navidrome
This commit is contained in:
parent
1408470a53
commit
28dc0896b9
16 changed files with 969 additions and 171 deletions
|
|
@ -5,13 +5,59 @@
|
|||
...
|
||||
}:
|
||||
let
|
||||
inherit (lib) mkEnableOption mkIf mkOption;
|
||||
inherit (lib.types) str nullOr pathWith;
|
||||
inherit (lib)
|
||||
mkEnableOption
|
||||
mkIf
|
||||
mkOption
|
||||
converge
|
||||
mkMerge
|
||||
filterAttrsRecursive
|
||||
literalExpression
|
||||
mapAttrsToList
|
||||
concatStringsSep
|
||||
attrNames
|
||||
;
|
||||
inherit (lib.types)
|
||||
str
|
||||
nullOr
|
||||
pathWith
|
||||
submodule
|
||||
listOf
|
||||
functionTo
|
||||
attrsOf
|
||||
lines
|
||||
;
|
||||
absPath = pathWith {
|
||||
inStore = false;
|
||||
absolute = true;
|
||||
};
|
||||
cfg = config.xyno.services.kanidm;
|
||||
tlsDir = "/run/generated/kanidm-tls";
|
||||
package = pkgs.kanidmWithSecretProvisioning_1_8.overrideAttrs (old: {
|
||||
doCheck = false;
|
||||
patches = old.patches ++ [
|
||||
(pkgs.writeText "patch-kanidm-name" ''
|
||||
diff --git a/server/lib/src/value.rs b/server/lib/src/value.rs
|
||||
index 86b5a74c1..c83b2f93d 100644
|
||||
--- a/server/lib/src/value.rs
|
||||
+++ b/server/lib/src/value.rs
|
||||
@@ -64,7 +64,7 @@ lazy_static! {
|
||||
/// Only lowercase+numbers, with limited chars.
|
||||
pub static ref INAME_RE: Regex = {
|
||||
#[allow(clippy::expect_used)]
|
||||
- Regex::new("^[a-z][a-z0-9-_\\.]{0,63}$").expect("Invalid Iname regex found")
|
||||
+ Regex::new("^[a-z0-9-_\\.]{0,64}$").expect("Invalid Iname regex found")
|
||||
};
|
||||
|
||||
/// Only alpha-numeric with limited special chars and space
|
||||
'')
|
||||
];
|
||||
});
|
||||
templatePlaceholders = {
|
||||
clientId = ''\($get.attrs.name[0])'';
|
||||
basicSecret = ''\($secret.secret)'';
|
||||
env = v: ''\(env.${v})'';
|
||||
};
|
||||
in
|
||||
{
|
||||
options.xyno.services.kanidm.enable = mkEnableOption "enables kanidm";
|
||||
|
|
@ -19,8 +65,75 @@ in
|
|||
default = "idm.xyno.systems";
|
||||
type = str;
|
||||
};
|
||||
options.xyno.services.kanidm.isReplica = mkEnableOption "replica";
|
||||
options.xyno.services.kanidm.isReplica = mkEnableOption "replica"; # TODO
|
||||
options.xyno.services.kanidm.setupTraefik = mkEnableOption "traefik";
|
||||
options.xyno.services.kanidm.templates = mkOption {
|
||||
type = attrsOf (
|
||||
submodule (
|
||||
{ name, ... }:
|
||||
{
|
||||
options = {
|
||||
path = mkOption {
|
||||
type = absPath;
|
||||
default = "/run/generated/kanidmTemplates/${name}";
|
||||
};
|
||||
user = mkOption {
|
||||
type = str;
|
||||
default = "root";
|
||||
};
|
||||
group = mkOption {
|
||||
type = str;
|
||||
default = "kanidm";
|
||||
};
|
||||
chmod = mkOption {
|
||||
type = str;
|
||||
default = "440";
|
||||
};
|
||||
wantedBy = mkOption {
|
||||
type = listOf str;
|
||||
default = [ ];
|
||||
example = [ "traccar.service" ];
|
||||
};
|
||||
text = mkOption {
|
||||
type = functionTo lines;
|
||||
description = ''
|
||||
jq templated string
|
||||
|
||||
current placeholders: ${concatStringsSep ", " (attrNames templatePlaceholders)}
|
||||
'';
|
||||
example = literalExpression ''
|
||||
p: ${"''"}
|
||||
OAUTH2_PROXY_CLIENT_ID=''${p.clientId}
|
||||
OAUTH2_PROXY_CLIENT_SECRET=''${p.clientSecret}
|
||||
${"''"}
|
||||
'';
|
||||
};
|
||||
environmentFiles = mkOption {
|
||||
type = listOf absPath;
|
||||
default = [ ];
|
||||
description = ''
|
||||
add environment variables to the template file.
