merge auth SP module into main configuration; add enableSso option
`enableSso` is being added to the following SP modules: * gitea (forgejo) * nextcloud * roundcube * simple-nixos-mailserver
This commit is contained in:
Alexander Tomokhov
@@ -1,9 +0,0 @@
|
||||
[
|
||||
[ "security", "acme", "certs" ],
|
||||
[ "selfprivacy", "domain" ],
|
||||
[ "selfprivacy", "modules", "auth" ],
|
||||
[ "services", "kanidm" ],
|
||||
[ "services", "oauth2-proxy", "enable" ],
|
||||
[ "services", "oauth2-proxy", "nginx" ],
|
||||
[ "systemd", "services", "kanidm" ]
|
||||
]
|
||||
27
sp-modules/auth/flake.lock
generated
27
sp-modules/auth/flake.lock
generated
@@ -1,27 +0,0 @@
|
||||
{
|
||||
"nodes": {
|
||||
"nixpkgs-unstable": {
|
||||
"locked": {
|
||||
"lastModified": 1725194671,
|
||||
"narHash": "sha256-tLGCFEFTB5TaOKkpfw3iYT9dnk4awTP/q4w+ROpMfuw=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "b833ff01a0d694b910daca6e2ff4a3f26dee478c",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "b833ff01a0d694b910daca6e2ff4a3f26dee478c",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"root": {
|
||||
"inputs": {
|
||||
"nixpkgs-unstable": "nixpkgs-unstable"
|
||||
}
|
||||
}
|
||||
},
|
||||
"root": "root",
|
||||
"version": 7
|
||||
}
|
||||
@@ -1,62 +0,0 @@
|
||||
{
|
||||
description = "User authentication and authorization module";
|
||||
|
||||
# TODO remove when Kanidm provisioning without groups assertion lands in NixOS
|
||||
# inputs.nixos-unstable.url = github:alexoundos/nixpkgs/679fd3fd318ce2d57d0cabfbd7f4b8857d78ae95;
|
||||
# inputs.nixos-unstable.url = git+file:/data/nixpkgs?ref=kanidm-1.4.0&rev=1bac99358baea6a3268027b4e585c68cd4ef107d;
|
||||
inputs.nixos-unstable.url = github:nixos/nixpkgs/7ffd9ae656aec493492b44d0ddfb28e79a1ea25d;
|
||||
|
||||
outputs = { self, nixos-unstable }: {
|
||||
overlays.default = _final: prev: {
|
||||
inherit (nixos-unstable.legacyPackages.${prev.system})
|
||||
kanidm oauth2-proxy;
|
||||
kanidm-provision =
|
||||
nixos-unstable.legacyPackages.${prev.system}.kanidm-provision.overrideAttrs (_: {
|
||||
version = "git";
|
||||
src = prev.fetchFromGitHub {
|
||||
owner = "oddlama";
|
||||
repo = "kanidm-provision";
|
||||
rev = "d1f55c9247a6b25d30bbe90a74307aaac6306db4";
|
||||
hash = "sha256-cZ3QbowmWX7j1eJRiUP52ao28xZzC96OdZukdWDHfFI=";
|
||||
};
|
||||
});
|
||||
};
|
||||
|
||||
nixosModules.default = { ... }: {
|
||||
disabledModules = [
|
||||
"services/security/kanidm.nix"
|
||||
"services/security/oauth2-proxy.nix"
|
||||
"services/security/oauth2-proxy-nginx.nix"
|
||||
];
|
||||
imports = [
|
||||
./kanidm.nix
|
||||
(nixos-unstable.legacyPackages.x86_64-linux.path
|
||||
+ /nixos/modules/services/security/oauth2-proxy.nix)
|
||||
(nixos-unstable.legacyPackages.x86_64-linux.path
|
||||
+ /nixos/modules/services/security/oauth2-proxy-nginx.nix)
|
||||
./module.nix
|
||||
];
|
||||
nixpkgs.overlays = [ self.overlays.default ];
|
||||
};
|
||||
|
||||
configPathsNeeded =
|
||||
builtins.fromJSON (builtins.readFile ./config-paths-needed.json);
|
||||
|
||||
meta = { lib, ... }: {
|
||||
spModuleSchemaVersion = 1;
|
||||
id = "auth";
|
||||
name = "Auth";
|
||||
description = "Temporary auth module.";
|
||||
svgIcon = builtins.readFile ./icon.svg;
|
||||
isMovable = false;
|
||||
isRequired = false;
|
||||
backupDescription = "Useless service.";
|
||||
systemdServices = [ "kanidm.service" ];
|
||||
folders = [ ];
|
||||
license = [ ];
|
||||
homepage = "https://kanidm.com";
|
||||
sourcePage = "https://github.com/kanidm";
|
||||
supportLevel = "hallucinatory";
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1 +0,0 @@
|
||||
<svg xmlns="http://www.w3.org/2000/svg" width="1" height="1"/>
