mc-fucker/nixos-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

init of authentik-server

Browse source
This commit is contained in:
mc-fucker 2023-06-28 07:56:38 +02:00
parent 65a59a6935
commit f76e3a10e3
1 changed files with 132 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

132
modules/authentik-server.nix Normal file
View file

@ -0,0 +1,132 @@
{ config, lib, ... }:
let
cfg = import ./vars.nix;
dbport = cfg.authentik.dbPort;
domain = cfg.authentik.domain;
redis = "6379";
port = cfg.authentik.port;
authentikEnvironment = {
TZ = "Europe/Berlin";
AUTHENTIK_REDIS__HOST = cfg.podman.hostIP;
AUTHENTIK_POSTGRESQL__HOST = cfg.podman.hostIP;
AUTHENTIK_POSTGRESQL__PORT = dbport;
AUTHENTIK_POSTGRESQL__NAME = "authentik";
AUTHENTIK_POSTGRESQL__USER = "authentik";
AUTHENTIK_POSTGRESQL__PASSWORD = "file://${config.sops.secrets."authentik/db".path}";
AUTHENTIK_SECRET_KEY = "file://${config.sops.secrets."authentik/secret".path}";
AUTHENTIK_EMAIL__HOST = cfg.mail.host;
AUTHENTIK_EMAIL__PORT = cfg.mail.port;
AUTHENTIK_EMAIL__USE_TLS = "true";
AUTHENTIK_EMAIL__FROM = "Authentik <authentik@mc-fucker.cool>";
};
in
{
imports = [
./podman-postgresql.nix # for the database
./nginx.nix # for the webserver
];
sops.secrets."authentik/db" = {
owner = "mc-fucker"; # unfortunately, the UID of the container process can't
group = "nogroup"; # be changed, so it needs to be this user
};
sops.secrets."authentik/secret" = {
owner = "mc-fucker";
group = "nogroup";
};
services.podman-postgresql."authentik" = {
enable = true;
image = "docker.io/library/postgres:15-alpine";
port = (lib.strings.toInt dbport);
passwordFile = config.sops.secrets."authentik/db".path;
};
virtualisation.oci-containers.containers.redis = {
image = "docker.io/library/redis:alpine";
extraOptions = cfg.podman.extraOptions;
cmd = [ "--save 60 1" ];
volumes = [
"/var/lib/redis:/data"
];
ports = [ "${redis}:${redis}" ];
environment = {
TZ = "Europe/Berlin";
};
};
virtualisation.oci-containers.containers.authentik-server = {
image = "ghcr.io/goauthentik/server";
extraOptions = cfg.podman.extraOptions;
cmd = [ "server" ];
dependsOn = [
"postgresql-authentik"
"redis"
];
volumes = [
"/var/lib/authentik/media:/media"
"/var/lib/authentik/templates:/templates"
"${config.sops.secrets."authentik/db".path}:${config.sops.secrets."authentik/db".path}"
"${config.sops.secrets."authentik/secret".path}:${config.sops.secrets."authentik/secret".path}"
];
ports = [ "${port}:${port}" ];
environment = authentikEnvironment;
};
virtualisation.oci-containers.containers.authentik-worker = {
image = "ghcr.io/goauthentik/server";
extraOptions = cfg.podman.extraOptions;
cmd = [ "worker" ];
dependsOn = [
"postgresql-authentik"
"redis"
];
volumes = [
"/var/lib/authentik/media:/media"
"/var/lib/authentik/templates:/templates"
"${config.sops.secrets."authentik/db".path}:${config.sops.secrets."authentik/db".path}"
"${config.sops.secrets."authentik/secret".path}:${config.sops.secrets."authentik/secret".path}"
];
environment = authentikEnvironment;
};
services.nginx = {
upstreams.authentik = {
servers."localhost:${port}" = {};
};
appendHttpConfig = ''
map $http_upgrade $connection_upgrade_keepalive {
default upgrade;
''' ''';
}
'';
virtualHosts.${domain} = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://authentik";
extraConfig = ''
proxy_http_version 1.1;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $host;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade_keepalive;
'';
};
extraConfig = ''
access_log /var/log/nginx/${domain}_access.log;
error_log /var/log/nginx/${domain}_error.log;
'';
};
};
}
# vim: set et ts=2 sw=2 ai: