nix/nixos-config
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Big commit

Browse Source
This commit is contained in:
niten
2023-12-04 17:10:57 -08:00
parent 44589ddc77
commit 0027566304
29 changed files with 1582 additions and 521 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config/host-config/limina.nix
+126 -1
View File
@@ -10,6 +10,13 @@ let
domain-name = host-config.domain;
domain = config.fudo.domains.${domain-name};
hostname = config.instance.hostname;
domSecrets =
config.fudo.secrets.files.domain-secrets."${config.instance.local-domain}";
hostSecrets = config.fudo.secrets.host-secrets."${hostname}";
authentikHost = "authentik.fudo.org";
# dns-proxy-port = 5335;
in {
@@ -84,6 +91,31 @@ in {
};
fudo = {
secrets.host-secrets."${hostname}" = {
sea-cam-auth-proxy-env = {
source-file = let
token = removeSuffix "\n"
(readFile domSecrets."seattle-camera-auth-proxy.token");
in pkgs.writeText "sea-cam-auth-proxy.env" ''
AUTHENTIK_HOST=https://${authentikHost}/;
AUTHENTIK_TOKEN=${token}
AUTHENTIK_INSECURE=0
'';
target-file = "/run/sea-cam-auth-proxy/env";
};
sea-red-auth-proxy-env = {
source-file = let
token = removeSuffix "\n"
(readFile domSecrets."seattle-red-auth-proxy.token");
in pkgs.writeText "sea-red-auth-proxy.env" ''
AUTHENTIK_HOST=https://${authentikHost}/;
AUTHENTIK_TOKEN=${token}
AUTHENTIK_INSECURE=0
'';
target-file = "/run/sea-red-auth-proxy/env";
};
};
hosts.limina.external-interfaces = [ "enp1s0" ];
client.dns.external-interface = "enp1s0";
@@ -139,6 +171,34 @@ in {
systemd.services.nginx.requires = [ "bind.service" ];
virtualisation = {
podman = {
enable = true;
dockerSocket.enable = true;
autoPrune.enable = true;
};
docker.enable = false;
oci-containers = {
backend = "podman";
containers = {
"sea-cam-auth-proxy" = {
image = "ghcr.io/goauthentik/proxy";
autoStart = true;
environmentFiles =
[ hostSecrets.sea-cam-auth-proxy-env.target-file ];
ports = [ "9000:9000" ];
};
"sea-red-auth-proxy" = {
image = "ghcr.io/goauthentik/proxy";
autoStart = true;
environmentFiles =
[ hostSecrets.sea-red-auth-proxy-env.target-file ];
ports = [ "9001:9000" ];
};
};
};
};
services = {
nginx = {
enable = true;
@@ -146,7 +206,62 @@ in {
recommendedOptimisation = true;
recommendedProxySettings = true;
virtualHosts = {
virtualHosts = let
authenticatedPassthrough = { target, authPort }: {
enableACME = true;
forceSSL = true;
locations = {
"/" = {
proxyPass = target;
proxyWebsockets = true;
extraConfig = ''
##############################
# authentik-specific config
##############################
auth_request /outpost.goauthentik.io/auth/nginx;
error_page 401 = @goauthentik_proxy_signin;
auth_request_set $auth_cookie $upstream_http_set_cookie;
add_header Set-Cookie $auth_cookie;
# translate headers from the outposts back to the actual upstream
auth_request_set $authentik_username $upstream_http_x_authentik_username;
auth_request_set $authentik_groups $upstream_http_x_authentik_groups;
auth_request_set $authentik_email $upstream_http_x_authentik_email;
auth_request_set $authentik_name $upstream_http_x_authentik_name;
auth_request_set $authentik_uid $upstream_http_x_authentik_uid;
proxy_set_header X-authentik-username $authentik_username;
proxy_set_header X-authentik-groups $authentik_groups;
proxy_set_header X-authentik-email $authentik_email;
proxy_set_header X-authentik-name $authentik_name;
proxy_set_header X-authentik-uid $authentik_uid;
'';
};
"/outpost.goauthentik.io" = {
proxyPass = "http://127.0.0.1:${
toString authPort
}/outpost.goauthentik.io";
extraConfig = ''
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
add_header Set-Cookie $auth_cookie;
auth_request_set $auth_cookie $upstream_http_set_cookie;
proxy_pass_request_body off;
proxy_set_header Content-Length "";
'';
};
"@goauthentik_proxy_signin" = {
return = "302 /outpost.goauthentik.io/start?rd=$request_uri";
extraConfig = ''
add_header Set-Cookie $auth_cookie;
internal;
'';
};
};
};
in {
"sea-home.fudo.link" = {
enableACME = true;
forceSSL = true;
@@ -159,6 +274,16 @@ in {
'';
};
};
"sea-cam.fudo.link" = authenticatedPassthrough {
target = "http://frigate.sea.fudo.org/";
authPort = 9000;
};
"sea-red.fudo.link" = authenticatedPassthrough {
target = "http://node-red.sea.fudo.org/";
authPort = 9001;
};
};
};