|
||||
|
Before Width: | Height: | Size: 63 B |
File diff suppressed because it is too large
Load Diff
@@ -1,222 +0,0 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
let
|
||||
cfg = config.selfprivacy.modules.auth;
|
||||
domain = config.selfprivacy.domain;
|
||||
auth-fqdn = cfg.subdomain + "." + domain;
|
||||
|
||||
# e.g. "dc=mydomain,dc=com"
|
||||
ldap-base-dn =
|
||||
lib.strings.concatMapStringsSep
|
||||
","
|
||||
(x: "dc=" + x)
|
||||
(lib.strings.splitString "." domain);
|
||||
ldap-host = "127.0.0.1";
|
||||
ldap-port = 3636;
|
||||
|
||||
admins-group = "sp.admins";
|
||||
full-users-group = "sp.full_users";
|
||||
|
||||
kanidm-bind-address = "127.0.0.1:3013";
|
||||
|
||||
selfprivacy-service-account-name = "sp.selfprivacy-api.service-account";
|
||||
|
||||
spApiUserExecStartPostScript =
|
||||
pkgs.writeShellScript "spApiUserExecStartPostScript" ''
|
||||
export HOME=$RUNTIME_DIRECTORY/client_home
|
||||
readonly KANIDM="${pkgs.kanidm}/bin/kanidm"
|
||||
|
||||
# get Kanidm service account for SelfPrivacyAPI
|
||||
KANIDM_SERVICE_ACCOUNT="$($KANIDM service-account list --name idm_admin | grep -E "^name: ${selfprivacy-service-account-name}$")"
|
||||
echo KANIDM_SERVICE_ACCOUNT: "$KANIDM_SERVICE_ACCOUNT"
|
||||
if [ -n "$KANIDM_SERVICE_ACCOUNT" ]
|
||||
then
|
||||
echo "kanidm service account \"${selfprivacy-service-account-name}\" is found"
|
||||
else
|
||||
echo "kanidm service account \"${selfprivacy-service-account-name}\" is not found"
|
||||
echo "creating new kanidm service account \"${selfprivacy-service-account-name}\""
|
||||
if $KANIDM service-account create --name idm_admin "${selfprivacy-service-account-name}" "SelfPrivacy API service account" idm_admin
|
||||
then
|
||||
echo "kanidm service account \"${selfprivacy-service-account-name}\" created"
|
||||
else
|
||||
echo "error: cannot create kanidm service account \"${selfprivacy-service-account-name}\""
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
|
||||
$KANIDM group add-members idm_admins "${selfprivacy-service-account-name}"
|
||||
'';
|
||||
|
||||
# lua stuff for debugging only
|
||||
lua_core_path = "${pkgs.luajitPackages.lua-resty-core}/lib/lua/5.1/?.lua";
|
||||
lua_lrucache_path = "${pkgs.luajitPackages.lua-resty-lrucache}/lib/lua/5.1/?.lua";
|
||||
lua_path = "${lua_core_path};${lua_lrucache_path};";
|
||||
in
|
||||
{
|
||||
options.selfprivacy.modules.auth = {
|
||||
enable = (lib.mkOption {
|
||||
default = false;
|
||||
type = lib.types.bool;
|
||||
}) // {
|
||||
meta = {
|
||||
type = "enable";
|
||||
};
|
||||
};
|
||||
subdomain = (lib.mkOption {
|
||||
default = "auth";
|
||||
type = lib.types.strMatching "[A-Za-z0-9][A-Za-z0-9\-]{0,61}[A-Za-z0-9]";
|
||||
}) // {
|
||||
meta = {
|
||||
widget = "subdomain";
|
||||
type = "string";
|
||||
regex = "[A-Za-z0-9][A-Za-z0-9\-]{0,61}[A-Za-z0-9]";
|
||||
weight = 0;
|
||||
};
|
||||
};
|
||||
debug = (lib.mkOption {
|
||||
default = false;
|
||||
type = lib.types.bool;
|
||||
}) // {
|
||||
meta = {
|
||||
type = "enable";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
# kanidm uses TLS in internal connection with nginx too
|
||||
# FIXME revise this: maybe kanidm must not have access to a public TLS
|
||||
users.groups."acmereceivers".members = [ "kanidm" ];
|
||||
|
||||
# for ExecStartPost scripts to have access to /run/keys/*
|
||||
users.groups.keys.members = [ "kanidm" ];
|
||||
|
||||
services.kanidm = {
|
||||
enableServer = true;
|
||||
|
||||
# kanidm with Rust code patches for OAuth and admin passwords provisioning
|
||||
package = pkgs.kanidm.withSecretProvisioning;
|
||||
|
||||
serverSettings = {
|
||||
inherit domain;