|
||||
the environment variable BANANA would be accessible as
|
||||
```
|
||||
COOKIE_SECRET=''${p.env "BANANA"}
|
||||
```
|
||||
in the template
|
||||
'';
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
}
|
||||
)
|
||||
);
|
||||
|
||||
example = {
|
||||
traccar.text = p: ''
|
||||
OPENID_CLIENTID=${p.clientId}
|
||||
OPENID_SECRET=${p.basicSecret}
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
options.xyno.services.kanidm.tls = {
|
||||
keyPem = mkOption {
|
||||
|
|
@ -29,60 +142,144 @@ in
|
|||
description = "autogenerated if unset";
|
||||
};
|
||||
certPem = mkOption {
|
||||
default = "/run/generated/kanidm-tls/cert.pem";
|
||||
default = "${tlsDir}/cert.pem";
|
||||
type = absPath;
|
||||
};
|
||||
};
|
||||
config = mkIf cfg.enable {
|
||||
services.kanidm = {
|
||||
enableServer = true;
|
||||
enableClient = true;
|
||||
adminPasswordFile = config.sops.secrets."kanidm.password".path;
|
||||
provision = {
|
||||
adminPasswordFile = config.sops.secrets."kanidm.password".path;
|
||||
};
|
||||
serverSettings = {
|
||||
tls_key = if cfg.tls.keyPem != null then cfg.tls.keyPem else "/run/generated/key.pem";
|
||||
tls_chain = cfg.tls.certPem;
|
||||
bindaddress = "127.0.0.3:8443";
|
||||
};
|
||||
};
|
||||
xyno.services.traefik.simpleProxy = mkIf cfg.setupTraefik {
|
||||
host = cfg.domain;
|
||||
internal = "https://127.0.0.3:8443";
|
||||
transport = "kanidm-https";
|
||||
};
|
||||
services.traefik.dynamicConfigOptions.http = mkIf cfg.setupTraefik {
|
||||
serversTransports."kanidm-https" = {
|
||||
serverName = cfg.domain;
|
||||
certificates = [
|
||||
cfg.certPem
|
||||
];
|
||||
};
|
||||
};
|
||||
config = mkMerge [
|
||||
(mkIf cfg.enable {
|
||||
services.kanidm = {
|
||||
enableServer = true;
|
||||
enableClient = true;
|
||||
inherit package;
|
||||
clientSettings.uri = "https://${cfg.domain}";
|
||||
|
||||
systemd.services.generate-kanidm-tls = mkIf (cfg.tls.keyPem == null) {
|
||||
serviceConfig = {
|
||||
User = "root";
|
||||
Group = "kanidm";
|
||||
provision = {
|
||||
enable = true;
|
||||
adminPasswordFile = config.sops.secrets."kanidm/adminPassword".path;
|
||||
idmAdminPasswordFile = config.sops.secrets."kanidm/idmAdminPassword".path;
|
||||
instanceUrl = "https://127.0.0.3:8443";
|
||||
acceptInvalidCerts = true;
|
||||
autoRemove = true;
|
||||
groups.application_admins = {};
|
||||
};
|
||||
serverSettings = {
|
||||
trust_x_forward_for = true;
|
||||
tls_key = if cfg.tls.keyPem != null then cfg.tls.keyPem else "${tlsDir}/key.pem";
|
||||
tls_chain = cfg.tls.certPem;
|
||||
bindaddress = "127.0.0.3:8443";
|
||||
origin = "https://${cfg.domain}";
|
||||
domain = cfg.domain;
|
||||
};
|
||||
};
|
||||
wantedBy = [
|
||||
"kanidm.service"
|
||||
"traefik.service"
|
||||
];
|
||||
script = ''
|
||||
mkdir -p /run/generated/kanidm-tls
|
||||
${pkgs.openssl}/bin/openssl req -x509 -newkey ed25519 -noenc -subj "/CN=generated.${cfg.domain}" -addext "subjectAltName=DNS:${cfg.domain}" -keyout /run/generated/key.pem -out /run/generated/cert.pem
|
||||
'';
|
||||
};
|
||||
sops.secrets."kanidm.password" = {
|
||||
sopsFile = ../../instances/${config.networking.hostName}/secrets/kanidm.yaml;
|
||||
};
|
||||
# sops.templates."kanidm.env".content = ''
|
||||
# DESEC_TOKEN=${config.sops.placeholder.desec_token}
|
||||
# DESEC_PROPAGATION_TIMEOUT=1200
|
||||
# '';
|
||||
# sops.templates."kanidm.env".reloadUnits = [ "kanidm.service" ];
|
||||
