +19,7 @@
|
|||
./restic.nix
|
||||
./scrutiny.nix
|
||||
./security.nix
|
||||
./sso.nix
|
||||
./sso
|
||||
./vaultwarden.nix
|
||||
];
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,224 +0,0 @@
|
|||
{
|
||||
pkgs,
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
lib.mkIf config.fireproof.homelab.enable (let
|
||||
mosquittoPort = 1883;
|
||||
zigbee2mqttPort = 8180;
|
||||
homeAssistantPort = 8123;
|
||||
in {
|
||||
age.secrets = {
|
||||
"zigbee2mqtt-secret.yaml" = {
|
||||
rekeyFile = ../../secrets/hosts/homelab/zigbee2mqtt-secret.yaml.age;
|
||||
owner = "zigbee2mqtt";
|
||||
group = "zigbee2mqtt";
|
||||
};
|
||||
mosquitto-zigbee2mqtt.rekeyFile = ../../secrets/hosts/homelab/mosquitto-zigbee2mqtt.age;
|
||||
mosquitto-sas.rekeyFile = ../../secrets/hosts/homelab/mosquitto-sas.age;
|
||||
mosquitto-ha.rekeyFile = ../../secrets/hosts/homelab/mosquitto-ha.age;
|
||||
hassSecrets = {
|
||||
rekeyFile = ../../secrets/hosts/homelab/hass.yaml.age;
|
||||
path = "${config.services.home-assistant.configDir}/secrets.yaml";
|
||||
mode = "400";
|
||||
owner = "hass";
|
||||
group = "hass";
|
||||
};
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
mosquittoPort
|
||||
];
|
||||
|
||||
services = {
|
||||
restic.backups.homelab = {
|
||||
paths = [
|
||||
config.services.zigbee2mqtt.dataDir
|
||||
config.services.home-assistant.configDir
|
||||
];
|
||||
exclude = [
|
||||
"/var/lib/zigbee2mqtt/log/"
|
||||
];
|
||||
};
|
||||
|
||||
oauth2-proxy.nginx.virtualHosts."zigbee.nickolaj.com".allowed_groups = ["iot-admin"];
|
||||
nginx.virtualHosts = {
|
||||
"zigbee.nickolaj.com" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."/" = {
|
||||
proxyPass = "http://localhost:${toString zigbee2mqttPort}";
|
||||
proxyWebsockets = true;
|
||||
};
|
||||
};
|
||||
"ha.nickolaj.com" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."/" = {
|
||||
proxyPass = "http://localhost:${toString homeAssistantPort}";
|
||||
proxyWebsockets = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
home-assistant = {
|
||||
enable = true;
|
||||
package = pkgs.home-assistant;
|
||||
customComponents = with pkgs.home-assistant-custom-components; [
|
||||
adaptive_lighting
|
||||
sleep_as_android_mqtt
|
||||
(pkgs.buildHomeAssistantComponent rec {
|
||||
owner = "Sian-Lee-SA";
|
||||
domain = "switch_manager";
|
||||
version = "v2.0.4b";
|
||||
src = pkgs.fetchFromGitHub {
|
||||
inherit owner;
|
||||
repo = "Home-Assistant-Switch-Manager";
|
||||
rev = version;
|
||||
hash = "sha256-W9xO3JjnRKHk/dlXMA6y5nEJl/KsGzPvJoumGw+nohw=";
|
||||
};
|
||||
})
|
||||
(pkgs.buildHomeAssistantComponent rec {
|
||||
owner = "snicker";
|
||||
domain = "zwift";
|
||||
version = "v3.3.5";
|
||||
src = pkgs.fetchFromGitHub {
|
||||
inherit owner;
|
||||
repo = "zwift_hass";
|
||||
rev = version;
|
||||
hash = "sha256-+lJ6Otp8lT+xVtjiQLSQrqT5cVinRTRPTzS+HB1AxB0=";
|
||||
};
|
||||
propagatedBuildInputs = [
|
||||
(pkgs.python313.pkgs.buildPythonPackage rec {
|
||||
pname = "zwift-client";
|
||||
version = "0.2.0";
|
||||
pyproject = true;
|
||||
src = pkgs.fetchFromGitHub {
|
||||
owner = "nickolaj-jepsen";
|
||||
repo = "zwift-client";
|
||||
rev = "882fb881f1271dc104fd0250cab4ceb6e3710a59";
|
||||
hash = "sha256-4gOlWG+QVwODlIhiNH7rhiD0rzNv2WxY2ty9o/51eHU=";
