fricloud/server-configs
2
0
Fork 0
Code Issues 4 Pull requests Projects Releases Packages Wiki Activity Actions

gerd.authelia: moved to own directory + added nginx proxy example

Browse source
This commit is contained in:
eyjhb 2024-08-12 14:36:01 +02:00
parent 5d94967c48
commit 9cc18d0ca3
Signed by: eyjhb
GPG key ID: 609F508E3239F920
4 changed files with 95 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

85
machines/gerd/services/authelia/authelia.nix Normal file
View file

@ -0,0 +1,85 @@
{ config, ... }:
let
svc_domain = "auth.${config.mine.settings.domain}";
autheliaStateDir = "/var/lib/authelia-main";
in {
services.authelia.instances.main = {
enable = true;
environmentVariables.AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PASSWORD_FILE = config.age.secrets.lldap-bind-user-pass.path;
secrets = {
jwtSecretFile = config.age.secrets.authelia-jwt.path;
storageEncryptionKeyFile = config.age.secrets.authelia-storage.path;
sessionSecretFile = config.age.secrets.authelia-session.path;
oidcIssuerPrivateKeyFile = config.age.secrets.authelia-oidc-issuer-privatekey-pem.path;
};
settings = {
session.domain = config.mine.settings.domain;
# totp - disable for now, as it requires email server
access_control.default_policy = "one_factor";
# totp.disable = true;
# webauthn.disable = true;
# default_2fa_method = "totp";
# totp.issuer = "auth.fricloud.dk";
storage.local.path = "${autheliaStateDir}/authelia.sqlite3";
notifier.filesystem.filename = "${autheliaStateDir}/authelia_notifier.txt";
authentication_backend = {
password_reset.disable = false;
refresh_interval = "1m";
ldap = {
implementation = "custom";
# address in the future
url = "ldap://localhost:${builtins.toString config.services.lldap.settings.ldap_port}";
timeout = "5s";
start_tls = false;
base_dn = config.mine.settings.ldap.dc;
additional_users_dn = "ou=${config.mine.settings.ldap.ou.users}";
additional_groups_dn = "ou=${config.mine.settings.ldap.ou.groups}";
users_filter = "(&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person))";
groups_filter = "(member={dn})";
display_name_attribute = config.mine.settings.ldap.attr.firstname;
username_attribute = config.mine.settings.ldap.attr.uid;
group_name_attribute = config.mine.settings.ldap.attr.groupname;
mail_attribute = config.mine.settings.ldap.attr.email;
user = config.mine.settings.ldap.bind_dn;
};
};
};
};
services.nginx.virtualHosts."${svc_domain}" = {
forceSSL = true;
enableACME = true;
locations."/".proxyPass = "http://localhost:${builtins.toString config.services.authelia.instances.main.settings.server.port}";
};
# persistent files
environment.persistence.root.directories = [
autheliaStateDir
];
# setup secrets for authelia
age.secrets = {
authelia-jwt.owner = "authelia-main";
authelia-storage.owner = "authelia-main";
authelia-session.owner = "authelia-main";
authelia-oidc-issuer-privatekey-pem.owner = "authelia-main";
};
users.groups."${config.age.secrets.lldap-bind-user-pass.group}".members = [ config.users.users.authelia-main.name ];
# settings
mine.settings.authelia.domain = svc_domain;
}