defiant/hedgedoc: move to keycloak

hosts/defiant/configuration.nix

@@ -20,10 +20,11 @@
       ./services/gitea.nix
       ./services/hedgedoc.nix
       ./services/home-assistant.nix
+      ./services/keycloak.nix
       ./services/matrix
-      ./services/monitoring
       ./services/microbin.nix
       # ./services/minecraft.nix
+      ./services/monitoring
       ./services/vaultwarden.nix
   ];
 

hosts/defiant/services/gitea.nix

@@ -36,7 +36,6 @@ in {
           OPENID_CONNECT_SCOPES = "email profile openid";
           UPDATE_AVATAR = true;
           ACCOUNT_LINKING = "auto";
-          USERNAME = "email";
         };
 
         log.LEVEL = "Info";
@@ -49,11 +48,7 @@ in {
         };
       };
 
-      # TODO:
-      # - Backup
-      #   - services.gitea.dump?
-      #   - ZFS snapshots?
-      # - configure mailer
+      # TODO: configure mailer
     };
 
     systemd.services.gitea.serviceConfig.WorkingDirectory = lib.mkForce "${cfg.stateDir}/work";

hosts/defiant/services/hedgedoc.nix

@@ -4,7 +4,7 @@ let
   domain = "md.feal.no";
   port = 3300;
   host = "127.0.1.2";
-  authServerUrl = "https://auth.feal.no";
+  authServerUrl = "https://iam.feal.no";
 in {
   # Contains CMD_SESSION_SECRET and CMD_OAUTH2_CLIENT_SECRET
   sops.secrets."hedgedoc/env" = {
@@ -21,9 +21,8 @@ in {
 
       allowFreeURL = true;
       allowAnonymous = false;
-      allowAnonymousEdits = true; # Allow anonymous edits with the "freely" permission
+      allowAnonymousEdits = true;
 
-      # dbURL = "postgres://hedgedoc@localhost/hedgedoc";
       db = {
         username = "hedgedoc";
         database = "hedgedoc";
@@ -32,20 +31,23 @@ in {
       };
 
       email = false;
-      oauth2 = {
-        baseURL = "${authServerUrl}/oauth2";
-        tokenURL = "${authServerUrl}/oauth2/token";
-        authorizationURL = "${authServerUrl}/ui/oauth2";
-        userProfileURL = "${authServerUrl}/oauth2/openid/hedgedoc/userinfo";
+      oauth2 = let
+        oidc = "${authServerUrl}/realms/feal.no/protocol/openid-connect";
+      in {
+        providerName = "Keycloak";
+        authorizationURL = "${oidc}/auth";
+        baseURL = "${authServerUrl}";
+        tokenURL = "${oidc}/token";
+        userProfileURL = "${oidc}/userinfo";
 
         clientID = "hedgedoc";
         clientSecret = "$CMD_OAUTH2_CLIENT_SECRET";
         scope = "openid email profile";
-        userProfileUsernameAttr = "name";
+        userProfileDisplayNameAttr = "name";
         userProfileEmailAttr = "email";
-        userProfileDisplayNameAttr = "displayname";
-
-        providerName = "KaniDM";
+        userProfileUsernameAttr = "preferred_username";
+        rolesClaim = "hedgedoc-roles";
+        accessRole = "hedgedoc-user";
       };
     };
   };

hosts/defiant/services/keycloak.nix

@@ -0,0 +1,33 @@
+{ config, pkgs, lib, ... }:
+let
+  cfg = config.services.keycloak.settings;
+in {
+  environment.noXlibs = false;
+  sops.secrets."keycloak/postgres" = { };
+
+  services.keycloak = {
+    enable = true;
+
+    database = {
+      type = "postgresql";
+      createLocally = true;
+      username = "keycloak";
+      passwordFile = config.sops.secrets."keycloak/postgres".path;
+    };
+
+    settings = {
+      cache = "local";
+      hostname = "iam.feal.no";
+      hostname-strict-backchannel = true;
+      http-enable = true;
+      http-host = "127.0.1.2";
+      http-port = 5060;
+      proxy = "edge";
+    };
+  };
+
+  # The main reverse proxy is defined in ./nginx.nix
+  services.nginx.virtualHosts.${cfg.hostname} = {
+    locations."= /".return = "302 https://${cfg.hostname}/realms/feal.no/account";
+  };
+}

hosts/defiant/services/nginx.nix

@@ -1,5 +1,8 @@
 { config, values, ... }:
-{
+let
+  gitea = config.services.gitea.settings;
+  keycloak = config.services.keycloak.settings;
+in {
   services.nginx = {
     enable = true;
     enableReload = true;
@@ -60,7 +63,8 @@
       };
     };
     "cloud.feal.no" = publicProxy "http://voyager.home.feal.no" {};
-    "git.feal.no" = publicProxy "http://unix:${config.services.gitea.settings.server.HTTP_ADDR}" {};
+    "git.feal.no" = publicProxy "http://unix:${gitea.server.HTTP_ADDR}" {};
     "jf.feal.no" = publicProxy "http://jellyfin.home.feal.no/" {};
+    "iam.feal.no" = publicProxy "http://${keycloak.http-host}:${toString keycloak.http-port}" {};
   };
 }

