gensokyo-zone/infrastructure
1
0
Fork 0
mirror of https://github.com/gensokyo-zone/infrastructure.git synced 2026-02-09 12:29:19 -08:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix(vouch): local access

Browse source
This commit is contained in:
arcnmx 2024-03-22 14:02:17 -07:00
parent 34bca016b4
commit b16d6faee7
8 changed files with 110 additions and 193 deletions
Download patch file Download diff file Expand all files Collapse all files

46
nixos/access/vouch.nix
View file

@ -3,40 +3,31 @@
lib,
...
}: let
inherit (lib.options) mkOption;
inherit (lib.modules) mkIf mkMerge mkDefault mkOptionDefault;
inherit (config) networking;
inherit (config.services) tailscale nginx;
cfg = config.services.vouch-proxy;
access = nginx.access.vouch;
in {
options.services.nginx.access.vouch = with lib.types; {
url = mkOption {
type = str;
};
};
config.services.nginx = {
access.vouch = mkIf cfg.enable {
url = let
virtualHosts = let
localVouchUrl = let
inherit (cfg.settings.vouch) listen;
host =
if listen == "0.0.0.0" || listen == "[::]"
then "localhost"
else listen;
in
mkOptionDefault "http://${host}:${toString cfg.settings.vouch.port}";
};
virtualHosts = let
"http://${host}:${toString cfg.settings.vouch.port}";
locations = {
"/" = {
proxyPass = mkDefault access.url;
extraConfig = ''
proxy_redirect default;
set $x_proxy_host $x_forwarded_host;
'';
};
"/validate" = {config, ...}: {
"/validate" = {config, virtualHost, ...}: {
proxied.enable = true;
proxyPass = mkDefault (access.url + "/validate");
proxyPass = mkDefault (virtualHost.locations."/".proxyPass + "/validate");
proxy.headers.enableRecommended = true;
local.denyGlobal = true;
extraConfig = ''
@ -44,7 +35,7 @@ in {
'';
};
};
localLocations = kanidmDomain: mkIf nginx.vouch.localSso.enable {
localLocations = kanidmDomain: mkIf (nginx.vouch.localSso.enable && false) {
"/" = {
proxied.xvars.enable = true;
extraConfig = ''
@ -55,14 +46,25 @@ in {
name.shortServer = mkDefault "login";
in {
vouch = {
inherit name locations;
inherit name;
serverAliases = [ nginx.vouch.doubleProxy.serverName ];
proxied.enable = true;
local.denyGlobal = true;
locations = mkMerge [
locations
{
"/".proxyPass = mkIf cfg.enable (mkDefault localVouchUrl);
}
];
ssl.force = true;
};
vouch'local = {
name = {
inherit (name) shortServer;
includeTailscale = false;
includeTailscale = mkDefault false;
};
serverAliases = mkIf cfg.enable [ nginx.vouch.doubleProxy.localServerName ];
proxied.enable = true;
local.enable = true;
ssl = {
force = true;
@ -70,11 +72,14 @@ in {
};
locations = mkMerge [
locations
{
"/".proxyPass = mkDefault nginx.virtualHosts.vouch.locations."/".proxyPass;
}
(localLocations "sso.local.${networking.domain}")
];
};
vouch'tail = {
enable = mkDefault tailscale.enable;
enable = mkDefault (tailscale.enable && !nginx.virtualHosts.vouch'local.name.includeTailscale);
ssl.cert.copyFromVhost = "vouch'local";
name = {
inherit (name) shortServer;
@ -83,6 +88,9 @@ in {
local.enable = true;
locations = mkMerge [
locations
{
"/".proxyPass = mkDefault nginx.virtualHosts.vouch'local.locations."/".proxyPass;
}
(localLocations "sso.tail.${networking.domain}")
];
};