xyno/nix-configs
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

desec

Browse source
This commit is contained in:
xyno (Philipp Hochkamp) 2023-09-14 15:50:04 +02:00
parent 0342390b6f
commit 91259d02e7
11 changed files with 154 additions and 99 deletions
Download patch file Download diff file Expand all files Collapse all files

19
nixos-modules/services/hedgedoc.nix
View file

@ -1,7 +1,6 @@
{ config, lib, pkgs, ... }:
let
cfg = config.ragon.services.hedgedoc;
domain = config.ragon.services.nginx.domain;
in
{
options.ragon.services.hedgedoc.enable = lib.mkEnableOption "Enables the hedgedoc BitWarden Server";
@ -11,14 +10,14 @@ in
default = "md.xyno.systems";
};
config = lib.mkIf cfg.enable {
ragon.agenix.secrets.autheliaHedgedoc = { user = "authelia"; };
ragon.agenix.secrets.autheliaHedgedoc = { owner = "authelia-main"; };
services.authelia.instances.main.settingsFiles = [
config.age.secrets.autheliaHedgedoc.path
];
services.hedgedoc = {
enable = true;
environmentFile = "${config.age.secrets.hedgedocSecret.path}";
configuration = {
settings = {
protocolUseSSL = true;
sessionSecret = "$SESSION_SECRET";
allowAnonymous = false;
@ -26,12 +25,12 @@ in
allowFreeURL = true;
email = false;
oauth2 = {
clientID = "$OAUTH2_CLIENT_ID";
clientSecret = "$OAUTH2_CLIENT_SECRET";
clientID = "$CLIENT_ID";
clientSecret = "$CLIENT_SECRET";
providerName = "xyno.systems SSO";
authorizationURL = "https://sso.xyno.systems/oauth2/authorize";
tokenURL = "https://sso.xyno.systems/oauth2/token";
userProfileURL = "https://sso.xyno.systems/oauth2/userinfo";
authorizationURL = "https://sso.xyno.systems/api/oidc/authorize";
tokenURL = "https://sso.xyno.systems/api/oidc/token";
userProfileURL = "https://sso.xyno.systems/api/oidc/userinfo";
scope = "openid profile email";
userProfileUsernameAttr = "sub";
userProfileEmailAttr = "email";
@ -47,9 +46,9 @@ in
};
ragon.agenix.secrets.hedgedocSecret.owner = "hedgedoc";
services.nginx.virtualHosts."${cfg.domainPrefix}.${domain}" = {
services.nginx.virtualHosts."${cfg.domain}" = {
locations."/".proxyWebsockets = true;
locations."/".proxyPass = "http://127.0.0.1:${toString config.services.hedgedoc.configuration.port}";
locations."/".proxyPass = "http://[::1]:${toString config.services.hedgedoc.settings.port}";
} // (lib.my.findOutTlsConfig cfg.domain config);
services.postgresql = {