Skip to content

Commit 713622f

Browse files
IogaMasterIogaMaster
committed
authelia middleware
1 parent 51537ff commit 713622f

5 files changed

Lines changed: 130 additions & 44 deletions

File tree

‎hosts/equinox/config.nix‎

Lines changed: 29 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -28,35 +28,33 @@ in {
2828
apps.tools.git.enable = true;
2929
};
3030

31-
services.jellyfin = {
32-
enable = true;
33-
openFirewall = true; # Not strictly needed if Caddy is on the same machine
34-
};
35-
36-
networking.firewall.allowedTCPPorts = [
37-
8096 # Jellyfin
38-
8301 # Consul Gossip
39-
8300 # Consul RPC
40-
];
41-
42-
services.consul = {
43-
enable = true;
44-
extraConfig = {
45-
server = false;
46-
retry_join = [ "192.168.25.131" ];
47-
bind_addr = ''{{ GetPrivateInterfaces | attr "address" }}'';
48-
services = [{
49-
name = "jellyfin";
50-
port = 8096;
51-
tags = [ "media" "public" ];
52-
check = {
53-
http = "http://127.0.0.1:8096/health";
54-
interval = "10s";
55-
timeout = "1s";
56-
};
57-
}];
58-
};
59-
};
60-
61-
impermanence.enable = true;
31+
# services.jellyfin = {
32+
# enable = true;
33+
# openFirewall = true; # Not strictly needed if Caddy is on the same machine
34+
# };
35+
#
36+
# networking.firewall.allowedTCPPorts = [
37+
# 8096 # Jellyfin
38+
# 8301 # Consul Gossip
39+
# 8300 # Consul RPC
40+
# ];
41+
#
42+
# services.consul = {
43+
# enable = true;
44+
# extraConfig = {
45+
# server = false;
46+
# retry_join = [ "192.168.25.131" ];
47+
# bind_addr = ''{{ GetPrivateInterfaces | attr "address" }}'';
48+
# services = [{
49+
# name = "jellyfin";
50+
# port = 8096;
51+
# tags = [ "media" "public" ];
52+
# check = {
53+
# http = "http://127.0.0.1:8096/health";
54+
# interval = "10s";
55+
# timeout = "1s";
56+
# };
57+
# }];
58+
# };
59+
# };
6260
}

‎hosts/neutrino/config.nix‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,4 @@ in {
4040
};
4141
};
4242
};
43-
44-
impermanence.enable = true;
4543
}

‎modules/impermanence.nix‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{ lib, inputs, options, ... }@args:
2-
lib.mkModule args "impermanence" {
2+
(lib.mkModule args "impermanence" {
33
imports = [ inputs.impermanence.nixosModules.impermanence ];
44
options = with lib;
55
with lib.types; {
@@ -42,8 +42,9 @@ lib.mkModule args "impermanence" {
4242
umount /btrfs_tmp
4343
'';
4444

45-
environment.persistence."/persist" =
46-
lib.mkAliasDefinitions options.environment.persist;
47-
fileSystems."/persist".neededForBoot = true;
4845
};
46+
}) // {
47+
config.environment.persistence."/persist" =
48+
lib.mkAliasDefinitions options.environment.persist;
49+
config.fileSystems."/persist".neededForBoot = true;
4950
}