systemd.tmpfiles.rules = [ "d /run/generated/kanidmTemplates 1755 root kanidm -" ];
|
||||
systemd.services = mkMerge (
|
||||
(mapAttrsToList (n: v: {
|
||||
"generate-kanidm-template-${n}" = {
|
||||
serviceConfig = {
|
||||
User = "root";
|
||||
Group = "kanidm";
|
||||
Type = "oneshot";
|
||||
PrivateTmp = true;
|
||||
EnvironmentFile = v.environmentFiles;
|
||||
};
|
||||
requires = [ "kanidm.service" ] ++ (lib.optional cfg.setupTraefik "traefik.service");
|
||||
after = [
|
||||
"kanidm.service"
|
||||
"systemd-tmpfiles-setup.service"
|
||||
]
|
||||
++ (lib.optional cfg.setupTraefik "traefik.service");
|
||||
before = v.wantedBy;
|
||||
partOf = v.wantedBy;
|
||||
wantedBy = if (builtins.length v.wantedBy) == 0 then [ "multi-user.target" ] else v.wantedBy;
|
||||
enableStrictShellChecks = true;
|
||||
path = [
|
||||
package
|
||||
pkgs.jq
|
||||
];
|
||||
environment.KANIDM_TOKEN_CACHE_PATH = "/tmp/kanidm-token-cache";
|
||||
script =
|
||||
let
|
||||
templateText = v.text templatePlaceholders;
|
||||
in
|
||||
''
|
||||
KANIDM_PASSWORD=$(cat "${
|
||||
config.sops.secrets."kanidm/idmAdminPassword".path
|
||||
}") kanidm login -D idm_admin
|
||||
jq -r -s \
|
||||
-f "${pkgs.writeText "kanidm-template-${n}" ''"${templateText}"''}" \
|
||||
--argjson get "$(kanidm system oauth2 get --output json "${n}")" \
|
||||
--argjson secret "$(kanidm system oauth2 show-basic-secret --output json "${n}")" \
|
||||
> "${v.path}"
|
||||
chown "${v.user}:${v.group}" "${v.path}"
|
||||
chmod "${v.chmod}" "${v.path}"
|
||||
'';
|
||||
};
|
||||
}) cfg.templates)
|
||||
++ [
|
||||
(mkIf (cfg.tls.keyPem == null) {
|
||||
|
||||
generate-kanidm-tls =
|
||||
let
|
||||
units = [
|
||||
"kanidm.service"
|
||||
]
|
||||
++ (lib.optional cfg.setupTraefik "traefik.service");
|
||||
in
|
||||
{
|
||||
serviceConfig = {
|
||||
User = "root";
|
||||
Group = "kanidm";
|
||||
Type = "oneshot";
|
||||
};
|
||||
wantedBy = units;
|
||||
before = units;
|
||||
script = ''
|
||||
mkdir -p ${tlsDir}
|
||||
cd ${tlsDir}
|
||||
${config.services.kanidm.package}/bin/kanidmd cert-generate -c ${
|
||||
let
|
||||
toml = pkgs.formats.toml { };
|
||||
filterConfig = converge (filterAttrsRecursive (_: v: v != null));
|
||||
in
|
||||
toml.generate "kanidm-tls.conf" (filterConfig (config.services.kanidm.serverSettings))
|
||||
}
|
||||
chmod +g ${tlsDir}/*
|
||||
'';
|
||||
};
|
||||
})
|
||||
]
|
||||
);
|
||||
sops.secrets."kanidm/adminPassword" = {
|
||||
sopsFile = ../../instances/${config.networking.hostName}/secrets/kanidm.yaml;
|
||||
reloadUnits = [ "kanidm.service" ];
|
||||
owner = "kanidm";
|
||||
};
|
||||
sops.secrets."kanidm/idmAdminPassword" = {
|
||||
sopsFile = ../../instances/${config.networking.hostName}/secrets/kanidm.yaml;
|
||||
reloadUnits = [ "kanidm.service" ];
|
||||
owner = "kanidm";
|
||||
};
|
||||
|
||||
xyno.impermanence.directories = [ "/var/lib/kanidm" ];
|
||||
})
|
||||
(mkIf (cfg.enable && cfg.setupTraefik) {
|
||||
|
||||
xyno.services.traefik.simpleProxy.kanidm = {
|
||||
host = cfg.domain;
|
||||
internal = "https://127.0.0.3:8443";
|
||||
transport = "kanidm-https";
|
||||
};
|
||||
services.traefik.dynamicConfigOptions.http = mkIf (cfg.tls.keyPem == null) {
|
||||
serversTransports."kanidm-https" = {
|
||||
serverName = cfg.domain;
|
||||
rootcas = [
|
||||
"${tlsDir}/ca.pem"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
})
|
||||
];
|
||||
|
||||
};
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue