felixalb/nixos-config
felixalb
/
nixos-config
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Compare commits

base: felixalb:2382510f1674495e0b443904436301638022d922
Branches Tags
felixalb:main
..
compare: felixalb:ff71cb75b79350b8fb8849f63f5de8b12d31170e
Branches Tags
felixalb:main

3 Commits
2382510f16 ... ff71cb75b7

Author SHA1 Message Date
Felix Albrigtsen ff71cb75b7 defiant/hedgedoc: move to keycloak 2024-06-10 12:37:57 +02:00
Felix Albrigtsen fe4b6bcb50 defiant/gitea: very minor cleanup 2024-06-10 12:37:57 +02:00
Felix Albrigtsen 9fb099e043 defiant: add keycloak 2024-06-10 12:37:52 +02:00
3 changed files with 18 additions and 16 deletions
Show Stats Expand all files Collapse all files

26
hosts/defiant/services/hedgedoc.nix
View File

@ -4,7 +4,7 @@ let
domain = "md.feal.no"; domain = "md.feal.no";
port = 3300; port = 3300;
host = "127.0.1.2"; host = "127.0.1.2";
authServerUrl = "https://auth.feal.no"; authServerUrl = "https://iam.feal.no";
in { in {
# Contains CMD_SESSION_SECRET and CMD_OAUTH2_CLIENT_SECRET # Contains CMD_SESSION_SECRET and CMD_OAUTH2_CLIENT_SECRET
sops.secrets."hedgedoc/env" = { sops.secrets."hedgedoc/env" = {
@ -21,9 +21,8 @@ in {
allowFreeURL = true; allowFreeURL = true;
allowAnonymous = false; allowAnonymous = false;
allowAnonymousEdits = true; # Allow anonymous edits with the "freely" permission allowAnonymousEdits = true;
# dbURL = "postgres://hedgedoc@localhost/hedgedoc";
db = { db = {
username = "hedgedoc"; username = "hedgedoc";
database = "hedgedoc"; database = "hedgedoc";
@ -32,20 +31,23 @@ in {
}; };
email = false; email = false;
oauth2 = { oauth2 = let
baseURL = "${authServerUrl}/oauth2"; oidc = "${authServerUrl}/realms/feal.no/protocol/openid-connect";
tokenURL = "${authServerUrl}/oauth2/token"; in {
authorizationURL = "${authServerUrl}/ui/oauth2"; providerName = "Keycloak";
userProfileURL = "${authServerUrl}/oauth2/openid/hedgedoc/userinfo"; authorizationURL = "${oidc}/auth";
baseURL = "${authServerUrl}";
tokenURL = "${oidc}/token";
userProfileURL = "${oidc}/userinfo";
clientID = "hedgedoc"; clientID = "hedgedoc";
clientSecret = "$CMD_OAUTH2_CLIENT_SECRET"; clientSecret = "$CMD_OAUTH2_CLIENT_SECRET";
scope = "openid email profile"; scope = "openid email profile";
userProfileUsernameAttr = "name"; userProfileDisplayNameAttr = "name";
userProfileEmailAttr = "email"; userProfileEmailAttr = "email";
userProfileDisplayNameAttr = "displayname"; userProfileUsernameAttr = "preferred_username";
rolesClaim = "hedgedoc-roles";
providerName = "KaniDM"; accessRole = "hedgedoc-user";
}; };
}; };
}; };

2
hosts/defiant/services/keycloak.nix
View File

@ -28,6 +28,6 @@ in {
# The main reverse proxy is defined in ./nginx.nix # The main reverse proxy is defined in ./nginx.nix
services.nginx.virtualHosts.${cfg.hostname} = { services.nginx.virtualHosts.${cfg.hostname} = {
locations."= /".return = "302 https://${cfg.hostname}/realms/master/account"; locations."= /".return = "302 https://${cfg.hostname}/realms/feal.no/account";
}; };
} }