‎modules/services/authelia.nix‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
{ lib, secrets, colors, pkgs, ... }@args:
2+
lib.mkModule args "ioga.services.authelia" {
3+
options = with lib; {
4+
domain = mkOpt' types.str "ioga.dev";
5+
instanceName = mkOpt' types.str "main";
6+
};
7+
config = { cfg }: {
8+
secrets.authelia = {
9+
user = "authelia-${cfg.instanceName}";
10+
group = "authelia-${cfg.instanceName}";
11+
};
12+
services.authelia.instances.${cfg.instanceName} = {
13+
enable = true;
14+
secrets = {
15+
jwtSecretFile = "${secrets.authelia}/jwtSecretFile";
16+
sessionSecretFile = "${secrets.authelia}/sessionSecretFile";
17+
storageEncryptionKeyFile =
18+
"${secrets.authelia}/storageEncryptionKeyFile";
19+
};
20+
21+
settings = {
22+
theme = "dark";
23+
server.address = "tcp://0.0.0.0:9091";
24+
25+
authentication_backend.file.path =
26+
"/var/lib/authelia-${cfg.instanceName}/users.yml";
27+
storage.local.path = "/var/lib/authelia-${cfg.instanceName}/db.sqlite3";
28+
notifier.filesystem.filename =
29+
"/var/lib/authelia-${cfg.instanceName}/emails.txt";
30+
31+
access_control = {
32+
default_policy = "deny";
33+
rules = [
34+
{
35+
domain = "auth.${cfg.domain}";
36+
policy = "bypass";
37+
}
38+
{
39+
domain = "*.${cfg.domain}";
40+
policy = "one_factor";
41+
}
42+
];
43+
};
44+
45+
session.cookies = [{
46+
inherit (cfg) domain;
47+
authelia_url = "https://auth.${cfg.domain}";
48+
default_redirection_url = "https://${cfg.domain}";
49+
}];
50+
};
51+
};
52+
53+
systemd.services."authelia-${cfg.instanceName}" = {
54+
serviceConfig.StateDirectory = "authelia-${cfg.instanceName}";
55+
preStart = # bash
56+
''
57+
USER_DB="/var/lib/authelia-${cfg.instanceName}/users.yml"
58+
PASS=$(cat ${secrets.authelia}/adminPassword)
59+
HASHED_PASSWORD=$(${pkgs.authelia}/bin/authelia crypto hash generate argon2 --password "$PASS" | ${pkgs.gawk}/bin/awk '/Digest:/ {print $2}')
60+
if [ ! -s "$USER_DB" ]; then
61+
echo "${''
62+
users:
63+
admin:
64+
displayname: "Admin"
65+
password: "$HASHED_PASSWORD"
66+
email: "admin@${cfg.domain}"
67+
groups: [admins]''}" > "$USER_DB"
68+
chmod 600 "$USER_DB"
69+
chown authelia-${cfg.instanceName}:authelia-${cfg.instanceName} "$USER_DB"
70+
fi
71+
'';
72+
};
73+
};
74+
}

‎modules/services/reverse_proxy.nix‎

Lines changed: 22 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
1-
{ lib, colors, pkgs, ... }@args:
1+
{ lib, colors, pkgs, secrets, ... }@args:
22
lib.mkModule args "ioga.services.reverse_proxy" {
33
options = with lib; { domain = mkOpt' types.str "ioga.dev"; };
44
config = { cfg }: {
55

6+
ioga.services.authelia.enable = true;
67
services = {
78
resolved.extraConfig = ''
89
[Resolve]
@@ -22,16 +23,30 @@ lib.mkModule args "ioga.services.reverse_proxy" {
2223

2324
caddy = {
2425
enable = true;
25-
extraConfig = # caddy
26+
extraConfig =
27+
#caddy
2628
''
29+
(authelia_auth) {
30+
forward_auth 0.0.0.0:9091 {
31+
uri /api/authz/forward-auth
32+
copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
33+
# Important for session cookie logic
34+
header_up X-Forwarded-Proto {scheme}
35+
header_up X-Forwarded-Host {host}
36+
}
37+
}
38+
39+
http://auth.${cfg.domain} {
40+
reverse_proxy 0.0.0.0:9091
41+
}
42+
2743
http://*.${cfg.domain} {
44+
import authelia_auth
45+
2846
reverse_proxy {
2947
dynamic srv {
30-
name "{labels.2}.service.consul"
31-
resolvers 127.0.0.1:8600
32-
}
33-
transport http {
34-
resolvers 127.0.0.1:8600
48+
name "{labels.2}.service.consul"
49+
resolvers 127.0.0.1:8600
3550
}
3651
}
3752
}

0 commit comments

Comments
 (0)