diff options
| author | Alan Pearce | 2024-05-21 18:39:50 +0200 |
|---|---|---|
| committer | Alan Pearce | 2024-05-21 18:39:50 +0200 |
| commit | cb1f99a3c0a622042604efc3b6ede90fd7df262d (patch) | |
| tree | 18c44bcbcbf59ed104f2bf9646dd767d63c6cf52 | |
| parent | 004e74d94b9b4c8dbc33b98839452014ba0fffe3 (diff) | |
| download | nixfiles-cb1f99a3c0a622042604efc3b6ede90fd7df262d.tar.lz nixfiles-cb1f99a3c0a622042604efc3b6ede90fd7df262d.tar.zst nixfiles-cb1f99a3c0a622042604efc3b6ede90fd7df262d.zip | |
linde: configure dex
| -rw-r--r-- | secrets/dex.age | 7 | ||||
| -rw-r--r-- | secrets/secrets.nix | 1 | ||||
| -rw-r--r-- | system/linde.nix | 49 |
3 files changed, 57 insertions, 0 deletions
diff --git a/secrets/dex.age b/secrets/dex.age new file mode 100644 index 00000000..0a8726cf --- /dev/null +++ b/secrets/dex.age @@ -0,0 +1,7 @@ +age-encryption.org/v1 +-> ssh-ed25519 cvV2sw MzzfQI0psA0T3d9nCSgmJmbiV0rEoZmnaMm8e13/DSU +NtULp9HQgcMY/RadjNb3C4tNh9YWjDwrgkLIKUK+L1M +-> piv-p256 u9NeZg A2WA/ou1zL649+hHXQpeRQv44LfAt3gEIfbUmY7ELEX9 +AWZG99QU5BN11neChVUPI5mNLZLwmYH7j8QYnyh+BH0 +--- GwIdy5S/I/ujJQLtF/xfBqoKPBEaN/9xgf+Mj+jSryE +LX"g/tN|iFTuBO;>ȻApb5£Λ=ݏ$Gru1k PkWbgw@셼O+N8i?o$˺WV(h%nbgZ7I=HؒM@ \ No newline at end of file diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 86d1062c..0a8c4a9d 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -16,6 +16,7 @@ let binarycache = [ linde ]; paperless = [ linde ]; powerdns = [ linde ]; + dex = [ linde ]; dyndns = [ nanopi ]; syncthing = [ nanopi ]; diff --git a/system/linde.nix b/system/linde.nix index cb18217a..75136576 100644 --- a/system/linde.nix +++ b/system/linde.nix @@ -36,6 +36,7 @@ in }; acme.file = ../secrets/acme.age; binarycache.file = ../secrets/binarycache.age; + dex.file = ../secrets/dex.age; powerdns.file = ../secrets/powerdns.age; }; @@ -593,6 +594,13 @@ in reverse_proxy 127.0.0.1:8081 ''; }; + "id.alanpearce.eu" = { + useACMEHost = "alanpearce.eu"; + extraConfig = '' + encode zstd gzip + reverse_proxy http://${config.services.dex.settings.web.http} + ''; + }; "dns.alanpearce.eu" = { useACMEHost = "alanpearce.eu"; extraConfig = '' @@ -827,6 +835,47 @@ in }; }; + services.etcd = { + enable = true; + initialClusterState = "new"; # -> existing + dataDir = "/var/lib/etcd"; # TODO backup + }; + + services.dex = + let + issuer = "https://id.alanpearce.eu/"; + in + { + enable = true; + environmentFile = config.age.secrets.dex.path; + settings = { + inherit issuer; + storage = { + type = "etcd"; + config = { + endpoints = config.services.etcd.listenClientUrls; + namespace = "dex/"; + }; + }; + web.http = "127.0.0.1:5556"; + connectors = [{ + type = "github"; + id = "github"; + name = "GitHub"; + config = { + clientID = "$GITHUB_CLIENT_ID"; + clientSecret = "$GITHUB_CLIENT_SECRET"; + redirectURI = "${issuer}/callback"; + orgs = [{ + name = "alan-pearce"; + }]; + teamNameField = "slug"; + useLoginAsID = true; + }; + }]; + }; + }; + services.syncthing = { enable = true; dataDir = "/srv/syncthing"; |