gensokyo-zone/infrastructure
1
0
Fork 0
mirror of https://github.com/gensokyo-zone/infrastructure.git synced 2026-02-09 12:29:19 -08:00
Code Issues Projects Releases Packages Wiki Activity Actions

glauth: Working

Browse source
This commit is contained in:
kat witch 2021-09-05 00:03:41 +01:00
parent a1d46f5301
commit acfa259b2a
No known key found for this signature in database
GPG key ID: 1B477797DCA5EC72
4 changed files with 12 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

4
README.md
View file

@ -113,10 +113,12 @@ See [here][] for additional information on profiles.
| [filehost][] | I sling things in here via SSH/SCP. | | [filehost][] | I sling things in here via SSH/SCP. |
| [fusionpbx][] | FusionPBX. Fancy PBX. | | [fusionpbx][] | FusionPBX. Fancy PBX. |
| [gitea][] | Self-hosted git with mail support. | | [gitea][] | Self-hosted git with mail support. |
| [glauth][] | LDAP server. |
| [jellyfin][] | HTPC/NAS stuff. | | [jellyfin][] | HTPC/NAS stuff. |
| [katsplash][] | A splash screen for some hosts. | | [katsplash][] | A splash screen for some hosts. |
| [kattv-ingest][] | Takes data from kattv, slings to RTMP. | | [kattv-ingest][] | Takes data from kattv, slings to RTMP. |
| [kattv][] | Takes data from a webcam, slings to kattv-ingest. | | [kattv][] | Takes data from a webcam, slings to kattv-ingest. |
| [keycloak][] | Fancy identity stuffs. |
| [knot][] | Knot DNS, authoritative DNS server. | | [knot][] | Knot DNS, authoritative DNS server. |
| [logrotate][] | Rotates logs! | | [logrotate][] | Rotates logs! |
| [mail][] | [nixos-mailserver][]. | | [mail][] | [nixos-mailserver][]. |
@ -255,10 +257,12 @@ Please use `nix-shell` or [direnv/direnv][]. The shell is not compatible with [n
[filehost]: config/services/filehost/default.nix [filehost]: config/services/filehost/default.nix
[fusionpbx]: config/services/fusionpbx/default.nix [fusionpbx]: config/services/fusionpbx/default.nix
[gitea]: config/services/gitea/default.nix [gitea]: config/services/gitea/default.nix
[glauth]: config/services/glauth
[jellyfin]: config/services/jellyfin/default.nix [jellyfin]: config/services/jellyfin/default.nix
[katsplash]: config/services/katsplash/default.nix [katsplash]: config/services/katsplash/default.nix
[kattv-ingest]: config/services/kattv-ingest/default.nix [kattv-ingest]: config/services/kattv-ingest/default.nix
[kattv]: config/services/kattv/default.nix [kattv]: config/services/kattv/default.nix
[keycloak]: config/services/keycloak
[knot]: config/services/knot/default.nix [knot]: config/services/knot/default.nix
[logrotate]: config/services/logrotate/default.nix [logrotate]: config/services/logrotate/default.nix
[mail]: config/services/mail/default.nix [mail]: config/services/mail/default.nix

1
config/modules/nixos/glauth.nix
View file

@ -154,6 +154,7 @@ in
shopt -s inherit_errexit shopt -s inherit_errexit
umask u=rwx,g=,o= umask u=rwx,g=,o=
mkdir -p /run/glauth/secrets mkdir -p /run/glauth/secrets
chown -R glauth:glauth /run/glauth/
install -T -m 0400 -o glauth -g glauth '${dbcfg.passwordFile}' /run/glauth/secrets/db_password install -T -m 0400 -o glauth -g glauth '${dbcfg.passwordFile}' /run/glauth/secrets/db_password
''; '';
startPre = '' startPre = ''

8
config/services/glauth/default.nix
View file

@ -1,6 +1,10 @@
{ config, tf, lib, ... }: with lib; { { config, tf, lib, ... }: with lib; {
network.firewall.public.tcp.ports = singleton 3984; network.firewall.public.tcp.ports = singleton 3984;
network.extraCerts.domain-auth = "auth.${config.network.dns.domain}";
users.groups.domain-auth.members = [ "nginx" "glauth" ];
security.acme.certs.domain-auth.group = "domain-auth";
services.glauth = { services.glauth = {
enable = true; enable = true;
configFile = config.secrets.files.glauth-config-file.path; configFile = config.secrets.files.glauth-config-file.path;
@ -19,8 +23,8 @@
ldaps = { ldaps = {
enabled = true; enabled = true;
listen = "0.0.0.0:3894"; listen = "0.0.0.0:3894";
cert = "/var/lib/acme/auth.kittywit.ch/fullchain.pem"; cert = "/var/lib/acme/domain-auth/fullchain.pem";
key = "/var/lib/acme/auth.kittywit.ch/key.pem"; key = "/var/lib/acme/domain-auth/key.pem";
}; };
backend = { backend = {
baseDN = "dc=kittywitch,dc=com"; baseDN = "dc=kittywitch,dc=com";

2
config/services/keycloak/default.nix
View file

@ -29,7 +29,7 @@
}; };
services.nginx.virtualHosts."auth.${config.network.dns.domain}" = { services.nginx.virtualHosts."auth.${config.network.dns.domain}" = {
enableACME = true; useACMEHost = "domain-auth";
forceSSL = true; forceSSL = true;
locations = { "/".proxyPass = "http://127.0.0.1:8089"; }; locations = { "/".proxyPass = "http://127.0.0.1:8089"; };
}; };