felixalb/nixos-config
felixalb
/
nixos-config
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

defiant: add keycloak

This commit is contained in:
Felix Albrigtsen 2024-06-10 10:45:59 +02:00
parent ef23fded85
commit f5a8ace030
4 changed files with 46 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
hosts/defiant/configuration.nix
View File

@ -20,10 +20,11 @@
./services/gitea.nix
./services/hedgedoc.nix
./services/home-assistant.nix
./services/keycloak.nix
./services/matrix
./services/monitoring
./services/microbin.nix
#./services/minecraft.nix
# ./services/minecraft.nix
./services/monitoring
./services/vaultwarden.nix
];

33
hosts/defiant/services/keycloak.nix Normal file
View File

@ -0,0 +1,33 @@
{ config, pkgs, lib, ... }:
let
cfg = config.services.keycloak.settings;
in {
environment.noXlibs = false;
sops.secrets."keycloak/postgres" = { };
services.keycloak = {
enable = true;
database = {
type = "postgresql";
createLocally = true;
username = "keycloak";
passwordFile = config.sops.secrets."keycloak/postgres".path;
};
settings = {
cache = "local";
hostname = "iam.feal.no";
hostname-strict-backchannel = true;
http-enable = true;
http-host = "127.0.1.2";
http-port = 5060;
proxy = "edge";
};
};
# The main reverse proxy is defined in ./nginx.nix
services.nginx.virtualHosts.${cfg.hostname} = {
locations."= /".return = "302 https://${cfg.hostname}/realms/master/account";
};
}

8
hosts/defiant/services/nginx.nix
View File

@ -1,5 +1,8 @@
{ config, values, ... }:
{
let
gitea = config.services.gitea.settings;
keycloak = config.services.keycloak.settings;
in {
services.nginx = {
enable = true;
enableReload = true;
@ -60,7 +63,8 @@
};
};
"cloud.feal.no" = publicProxy "http://voyager.home.feal.no" {};
"git.feal.no" = publicProxy "http://unix:${config.services.gitea.settings.server.HTTP_ADDR}" {};
"git.feal.no" = publicProxy "http://unix:${gitea.server.HTTP_ADDR}" {};
"jf.feal.no" = publicProxy "http://jellyfin.home.feal.no/" {};
"iam.feal.no" = publicProxy "http://${keycloak.http-host}:${toString keycloak.http-port}" {};
};
}

6
secrets/defiant/defiant.yaml
View File

@ -10,6 +10,8 @@ microbin:
borg:
postgres: ENC[AES256_GCM,data:vwfLF2qkUMl9b/4oYVm+pzfbbw==,iv:+QlTXjowne2d+ufw9YbhgaAIVvYg78LkMS0BqfPwoRI=,tag:JAbR3/DbYp+vRApJteg4zA==,type:str]
gitea: ENC[AES256_GCM,data:GIZ/wkzEkm6DUZETv8GpXd8k5w==,iv:MLnVtrev+poT+3D5+o5UV8FBQWpvqlYAkcXMF53bKJw=,tag:89zkLJNZw04ZPyqvpspgsw==,type:str]
keycloak:
postgres: ENC[AES256_GCM,data:OYvpSyBAQfAJg4/syz1r,iv:Ge6m63YPl+gJPepIRmBz747bXqUo65MHQaRn1S/8m2I=,tag:18bFwYtmcslXlgflfYqM8w==,type:str]
sops:
kms: []
gcp_kms: []
@ -34,8 +36,8 @@ sops:
RXcvQU1JYnl0bUtocTZuNkRxcGQwR2MKnyAYtF2y7XBmNuIYi6RzqEJEPPg7B22A
fQVeDfIhiNSVva784KTU+y4TU1UPxumriRrLRFPF3h42ZEq2zQAgrQ==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2024-03-08T00:37:40Z"
mac: ENC[AES256_GCM,data:2S6Z4ZqffGA5Clz+h4J44s7yhb6lMFdUq9KpE4IJUu2cgJyD1Zsh0i1Z1ZwTiD7MH+F1UUMyVhBYk6Fkm1UY07wmDLodNkKfpKRnU2EGa4+yQudin2QHsId+k3C2iAI1UtGlL5Vi00p5VZfihuntcAbwn63RZriCrKn0ayzTQKw=,iv:bwQECQCQghG0DTeWrg73IlFwmz8Fob2ftLKM3kaKOE4=,tag:8HXjvNnzqmIprsXd5d/SmA==,type:str]
lastmodified: "2024-06-07T19:36:11Z"
mac: ENC[AES256_GCM,data:WOLO+WYzu1svAqnX8PTnzoSB//hLJ11FfcSWk0/bnQjpOyxQ0Ey7juNyMMe+EuhZ0NZ6JE6MkHk2uVdgSmRIKdxBTSoZuzCllRB4vv1lAABPllOljpjEoDKbZBmiOereE4dwY8AFsFl5uHVqzQ2uvO6FUKY9/vgvXuSABZsN0+w=,iv:wQKa7EiBIYogELOgKotUdxgld/HwIJf9EWpMAZS8D/0=,tag:6auS6hruXlcmiQsphk4tVA==,type:str]
pgp: []
unencrypted_suffix: _unencrypted
version: 3.8.1