|
||||
};
|
||||
doCheck = false;
|
||||
propagatedBuildInputs = with pkgs.python313.pkgs; [
|
||||
hatchling
|
||||
requests
|
||||
protobuf
|
||||
];
|
||||
})
|
||||
];
|
||||
})
|
||||
];
|
||||
extraComponents = [
|
||||
"default_config"
|
||||
"met"
|
||||
"mqtt"
|
||||
"esphome"
|
||||
"google"
|
||||
"spotify"
|
||||
"unifi"
|
||||
"upnp"
|
||||
"homeassistant_hardware"
|
||||
];
|
||||
config = {
|
||||
homeassistant = {
|
||||
name = "Home";
|
||||
latitude = "!secret latitude";
|
||||
longitude = "!secret longitude";
|
||||
elevation = "!secret elevation";
|
||||
unit_system = "metric";
|
||||
time_zone = "Europe/Copenhagen";
|
||||
};
|
||||
frontend = {
|
||||
themes = "!include_dir_merge_named themes";
|
||||
};
|
||||
http = {
|
||||
server_port = homeAssistantPort;
|
||||
use_x_forwarded_for = true;
|
||||
trusted_proxies = [
|
||||
"127.0.0.1"
|
||||
"::1"
|
||||
];
|
||||
};
|
||||
sensor = [
|
||||
{
|
||||
platform = "zwift";
|
||||
username = "!secret zwift_username";
|
||||
password = "!secret zwift_password";
|
||||
}
|
||||
];
|
||||
|
||||
automation = "!include automations.yaml";
|
||||
script = "!include scripts.yaml";
|
||||
scene = "!include scenes.yaml";
|
||||
};
|
||||
};
|
||||
|
||||
mosquitto = {
|
||||
enable = true;
|
||||
listeners = [
|
||||
{
|
||||
port = mosquittoPort;
|
||||
users."zigbee2mqtt" = {
|
||||
acl = ["readwrite #"];
|
||||
passwordFile = "${config.age.secrets.mosquitto-zigbee2mqtt.path}";
|
||||
};
|
||||
users."homeassistant" = {
|
||||
acl = ["readwrite #"];
|
||||
passwordFile = "${config.age.secrets.mosquitto-ha.path}";
|
||||
};
|
||||
users."sleep_as_android" = {
|
||||
acl = ["readwrite SleepAsAndroid"];
|
||||
passwordFile = "${config.age.secrets.mosquitto-sas.path}";
|
||||
};
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
zigbee2mqtt = {
|
||||
enable = true;
|
||||
settings = {
|
||||
homeassistant = {
|
||||
enabled = true;
|
||||
};
|
||||
mqtt = {
|
||||
base_topic = "zigbee2mqtt";
|
||||
server = "mqtt://localhost:${toString mosquittoPort}";
|
||||
user = "zigbee2mqtt";
|
||||
password = "!${config.age.secrets."zigbee2mqtt-secret.yaml".path} password";
|
||||
};
|
||||
frontend = {
|
||||
enabled = true;
|
||||
port = zigbee2mqttPort;
|
||||
};
|
||||
serial = {
|
||||
port = "/dev/serial/by-id/usb-Silicon_Labs_Sonoff_Zigbee_3.0_USB_Dongle_Plus_0001-if00-port0";
|
||||
adapter = "zstack";
|
||||
};
|
||||
advanced = {
|
||||
network_key = [
|
||||
233
|
||||
138
|
||||
136
|
||||
76
|
||||
51
|
||||
117
|
||||
128
|
||||
127
|
||||
74
|
||||
84
|
||||
33
|
||||
179
|
||||
116
|
||||
61
|
||||
79
|
||||
101
|
||||
];
|
||||
channel = 25;
|
||||
log_level = "debug";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
})
|
||||
6
modules/homelab/home-assistant/default.nix
Normal file
6
modules/homelab/home-assistant/default.nix
Normal file
|
|
@ -0,0 +1,6 @@
|
|||
{...}: {
|
||||
imports = [
|
||||
./hass.nix
|
||||
./mqtt.nix
|
||||
];
|
||||
}
|
||||
124
modules/homelab/home-assistant/hass.nix
Normal file
124
modules/homelab/home-assistant/hass.nix
Normal file
|
|
@ -0,0 +1,124 @@
|
|||
{
|
||||
pkgs,
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
homeAssistantPort = 8123;
|
||||
in {
|
||||
config = lib.mkIf config.fireproof.homelab.enable {
|
||||