|
||||
# The origin for webauthn. This is the url to the server, with the port
|
||||
# included if it is non-standard (any port except 443). This must match or
|
||||
# be a descendent of the domain name you configure above. If these two
|
||||
# items are not consistent, the server WILL refuse to start!
|
||||
origin = "https://" + auth-fqdn;
|
||||
|
||||
# TODO revise this: maybe kanidm must not have access to a public TLS
|
||||
tls_chain =
|
||||
"${config.security.acme.certs.${domain}.directory}/fullchain.pem";
|
||||
tls_key =
|
||||
"${config.security.acme.certs.${domain}.directory}/key.pem";
|
||||
|
||||
# nginx should proxy requests to it
|
||||
bindaddress = kanidm-bind-address;
|
||||
|
||||
ldapbindaddress =
|
||||
"${ldap-host}:${toString ldap-port}";
|
||||
|
||||
# kanidm is behind a proxy
|
||||
trust_x_forward_for = true;
|
||||
|
||||
log_level = if cfg.debug then "trace" else "info";
|
||||
};
|
||||
provision = {
|
||||
enable = true;
|
||||
autoRemove = true; # if false, obsolete oauth2 scopeMaps remain
|
||||
groups.${admins-group}.present = true;
|
||||
groups.${full-users-group}.present = true;
|
||||
};
|
||||
enableClient = true;
|
||||
clientSettings = {
|
||||
uri = "https://" + auth-fqdn;
|
||||
verify_ca = false; # FIXME
|
||||
verify_hostnames = false; # FIXME
|
||||
};
|
||||
};
|
||||
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
additionalModules =
|
||||
lib.mkIf cfg.debug [ pkgs.nginxModules.lua ];
|
||||
commonHttpConfig = lib.mkIf cfg.debug ''
|
||||
log_format kanidm escape=none '$request $status\n'
|
||||
'[Request body]: $request_body\n'
|
||||
'[Header]: $resp_header\n'
|
||||
'[Response Body]: $resp_body\n\n';
|
||||
lua_package_path "${lua_path}";
|
||||
'';
|
||||
virtualHosts.${auth-fqdn} = {
|
||||
useACMEHost = domain;
|
||||
forceSSL = true;
|
||||
locations."/" = {
|
||||
extraConfig = lib.mkIf cfg.debug ''
|
||||
access_log /var/log/nginx/kanidm.log kanidm;
|
||||
|
||||
lua_need_request_body on;
|
||||
|
||||
# log header
|
||||
set $req_header "";
|
||||
set $resp_header "";
|
||||
header_filter_by_lua '
|
||||
local h = ngx.req.get_headers()
|
||||
for k, v in pairs(h) do
|
||||
if type(v) == "table" then
|
||||
ngx.var.req_header = ngx.var.req_header .. k .. "=" .. table.concat(v, ", ") .. " "
|
||||
else
|
||||
ngx.var.req_header = ngx.var.req_header .. k .. "=" .. v .. " "
|
||||
end
|
||||
end
|
||||
local rh = ngx.resp.get_headers()
|
||||
for k, v in pairs(rh) do
|
||||
if type(v) == "table" then
|
||||
ngx.var.resp_header = ngx.var.resp_header .. k .. "=" .. table.concat(v, ", ") .. " "
|
||||
else
|
||||
ngx.var.resp_header = ngx.var.resp_header .. k .. "=" .. v .. " "
|
||||
end
|
||||
end
|
||||
';
|
||||
|
||||
# log body
|
||||
set $resp_body "";
|
||||
body_filter_by_lua '
|
||||
local resp_body = string.sub(ngx.arg[1], 1, 4000)
|
||||
ngx.ctx.buffered = (ngx.ctx.buffered or "") .. resp_body
|
||||
if ngx.arg[2] then
|
||||
ngx.var.resp_body = ngx.ctx.buffered
|
||||
end
|
||||
';
|
||||
'';
|
||||
proxyPass = "https://${kanidm-bind-address}";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.kanidm.serviceConfig.ExecStartPost = lib.mkAfter
|
||||
[ spApiUserExecStartPostScript ];
|
||||
|
||||
passthru.selfprivacy.auth = {
|
||||
inherit
|
||||
admins-group
|
||||
auth-fqdn
