From 9fb099e043f67dd882b9e8c9ebf3a256ec1ad14b Mon Sep 17 00:00:00 2001
From: Felix Albrigtsen <felix@albrigtsen.it>
Date: Mon, 10 Jun 2024 10:45:59 +0200
Subject: [PATCH] defiant: add keycloak

---
 hosts/defiant/configuration.nix     |  5 +++--
 hosts/defiant/services/keycloak.nix | 33 +++++++++++++++++++++++++++++
 hosts/defiant/services/nginx.nix    |  8 +++++--
 secrets/defiant/defiant.yaml        |  6 ++++--
 4 files changed, 46 insertions(+), 6 deletions(-)
 create mode 100644 hosts/defiant/services/keycloak.nix

diff --git a/hosts/defiant/configuration.nix b/hosts/defiant/configuration.nix
index 930f568..7ffac1c 100644
--- a/hosts/defiant/configuration.nix
+++ b/hosts/defiant/configuration.nix
@@ -20,10 +20,11 @@
       ./services/gitea.nix
       ./services/hedgedoc.nix
       ./services/home-assistant.nix
+      ./services/keycloak.nix
       ./services/matrix
-      ./services/monitoring
       ./services/microbin.nix
-      #./services/minecraft.nix
+      # ./services/minecraft.nix
+      ./services/monitoring
       ./services/vaultwarden.nix
   ];
 
diff --git a/hosts/defiant/services/keycloak.nix b/hosts/defiant/services/keycloak.nix
new file mode 100644
index 0000000..23da159
--- /dev/null
+++ b/hosts/defiant/services/keycloak.nix
@@ -0,0 +1,33 @@
+{ config, pkgs, lib, ... }:
+let
+  cfg = config.services.keycloak.settings;
+in {
+  environment.noXlibs = false;
+  sops.secrets."keycloak/postgres" = { };
+
+  services.keycloak = {
+    enable = true;
+
+    database = {
+      type = "postgresql";
+      createLocally = true;
+      username = "keycloak";
+      passwordFile = config.sops.secrets."keycloak/postgres".path;
+    };
+
+    settings = {
+      cache = "local";
+      hostname = "iam.feal.no";
+      hostname-strict-backchannel = true;
+      http-enable = true;
+      http-host = "127.0.1.2";
+      http-port = 5060;
+      proxy = "edge";
+    };
+  };
+
+  # The main reverse proxy is defined in ./nginx.nix
+  services.nginx.virtualHosts.${cfg.hostname} = {
+    locations."= /".return = "302 https://${cfg.hostname}/realms/feal.no/account";
+  };
+}
diff --git a/hosts/defiant/services/nginx.nix b/hosts/defiant/services/nginx.nix
index 6561a34..c3042fd 100644
--- a/hosts/defiant/services/nginx.nix
+++ b/hosts/defiant/services/nginx.nix
@@ -1,5 +1,8 @@
 { config, values, ... }:
-{
+let
+  gitea = config.services.gitea.settings;
+  keycloak = config.services.keycloak.settings;
+in {
   services.nginx = {
     enable = true;
     enableReload = true;
@@ -60,7 +63,8 @@
       };
     };
     "cloud.feal.no" = publicProxy "http://voyager.home.feal.no" {};
-    "git.feal.no" = publicProxy "http://unix:${config.services.gitea.settings.server.HTTP_ADDR}" {};
+    "git.feal.no" = publicProxy "http://unix:${gitea.server.HTTP_ADDR}" {};
     "jf.feal.no" = publicProxy "http://jellyfin.home.feal.no/" {};
+    "iam.feal.no" = publicProxy "http://${keycloak.http-host}:${toString keycloak.http-port}" {};
   };
 }
diff --git a/secrets/defiant/defiant.yaml b/secrets/defiant/defiant.yaml
index f9fc325..fb9dd2f 100644
--- a/secrets/defiant/defiant.yaml
+++ b/secrets/defiant/defiant.yaml
@@ -10,6 +10,8 @@ microbin:
 borg:
     postgres: ENC[AES256_GCM,data:vwfLF2qkUMl9b/4oYVm+pzfbbw==,iv:+QlTXjowne2d+ufw9YbhgaAIVvYg78LkMS0BqfPwoRI=,tag:JAbR3/DbYp+vRApJteg4zA==,type:str]
     gitea: ENC[AES256_GCM,data:GIZ/wkzEkm6DUZETv8GpXd8k5w==,iv:MLnVtrev+poT+3D5+o5UV8FBQWpvqlYAkcXMF53bKJw=,tag:89zkLJNZw04ZPyqvpspgsw==,type:str]
+keycloak:
+    postgres: ENC[AES256_GCM,data:OYvpSyBAQfAJg4/syz1r,iv:Ge6m63YPl+gJPepIRmBz747bXqUo65MHQaRn1S/8m2I=,tag:18bFwYtmcslXlgflfYqM8w==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -34,8 +36,8 @@ sops:
             RXcvQU1JYnl0bUtocTZuNkRxcGQwR2MKnyAYtF2y7XBmNuIYi6RzqEJEPPg7B22A
             fQVeDfIhiNSVva784KTU+y4TU1UPxumriRrLRFPF3h42ZEq2zQAgrQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-03-08T00:37:40Z"
-    mac: ENC[AES256_GCM,data:2S6Z4ZqffGA5Clz+h4J44s7yhb6lMFdUq9KpE4IJUu2cgJyD1Zsh0i1Z1ZwTiD7MH+F1UUMyVhBYk6Fkm1UY07wmDLodNkKfpKRnU2EGa4+yQudin2QHsId+k3C2iAI1UtGlL5Vi00p5VZfihuntcAbwn63RZriCrKn0ayzTQKw=,iv:bwQECQCQghG0DTeWrg73IlFwmz8Fob2ftLKM3kaKOE4=,tag:8HXjvNnzqmIprsXd5d/SmA==,type:str]
+    lastmodified: "2024-06-07T19:36:11Z"
+    mac: ENC[AES256_GCM,data:WOLO+WYzu1svAqnX8PTnzoSB//hLJ11FfcSWk0/bnQjpOyxQ0Ey7juNyMMe+EuhZ0NZ6JE6MkHk2uVdgSmRIKdxBTSoZuzCllRB4vv1lAABPllOljpjEoDKbZBmiOereE4dwY8AFsFl5uHVqzQ2uvO6FUKY9/vgvXuSABZsN0+w=,iv:wQKa7EiBIYogELOgKotUdxgld/HwIJf9EWpMAZS8D/0=,tag:6auS6hruXlcmiQsphk4tVA==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.8.1