gensokyo-zone/infrastructure
1
0
Fork 0
mirror of https://github.com/gensokyo-zone/infrastructure.git synced 2026-02-09 20:39:18 -08:00
Code Issues Projects Releases Packages Wiki Activity Actions

chore(keycloak): change default port

Browse source
This commit is contained in:
arcnmx 2024-03-26 10:45:58 -07:00
parent 0116ecf47f
commit 5fd4a90dc8
3 changed files with 16 additions and 35 deletions
Download patch file Download diff file Expand all files Collapse all files

38
nixos/access/keycloak.nix
View file

@ -3,38 +3,21 @@
lib, lib,
... ...
}: let }: let
inherit (lib.options) mkOption;
inherit (lib.modules) mkIf mkDefault; inherit (lib.modules) mkIf mkDefault;
cfg = config.services.keycloak; cfg = config.services.keycloak;
inherit (config) networking;
inherit (config.services) nginx; inherit (config.services) nginx;
access = nginx.access.keycloak;
locations = {
"/" = {
proxyPass = mkDefault access.url;
};
};
in { in {
options.services.nginx.access.keycloak = with lib.types; {
host = mkOption {
type = str;
default = "keycloak.local.${networking.domain}";
};
url = mkOption {
type = str;
default = "https://${access.host}";
};
};
config.services.nginx = { config.services.nginx = {
access.keycloak = mkIf cfg.enable {
host = mkDefault "localhost";
url = mkDefault (if cfg.sslCertificate != null then "https://${access.host}" else "http://${access.host}");
};
virtualHosts = { virtualHosts = {
keycloak = { keycloak = {
name.shortServer = mkDefault "sso"; name.shortServer = mkDefault "sso";
ssl.force = mkDefault true; ssl.force = mkDefault true;
inherit locations; locations."/".proxyPass = let
url = mkDefault (if cfg.sslCertificate != null
then "https://localhost:${toString cfg.settings.https-port}"
else "http://localhost:${toString cfg.settings.http-port}"
);
in mkIf cfg.enable (mkDefault url);
}; };
keycloak'local = { keycloak'local = {
name.shortServer = mkDefault "sso"; name.shortServer = mkDefault "sso";
@ -43,14 +26,7 @@ in {
cert.copyFromVhost = "keycloak"; cert.copyFromVhost = "keycloak";
}; };
local.enable = true; local.enable = true;
inherit locations; locations."/".proxyPass = mkDefault nginx.virtualHosts.keycloak.locations."/".proxyPass;
extraConfig = mkIf false ''
set $vouch_local_url ${nginx.vouch.localUrl};
#if ($x_forwarded_host ~ "\.tail\.${networking.domain}$") {
# set $vouch_local_url $x_scheme://${nginx.vouch.tailDomain};
#}
proxy_redirect ${nginx.vouch.url}/ $vouch_local_url/;
'';
}; };
}; };
}; };

12
nixos/keycloak.nix
View file

@ -21,7 +21,7 @@ in {
sopsFile = ./secrets/keycloak.yaml; sopsFile = ./secrets/keycloak.yaml;
owner = "keycloak"; owner = "keycloak";
}; };
in { in mkIf cfg.enable {
keycloak_db_password = commonSecret; keycloak_db_password = commonSecret;
}; };
users = mkIf cfg.enable { users = mkIf cfg.enable {
@ -33,10 +33,12 @@ in {
}; };
}; };
networking.firewall.interfaces.local.allowedTCPPorts = mkIf cfg.enable [ networking.firewall.interfaces.int.allowedTCPPorts = mkIf cfg.enable [
(if cfg.sslCertificate != null then 443 else 80) (if cfg.sslCertificate != null then cfg.settings.https-port else cfg.settings.http-port)
]; ];
systemd.services.keycloak.serviceConfig.DynamicUser = mkForce false; systemd.services.keycloak = mkIf cfg.enable {
serviceConfig.DynamicUser = mkForce false;
};
services.keycloak = { services.keycloak = {
enable = true; enable = true;
@ -54,6 +56,8 @@ in {
hostname-strict = mkDefault hostname-strict; hostname-strict = mkDefault hostname-strict;
hostname-strict-https = mkDefault hostname-strict; hostname-strict-https = mkDefault hostname-strict;
proxy-headers = mkDefault "xforwarded"; proxy-headers = mkDefault "xforwarded";
http-port = mkDefault 8080;
https-port = mkDefault 8443;
}; };
sslCertificate = mkDefault "${cert}/fullchain.pem"; sslCertificate = mkDefault "${cert}/fullchain.pem";

1
systems/hakurei/nixos.nix
View file

@ -230,6 +230,7 @@ in {
# we're not the real sso record-holder, so don't respond globally.. # we're not the real sso record-holder, so don't respond globally..
local.denyGlobal = true; local.denyGlobal = true;
ssl.cert.enable = true; ssl.cert.enable = true;
locations."/".proxyPass = "https://${getHostnameFor "keycloak" "lan"}:8443";
}; };
vouch = let vouch = let
inherit (keycloak.services) vouch-proxy; inherit (keycloak.services) vouch-proxy;