|
||||
full-users-group
|
||||
ldap-host
|
||||
ldap-port
|
||||
;
|
||||
oauth2-introspection-url-prefix = client_id: "https://${client_id}:";
|
||||
oauth2-introspection-url-postfix =
|
||||
"@${auth-fqdn}/oauth2/token/introspect";
|
||||
oauth2-discovery-url = client_id:
|
||||
"https://${auth-fqdn}/oauth2/openid/${client_id}/.well-known/openid-configuration";
|
||||
oauth2-provider-name = "Kanidm";
|
||||
oauth2-systemd-service = "kanidm.service";
|
||||
|
||||
# e.g. "dc=mydomain,dc=com"
|
||||
ldap-base-dn =
|
||||
lib.strings.concatMapStringsSep
|
||||
","
|
||||
(x: "dc=" + x)
|
||||
(lib.strings.splitString "." domain);
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -14,7 +14,7 @@ let
|
||||
"gitea-light"
|
||||
"gitea-dark"
|
||||
];
|
||||
is-auth-enabled = sp.modules.auth.enable or false;
|
||||
is-auth-enabled = cfg.enableSso;
|
||||
oauth-client-id = "forgejo";
|
||||
auth-passthru = config.passthru.selfprivacy.auth;
|
||||
oauth2-provider-name = auth-passthru.oauth2-provider-name;
|
||||
@@ -183,6 +183,15 @@ in
|
||||
weight = 6;
|
||||
};
|
||||
};
|
||||
enableSso = (lib.mkOption {
|
||||
default = false;
|
||||
type = lib.types.bool;
|
||||
description = "Enable SSO for Forgejo";
|
||||
}) // {
|
||||
meta = {
|
||||
type = "enable";
|
||||
};
|
||||
};
|
||||
debug = lib.mkOption {
|
||||
default = false;
|
||||
type = lib.types.bool;
|
||||
|
||||
@@ -11,8 +11,8 @@ let
|
||||
|
||||
hostName = "${cfg.subdomain}.${sp.domain}";
|
||||
auth-passthru = config.passthru.selfprivacy.auth;
|
||||
is-auth-enabled = sp.modules.auth.enable or false;
|
||||
cfg = sp.modules.nextcloud;
|
||||
is-auth-enabled = cfg.enableSso;
|
||||
ldap_scheme_and_host = "ldaps://${auth-passthru.ldap-host}";
|
||||
|
||||
occ = "${config.services.nextcloud.occ}/bin/nextcloud-occ";
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
let
|
||||
domain = config.selfprivacy.domain;
|
||||
cfg = config.selfprivacy.modules.roundcube;
|
||||
is-auth-enabled = config.selfprivacy.modules.auth.enable or false;
|
||||
is-auth-enabled = cfg.enableSso;
|
||||
auth-passthru = config.passthru.selfprivacy.auth;
|
||||
auth-fqdn = auth-passthru.auth-fqdn;
|
||||
sp-module-name = "roundcube";
|
||||
@@ -44,6 +44,15 @@ in
|
||||
weight = 0;
|
||||
};
|
||||
};
|
||||
enableSso = (lib.mkOption {
|
||||
default = false;
|
||||
type = lib.types.bool;
|
||||
description = "Enable SSO for Roundcube";
|
||||
}) // {
|
||||
meta = {
|
||||
type = "enable";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable (lib.mkMerge [
|
||||
|
||||
@@ -2,8 +2,9 @@
|
||||
rec {
|
||||
auth-passthru = config.passthru.selfprivacy.auth;
|
||||
domain = config.selfprivacy.domain;
|
||||
is-auth-enabled = config.selfprivacy.modules.auth.enable or false;
|
||||
group = "dovecot2";
|
||||
is-auth-enabled =
|
||||
config.selfprivacy.modules.simple-nixos-mailserver.enableSso;
|
||||
|
||||
appendSetting =
|
||||
{ name, file, prefix, suffix ? "", passwordFile, destination }:
|
||||
|
||||
@@ -18,5 +18,14 @@
|
||||
type = "location";
|
||||
};
|
||||
};
|
||||
enableSso = (lib.mkOption {
|
||||
default = false;
|
||||
type = lib.types.bool;
|
||||
description = "Enable SSO for mail server";
|
||||
}) // {
|
||||
meta = {
|
||||
type = "enable";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user