age.secrets.hassSecrets = {
|
||||
rekeyFile = ../../../secrets/hosts/homelab/hass.yaml.age;
|
||||
path = "${config.services.home-assistant.configDir}/secrets.yaml";
|
||||
mode = "400";
|
||||
owner = "hass";
|
||||
group = "hass";
|
||||
};
|
||||
|
||||
services.restic.backups.homelab = {
|
||||
paths = [config.services.home-assistant.configDir];
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts."ha.nickolaj.com" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."/" = {
|
||||
proxyPass = "http://localhost:${toString homeAssistantPort}";
|
||||
proxyWebsockets = true;
|
||||
};
|
||||
};
|
||||
|
||||
services.home-assistant = {
|
||||
enable = true;
|
||||
package = pkgs.home-assistant;
|
||||
customComponents = with pkgs.home-assistant-custom-components; [
|
||||
adaptive_lighting
|
||||
sleep_as_android_mqtt
|
||||
(pkgs.buildHomeAssistantComponent rec {
|
||||
owner = "Sian-Lee-SA";
|
||||
domain = "switch_manager";
|
||||
version = "v2.0.4b";
|
||||
src = pkgs.fetchFromGitHub {
|
||||
inherit owner;
|
||||
repo = "Home-Assistant-Switch-Manager";
|
||||
rev = version;
|
||||
hash = "sha256-W9xO3JjnRKHk/dlXMA6y5nEJl/KsGzPvJoumGw+nohw=";
|
||||
};
|
||||
})
|
||||
(pkgs.buildHomeAssistantComponent rec {
|
||||
owner = "snicker";
|
||||
domain = "zwift";
|
||||
version = "v3.3.5";
|
||||
src = pkgs.fetchFromGitHub {
|
||||
inherit owner;
|
||||
repo = "zwift_hass";
|
||||
rev = version;
|
||||
hash = "sha256-+lJ6Otp8lT+xVtjiQLSQrqT5cVinRTRPTzS+HB1AxB0=";
|
||||
};
|
||||
propagatedBuildInputs = [
|
||||
(pkgs.python313.pkgs.buildPythonPackage {
|
||||
pname = "zwift-client";
|
||||
version = "0.2.0";
|
||||
pyproject = true;
|
||||
src = pkgs.fetchFromGitHub {
|
||||
owner = "nickolaj-jepsen";
|
||||
repo = "zwift-client";
|
||||
rev = "882fb881f1271dc104fd0250cab4ceb6e3710a59";
|
||||
hash = "sha256-4gOlWG+QVwODlIhiNH7rhiD0rzNv2WxY2ty9o/51eHU=";
|
||||
};
|
||||
doCheck = false;
|
||||
propagatedBuildInputs = with pkgs.python313.pkgs; [
|
||||
hatchling
|
||||
requests
|
||||
protobuf
|
||||
];
|
||||
})
|
||||
];
|
||||
})
|
||||
];
|
||||
extraComponents = [
|
||||
"default_config"
|
||||
"met"
|
||||
"mqtt"
|
||||
"esphome"
|
||||
"google"
|
||||
"spotify"
|
||||
"unifi"
|
||||
"upnp"
|
||||
"homeassistant_hardware"
|
||||
];
|
||||
config = {
|
||||
homeassistant = {
|
||||
name = "Home";
|
||||
latitude = "!secret latitude";
|
||||
longitude = "!secret longitude";
|
||||
elevation = "!secret elevation";
|
||||
unit_system = "metric";
|
||||
time_zone = "Europe/Copenhagen";
|
||||
};
|
||||
frontend = {
|
||||
themes = "!include_dir_merge_named themes";
|
||||
};
|
||||
http = {
|
||||
server_port = homeAssistantPort;
|
||||
use_x_forwarded_for = true;
|
||||
trusted_proxies = [
|
||||
"127.0.0.1"
|
||||
"::1"
|
||||
];
|
||||
};
|
||||
sensor = [
|
||||
{
|
||||
platform = "zwift";
|
||||
username = "!secret zwift_username";
|
||||
password = "!secret zwift_password";
|
||||
}
|
||||
];
|
||||
|
||||
automation = "!include automations.yaml";
|
||||
script = "!include scripts.yaml";
|
||||
scene = "!include scenes.yaml";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
104
modules/homelab/home-assistant/mqtt.nix
Normal file
104
modules/homelab/home-assistant/mqtt.nix
Normal file
|
|
@ -0,0 +1,104 @@
|
