gensokyo-zone/infrastructure
1
0
Fork 0
mirror of https://github.com/gensokyo-zone/infrastructure.git synced 2026-02-09 12:29:19 -08:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix(bw): nginx access

Browse source
This commit is contained in:
arcnmx 2024-06-02 19:36:25 -07:00
parent 90f0e94254
commit 23d257aacc
3 changed files with 47 additions and 32 deletions
Download patch file Download diff file Expand all files Collapse all files

1
nixos/vaultwarden.nix
View file

@ -15,6 +15,7 @@ in {
databaseUrlPath = mkIf (!postgresql.enable) (mkDefault config.sops.secrets.vaultwarden-database-url.path);
adminTokenPath = mkIf enableAdmin (mkDefault config.sops.secrets.vaultwarden-admin-token.path);
config = {
DOMAIN = mkDefault "https://bw.${config.networking.domain}";
SIGNUPS_ALLOWED = mkDefault false;
ROCKET_ADDRESS = mkDefault "::";
WEBSOCKET_ADDRESS = mkDefault "::";

4
systems/keycloak/default.nix
View file

@ -12,6 +12,10 @@ _: {
keycloak.enable = true;
vouch-proxy.enable = true;
vaultwarden.enable = true;
nginx = {
enable = true;
ports.proxied.enable = true;
};
};
};
}

32
systems/keycloak/nixos.nix
View file

@ -2,8 +2,11 @@
meta,
config,
access,
lib,
...
}: {
}: let
inherit (lib.modules) mkMerge;
in {
imports = let
inherit (meta) nixos;
in [
@ -15,6 +18,8 @@
nixos.vaultwarden
nixos.cloudflared
nixos.vouch
nixos.nginx
nixos.access.vaultwarden
];
services.cloudflared = let
@ -24,14 +29,14 @@
default = "http_status:404";
credentialsFile = config.sops.secrets.cloudflared-tunnel-keycloak.path;
ingress = let
inherit (config.services) nginx;
inherit (config.networking) domain;
keycloak'system = access.systemForService "keycloak";
inherit (keycloak'system.exports.services) keycloak;
vouch'system = access.systemForServiceId "login";
inherit (vouch'system.exports.services) vouch-proxy;
vaultwarden'system = access.systemForServiceId "bw";
inherit (vaultwarden'system.exports.services) vaultwarden;
in {
"${keycloak.id}.${config.networking.domain}" = let
ingress = {
"${keycloak.id}.${domain}" = let
portName =
if keycloak.ports.https.enable
then "https"
@ -49,19 +54,24 @@
} =
true;
};
"${vouch-proxy.id}.${config.networking.domain}" = {
"${vouch-proxy.id}.${domain}" = {
service = access.proxyUrlFor {
system = vouch'system;
service = vouch-proxy;
};
};
"${vaultwarden.id}.${config.networking.domain}" = {
service = access.proxyUrlFor {
system = vaultwarden'system;
service = vaultwarden;
};
};
in mkMerge [
ingress
(nginx.virtualHosts.vaultwarden.proxied.cloudflared.getIngress {})
];
};
};
services.nginx = {
proxied.enable = true;
virtualHosts = {
vaultwarden.proxied.enable = "cloudflared";
};
};