defiant: add keycloak

hosts/defiant/services/keycloak.nix

@@ -0,0 +1,33 @@
+{ config, pkgs, lib, ... }:
+let
+  cfg = config.services.keycloak.settings;
+in {
+  environment.noXlibs = false;
+  sops.secrets."keycloak/postgres" = { };
+
+  services.keycloak = {
+    enable = true;
+
+    database = {
+      type = "postgresql";
+      createLocally = true;
+      username = "keycloak";
+      passwordFile = config.sops.secrets."keycloak/postgres".path;
+    };
+
+    settings = {
+      cache = "local";
+      hostname = "iam.feal.no";
+      hostname-strict-backchannel = true;
+      http-enable = true;
+      http-host = "127.0.1.2";
+      http-port = 5060;
+      proxy = "edge";
+    };
+  };
+
+  # The main reverse proxy is defined in ./nginx.nix
+  services.nginx.virtualHosts.${cfg.hostname} = {
+    locations."= /".return = "302 https://${cfg.hostname}/realms/feal.no/account";
+  };
+}

hosts/defiant/services/nginx.nix

@@ -1,5 +1,8 @@
 { config, values, ... }:
-{
+let
+  gitea = config.services.gitea.settings;
+  keycloak = config.services.keycloak.settings;
+in {
   services.nginx = {
     enable = true;
     enableReload = true;
@@ -60,7 +63,8 @@
       };
     };
     "cloud.feal.no" = publicProxy "http://voyager.home.feal.no" {};
-    "git.feal.no" = publicProxy "http://unix:${config.services.gitea.settings.server.HTTP_ADDR}" {};
+    "git.feal.no" = publicProxy "http://unix:${gitea.server.HTTP_ADDR}" {};
     "jf.feal.no" = publicProxy "http://jellyfin.home.feal.no/" {};
+    "iam.feal.no" = publicProxy "http://${keycloak.http-host}:${toString keycloak.http-port}" {};
   };
 }