|||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
mosquittoPort = 1883;
|
||||
zigbee2mqttPort = 8180;
|
||||
in {
|
||||
config = lib.mkIf config.fireproof.homelab.enable {
|
||||
age.secrets = {
|
||||
"zigbee2mqtt-secret.yaml" = {
|
||||
rekeyFile = ../../../secrets/hosts/homelab/zigbee2mqtt-secret.yaml.age;
|
||||
owner = "zigbee2mqtt";
|
||||
group = "zigbee2mqtt";
|
||||
};
|
||||
mosquitto-zigbee2mqtt.rekeyFile = ../../../secrets/hosts/homelab/mosquitto-zigbee2mqtt.age;
|
||||
mosquitto-sas.rekeyFile = ../../../secrets/hosts/homelab/mosquitto-sas.age;
|
||||
mosquitto-ha.rekeyFile = ../../../secrets/hosts/homelab/mosquitto-ha.age;
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [mosquittoPort];
|
||||
|
||||
services.restic.backups.homelab = {
|
||||
paths = [config.services.zigbee2mqtt.dataDir];
|
||||
exclude = ["/var/lib/zigbee2mqtt/log/"];
|
||||
};
|
||||
|
||||
services.oauth2-proxy.nginx.virtualHosts."zigbee.nickolaj.com".allowed_groups = ["iot-admin"];
|
||||
services.nginx.virtualHosts."zigbee.nickolaj.com" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."/" = {
|
||||
proxyPass = "http://localhost:${toString zigbee2mqttPort}";
|
||||
proxyWebsockets = true;
|
||||
};
|
||||
};
|
||||
|
||||
services.mosquitto = {
|
||||
enable = true;
|
||||
listeners = [
|
||||
{
|
||||
port = mosquittoPort;
|
||||
users."zigbee2mqtt" = {
|
||||
acl = ["readwrite #"];
|
||||
passwordFile = "${config.age.secrets.mosquitto-zigbee2mqtt.path}";
|
||||
};
|
||||
users."homeassistant" = {
|
||||
acl = ["readwrite #"];
|
||||
passwordFile = "${config.age.secrets.mosquitto-ha.path}";
|
||||
};
|
||||
users."sleep_as_android" = {
|
||||
acl = ["readwrite SleepAsAndroid"];
|
||||
passwordFile = "${config.age.secrets.mosquitto-sas.path}";
|
||||
};
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
services.zigbee2mqtt = {
|
||||
enable = true;
|
||||
settings = {
|
||||
homeassistant = {
|
||||
enabled = true;
|
||||
};
|
||||
mqtt = {
|
||||
base_topic = "zigbee2mqtt";
|
||||
server = "mqtt://localhost:${toString mosquittoPort}";
|
||||
user = "zigbee2mqtt";
|
||||
password = "!${config.age.secrets."zigbee2mqtt-secret.yaml".path} password";
|
||||
};
|
||||
frontend = {
|
||||
enabled = true;
|
||||
port = zigbee2mqttPort;
|
||||
};
|
||||
serial = {
|
||||
port = "/dev/serial/by-id/usb-Silicon_Labs_Sonoff_Zigbee_3.0_USB_Dongle_Plus_0001-if00-port0";
|
||||
adapter = "zstack";
|
||||
};
|
||||
advanced = {
|
||||
network_key = [
|
||||
233
|
||||
138
|
||||
136
|
||||
76
|
||||
51
|
||||
117
|
||||
128
|
||||
127
|
||||
74
|
||||
84
|
||||
33
|
||||
179
|
||||
116
|
||||
61
|
||||
79
|
||||
101
|
||||
];
|
||||
channel = 25;
|
||||
log_level = "debug";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,116 +0,0 @@
|
|||
{
|
||||
config,
|
||||
pkgsUnstable,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
lib.mkIf config.fireproof.homelab.enable (let
|
||||
port = 9190;
|
||||
rootDomain = "nickolaj.com";
|
||||
zitadelDomain = "sso.${rootDomain}";
|
||||
oathproxyDomain = "oauth2-proxy.${rootDomain}";
|
||||
in {
|
||||
age.secrets.zitadel-master = {
|
||||
rekeyFile = ../../secrets/hosts/homelab/zitadel-master.age;
|
||||
owner = config.services.zitadel.user;
|
||||
};
|
||||
age.secrets.oauth2-proxy = {
|
||||