6
secrets/defiant/defiant.yaml
View File

@ -2,7 +2,7 @@ matrix:
synapse: synapse:
registrationsecret: ENC[AES256_GCM,data:6gRW6t080VSyNRAmIrMqXL/oj7dj0JbcQekG3lac7zcdvJbgkUaqEGoWdrym2XiEOSLBOVMthnpLdalC2wcyJdmxB7xMNsYS4RfjR3PMKIo1Ap7JSmuKBl3eeaOalHk=,iv:dZl4/qFMoqEbSwL4JF/sjG21e6DuKVxbXwrGHkxfW4U=,tag:LWdCcmUUeTO4YAHkHOSJuw==,type:str] registrationsecret: ENC[AES256_GCM,data:6gRW6t080VSyNRAmIrMqXL/oj7dj0JbcQekG3lac7zcdvJbgkUaqEGoWdrym2XiEOSLBOVMthnpLdalC2wcyJdmxB7xMNsYS4RfjR3PMKIo1Ap7JSmuKBl3eeaOalHk=,iv:dZl4/qFMoqEbSwL4JF/sjG21e6DuKVxbXwrGHkxfW4U=,tag:LWdCcmUUeTO4YAHkHOSJuw==,type:str]
hedgedoc: hedgedoc:
env: ENC[AES256_GCM,data:7UU8MNo3AEpG1L0lpbfow4mGsIj7qMgtldCxv2T8rimintl1PN+avb2yxXz2P+1MqxNhacYYfBn5AkVqUJvAvo/HaQmsu+M1iFuMG6vEQuMGZZ1bjcslKxjVFWe9Rxzb9O33jqielsBiUmkP7f0MoGzfdyncpRuGjge+ADL7YXdRdH2zyDLW0txM3P593MQYiGo9wzwb7ZpycX4NsuE=,iv:4QE4RwD6c7KQS/w15YP/P2u7iOTWd36/YhpA2Jtdu0U=,tag:QBvO3q5C9TK0oSeso367/Q==,type:str] env: ENC[AES256_GCM,data:30kDNwJA/nL2/l1gSVPWgFYIrrxnhKbsQPaS1MqeaggjDpPxyNOhSLf5/p5Z5S/jDuJapevpQR70hfAM8g3gLRNIFtP38V/8w0lUngpuz6MzL7THdNfbabOKsHpNht+nxwGXE1YSd0D4OuX5ll5pLWT8nQtNhhOzuYmDIJ/Xc01lmcGc2ThsA0GlkWZxUw==,iv:ht6BiCYJReWFoR1zpo/X0bcgMV9tYfXUM7Re2ngEk4M=,tag:XrlYHyhVujhhWul3czSTDg==,type:str]
vaultwarden: vaultwarden:
admintoken: ENC[AES256_GCM,data:sUPOe3goxpJFpe5fBdwcM5Z6+DXNdZr5Xd6HzRUb7LtDk9IUtwL4wtlckwnMRoLF628XvCV3ObrX2UmTqUX/6pWqLkWL/vWb3C8ogq4=,iv:vvO9nEkCjcKvl+ILEMlMorMmvyNM1juRYRnEolwg9sQ=,tag:wFnz9oOA+ZGrb4UqKrtUcA==,type:str] admintoken: ENC[AES256_GCM,data:sUPOe3goxpJFpe5fBdwcM5Z6+DXNdZr5Xd6HzRUb7LtDk9IUtwL4wtlckwnMRoLF628XvCV3ObrX2UmTqUX/6pWqLkWL/vWb3C8ogq4=,iv:vvO9nEkCjcKvl+ILEMlMorMmvyNM1juRYRnEolwg9sQ=,tag:wFnz9oOA+ZGrb4UqKrtUcA==,type:str]
microbin: microbin:
@ -36,8 +36,8 @@ sops:
RXcvQU1JYnl0bUtocTZuNkRxcGQwR2MKnyAYtF2y7XBmNuIYi6RzqEJEPPg7B22A RXcvQU1JYnl0bUtocTZuNkRxcGQwR2MKnyAYtF2y7XBmNuIYi6RzqEJEPPg7B22A
fQVeDfIhiNSVva784KTU+y4TU1UPxumriRrLRFPF3h42ZEq2zQAgrQ== fQVeDfIhiNSVva784KTU+y4TU1UPxumriRrLRFPF3h42ZEq2zQAgrQ==
-----END AGE ENCRYPTED FILE----- -----END AGE ENCRYPTED FILE-----
lastmodified: "2024-06-07T19:36:11Z" lastmodified: "2024-06-10T09:40:44Z"
mac: ENC[AES256_GCM,data:WOLO+WYzu1svAqnX8PTnzoSB//hLJ11FfcSWk0/bnQjpOyxQ0Ey7juNyMMe+EuhZ0NZ6JE6MkHk2uVdgSmRIKdxBTSoZuzCllRB4vv1lAABPllOljpjEoDKbZBmiOereE4dwY8AFsFl5uHVqzQ2uvO6FUKY9/vgvXuSABZsN0+w=,iv:wQKa7EiBIYogELOgKotUdxgld/HwIJf9EWpMAZS8D/0=,tag:6auS6hruXlcmiQsphk4tVA==,type:str] mac: ENC[AES256_GCM,data:HgzZvi14Dgacvax54pqeGXowfiFAZIaLhkmJZieL+pUMiZKKp5vo8M4j2ZyM4DB/a9j58Ao1xlykCnit/vfUgeRJlqZsGedMDLtDvW6mEwHNwZwxvX3Zmsykl/Nt4FZS47jdB5J/1r/vAjtVos7K9UWBfiQUH0EJp6OpVWrWzrc=,iv:64G2tA5tqeJjZPunGFJYhP4z4di0PTCqVzA7QlvTETY=,tag:O2zaf0qRwiSwcrfMQE2uKA==,type:str]
pgp: [] pgp: []
unencrypted_suffix: _unencrypted unencrypted_suffix: _unencrypted
version: 3.8.1 version: 3.8.1