secrets/defiant/defiant.yaml

@@ -2,7 +2,7 @@ matrix:
     synapse:
         registrationsecret: ENC[AES256_GCM,data:6gRW6t080VSyNRAmIrMqXL/oj7dj0JbcQekG3lac7zcdvJbgkUaqEGoWdrym2XiEOSLBOVMthnpLdalC2wcyJdmxB7xMNsYS4RfjR3PMKIo1Ap7JSmuKBl3eeaOalHk=,iv:dZl4/qFMoqEbSwL4JF/sjG21e6DuKVxbXwrGHkxfW4U=,tag:LWdCcmUUeTO4YAHkHOSJuw==,type:str]
 hedgedoc:
-    env: ENC[AES256_GCM,data:7UU8MNo3AEpG1L0lpbfow4mGsIj7qMgtldCxv2T8rimintl1PN+avb2yxXz2P+1MqxNhacYYfBn5AkVqUJvAvo/HaQmsu+M1iFuMG6vEQuMGZZ1bjcslKxjVFWe9Rxzb9O33jqielsBiUmkP7f0MoGzfdyncpRuGjge+ADL7YXdRdH2zyDLW0txM3P593MQYiGo9wzwb7ZpycX4NsuE=,iv:4QE4RwD6c7KQS/w15YP/P2u7iOTWd36/YhpA2Jtdu0U=,tag:QBvO3q5C9TK0oSeso367/Q==,type:str]
+    env: ENC[AES256_GCM,data:30kDNwJA/nL2/l1gSVPWgFYIrrxnhKbsQPaS1MqeaggjDpPxyNOhSLf5/p5Z5S/jDuJapevpQR70hfAM8g3gLRNIFtP38V/8w0lUngpuz6MzL7THdNfbabOKsHpNht+nxwGXE1YSd0D4OuX5ll5pLWT8nQtNhhOzuYmDIJ/Xc01lmcGc2ThsA0GlkWZxUw==,iv:ht6BiCYJReWFoR1zpo/X0bcgMV9tYfXUM7Re2ngEk4M=,tag:XrlYHyhVujhhWul3czSTDg==,type:str]
 vaultwarden:
     admintoken: ENC[AES256_GCM,data:sUPOe3goxpJFpe5fBdwcM5Z6+DXNdZr5Xd6HzRUb7LtDk9IUtwL4wtlckwnMRoLF628XvCV3ObrX2UmTqUX/6pWqLkWL/vWb3C8ogq4=,iv:vvO9nEkCjcKvl+ILEMlMorMmvyNM1juRYRnEolwg9sQ=,tag:wFnz9oOA+ZGrb4UqKrtUcA==,type:str]
 microbin:
@@ -10,6 +10,8 @@ microbin:
 borg:
     postgres: ENC[AES256_GCM,data:vwfLF2qkUMl9b/4oYVm+pzfbbw==,iv:+QlTXjowne2d+ufw9YbhgaAIVvYg78LkMS0BqfPwoRI=,tag:JAbR3/DbYp+vRApJteg4zA==,type:str]
     gitea: ENC[AES256_GCM,data:GIZ/wkzEkm6DUZETv8GpXd8k5w==,iv:MLnVtrev+poT+3D5+o5UV8FBQWpvqlYAkcXMF53bKJw=,tag:89zkLJNZw04ZPyqvpspgsw==,type:str]
+keycloak:
+    postgres: ENC[AES256_GCM,data:OYvpSyBAQfAJg4/syz1r,iv:Ge6m63YPl+gJPepIRmBz747bXqUo65MHQaRn1S/8m2I=,tag:18bFwYtmcslXlgflfYqM8w==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -34,8 +36,8 @@ sops:
             RXcvQU1JYnl0bUtocTZuNkRxcGQwR2MKnyAYtF2y7XBmNuIYi6RzqEJEPPg7B22A
             fQVeDfIhiNSVva784KTU+y4TU1UPxumriRrLRFPF3h42ZEq2zQAgrQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-03-08T00:37:40Z"
-    mac: ENC[AES256_GCM,data:2S6Z4ZqffGA5Clz+h4J44s7yhb6lMFdUq9KpE4IJUu2cgJyD1Zsh0i1Z1ZwTiD7MH+F1UUMyVhBYk6Fkm1UY07wmDLodNkKfpKRnU2EGa4+yQudin2QHsId+k3C2iAI1UtGlL5Vi00p5VZfihuntcAbwn63RZriCrKn0ayzTQKw=,iv:bwQECQCQghG0DTeWrg73IlFwmz8Fob2ftLKM3kaKOE4=,tag:8HXjvNnzqmIprsXd5d/SmA==,type:str]
+    lastmodified: "2024-06-10T09:40:44Z"
+    mac: ENC[AES256_GCM,data:HgzZvi14Dgacvax54pqeGXowfiFAZIaLhkmJZieL+pUMiZKKp5vo8M4j2ZyM4DB/a9j58Ao1xlykCnit/vfUgeRJlqZsGedMDLtDvW6mEwHNwZwxvX3Zmsykl/Nt4FZS47jdB5J/1r/vAjtVos7K9UWBfiQUH0EJp6OpVWrWzrc=,iv:64G2tA5tqeJjZPunGFJYhP4z4di0PTCqVzA7QlvTETY=,tag:O2zaf0qRwiSwcrfMQE2uKA==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.8.1