rekeyFile = ../../secrets/hosts/homelab/oauth2-proxy-keyfile.age;
|
||||
owner = "oauth2-proxy";
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts."${zitadelDomain}" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."/" = {
|
||||
proxyPass = "http://127.0.0.1:${toString port}";
|
||||
extraConfig = ''
|
||||
grpc_pass grpc://127.0.0.1:${toString port};
|
||||
grpc_set_header Host $host:$server_port;
|
||||
'';
|
||||
};
|
||||
};
|
||||
services.nginx.virtualHosts."${oathproxyDomain}" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."/" = {
|
||||
proxyWebsockets = true;
|
||||
proxyPass = "http://127.0.0.1:4180";
|
||||
};
|
||||
};
|
||||
|
||||
services.postgresql = {
|
||||
ensureDatabases = ["zitadel"];
|
||||
ensureUsers = [
|
||||
{
|
||||
name = "zitadel";
|
||||
ensureDBOwnership = true;
|
||||
ensureClauses.login = true;
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
services.zitadel = {
|
||||
enable = true;
|
||||
package = pkgsUnstable.zitadel;
|
||||
masterKeyFile = config.age.secrets.zitadel-master.path;
|
||||
settings = {
|
||||
Port = port;
|
||||
Database.postgres = {
|
||||
Host = "/var/run/postgresql/";
|
||||
Port = 5432;
|
||||
Database = "zitadel";
|
||||
User = {
|
||||
Username = "zitadel";
|
||||
SSL.Mode = "disable";
|
||||
};
|
||||
Admin = {
|
||||
Username = "zitadel";
|
||||
SSL.Mode = "disable";
|
||||
ExistingDatabase = "zitadel";
|
||||
};
|
||||
};
|
||||
ExternalDomain = zitadelDomain;
|
||||
ExternalPort = 443;
|
||||
ExternalSecure = true;
|
||||
};
|
||||
steps.FirstInstance = {
|
||||
InstanceName = "Fireproof Auth";
|
||||
Org = {
|
||||
Name = "Fireproof Auth";
|
||||
Human = {
|
||||
UserName = "nickolaj1177@gmail.com";
|
||||
FirstName = "Nickolaj";
|
||||
LastName = "Jepsen";
|
||||
Email.Verified = true;
|
||||
Password = "Password1!";
|
||||
PasswordChangeRequired = true;
|
||||
};
|
||||
};
|
||||
LoginPolicy.AllowRegister = false;
|
||||
};
|
||||
};
|
||||
|
||||
services.oauth2-proxy = {
|
||||
enable = true;
|
||||
provider = "oidc";
|
||||
reverseProxy = true;
|
||||
redirectURL = "https://${oathproxyDomain}/oauth2/callback";
|
||||
validateURL = "https://${zitadelDomain}/oauth2/";
|
||||
oidcIssuerUrl = "https://${zitadelDomain}:443";
|
||||
keyFile = config.age.secrets.oauth2-proxy.path;
|
||||
passBasicAuth = true;
|
||||
setXauthrequest = true;
|
||||
nginx.domain = oathproxyDomain;
|
||||
email.domains = ["*"];
|
||||
extraConfig = {
|
||||
whitelist-domain = ".${rootDomain}";
|
||||
cookie-domain = ".${rootDomain}";
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.oauth2-proxy.serviceConfig = {
|
||||
Restart = "always";
|
||||
RestartSec = "5s";
|
||||
};
|
||||
})
|
||||
6
modules/homelab/sso/default.nix
Normal file
6
modules/homelab/sso/default.nix
Normal file
|
|
@ -0,0 +1,6 @@
|
|||
{...}: {
|
||||
imports = [
|
||||
./zitadel.nix
|
||||
./proxy.nix
|
||||
];
|
||||
}
|
||||
48
modules/homelab/sso/proxy.nix
Normal file
48
modules/homelab/sso/proxy.nix
Normal file
|
|
@ -0,0 +1,48 @@
|
|||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
rootDomain = "nickolaj.com";
|
||||
zitadelDomain = "sso.${rootDomain}";
|
||||
oathproxyDomain = "oauth2-proxy.${rootDomain}";
|
||||
in {
|
||||
config = lib.mkIf config.fireproof.homelab.enable {
|
||||
age.secrets.oauth2-proxy = {
|
||||
rekeyFile = ../../../secrets/hosts/homelab/oauth2-proxy-keyfile.age;
|
||||
owner = "oauth2-proxy";
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts."${oathproxyDomain}" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."/" = {
|
||||
proxyWebsockets = true;
|
||||
proxyPass = "http://127.0.0.1:4180";
|
||||
};
|
||||
};
|
||||
|
||||
services.oauth2-proxy = {
|
||||
enable = true;
|
||||
provider = "oidc";
|
||||
reverseProxy = true;
|
||||
redirectURL = "https://${oathproxyDomain}/oauth2/callback";
|
||||
validateURL = "https://${zitadelDomain}/oauth2/";
|
||||
oidcIssuerUrl = "https://${zitadelDomain}:443";
|
||||
keyFile = config.age.secrets.oauth2-proxy.path;
|
||||
passBasicAuth = true;
|
||||
setXauthrequest = true;
|
||||
nginx.domain = oathproxyDomain;
|
||||
email.domains = ["*"];
|
||||
extraConfig = {
|
||||
whitelist-domain = ".${rootDomain}";
|
||||
cookie-domain = ".${rootDomain}";
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.oauth2-proxy.serviceConfig = {
|
||||
Restart = "always";
|
||||
RestartSec = "5s";
|
||||
};
|
||||
};
|
||||
}
|
||||
80
modules/homelab/sso/zitadel.nix
Normal file
80
modules/homelab/sso/zitadel.nix
Normal file
|
|
@ -0,0 +1,80 @@
|
|||
{
|
||||
config,
|
||||
pkgsUnstable,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
port = 9190;
|
||||
zitadelDomain = "sso.nickolaj.com";
|
||||
in {
|
||||
config = lib.mkIf config.fireproof.homelab.enable {
|
||||
age.secrets.zitadel-master = {
|
||||
rekeyFile = ../../../secrets/hosts/homelab/zitadel-master.age;
|
||||
owner = config.services.zitadel.user;
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts."${zitadelDomain}" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."/" = {
|
||||
proxyPass = "http://127.0.0.1:${toString port}";
|
||||
extraConfig = ''
|
||||
grpc_pass grpc://127.0.0.1:${toString port};
|
||||
grpc_set_header Host $host:$server_port;
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
services.postgresql = {
|
||||
ensureDatabases = ["zitadel"];
|
||||
ensureUsers = [
|
||||
{
|
||||
name = "zitadel";
|
||||
ensureDBOwnership = true;
|
||||
ensureClauses.login = true;
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
services.zitadel = {
|
||||
enable = true;
|
||||
package = pkgsUnstable.zitadel;
|
||||
masterKeyFile = config.age.secrets.zitadel-master.path;
|
||||
settings = {
|
||||
Port = port;
|
||||
Database.postgres = {
|
||||
Host = "/var/run/postgresql/";
|
||||
Port = 5432;
|
||||
Database = "zitadel";
|
||||
User = {
|
||||
Username = "zitadel";
|
||||
SSL.Mode = "disable";
|
||||
};
|
||||
Admin = {
|
||||
Username = "zitadel";
|
||||
SSL.Mode = "disable";
|
||||
ExistingDatabase = "zitadel";
|
||||
};
|
||||
};
|
||||
ExternalDomain = zitadelDomain;
|
||||
ExternalPort = 443;
|
||||
ExternalSecure = true;
|
||||
};
|
||||
steps.FirstInstance = {
|
||||
InstanceName = "Fireproof Auth";
|
||||
Org = {
|
||||
Name = "Fireproof Auth";
|
||||
Human = {
|
||||
UserName = "nickolaj1177@gmail.com";
|
||||
FirstName = "Nickolaj";
|
||||
LastName = "Jepsen";
|
||||
Email.Verified = true;
|
||||
Password = "Password1!";
|
||||
PasswordChangeRequired = true;
|
||||
};
|
||||
};
|
||||
LoginPolicy.AllowRegister = false;
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue