gensokyo-zone/infrastructure
1
0
Fork 0
mirror of https://github.com/gensokyo-zone/infrastructure.git synced 2026-02-09 12:29:19 -08:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat(hakurei): kanidm access

Browse source
This commit is contained in:
arcnmx 2024-01-23 11:54:59 -08:00
parent a8cd175500
commit b85e850dd6
10 changed files with 322 additions and 35 deletions
Download patch file Download diff file Expand all files Collapse all files

64
systems/hakurei/nixos.nix
View file

@ -1,9 +1,14 @@
{
config,
meta,
lib,
access,
...
}: {
}: let
inherit (lib.modules) mkIf mkMerge;
mediabox = access.systemFor "mediabox";
tei = access.systemFor "tei";
in {
imports = let
inherit (meta) nixos;
in [
@ -12,7 +17,10 @@
nixos.reisen-ct
nixos.tailscale
nixos.cloudflared
nixos.acme
nixos.nginx
nixos.access.global
nixos.access.kanidm
nixos.access.proxmox
nixos.access.plex
];
@ -33,10 +41,56 @@
};
};
services.nginx.access = {
plex.url = let
system = access.systemFor "mediabox";
in "http://${system.networking.access.hostnameForNetwork.local}:32400";
security.acme.certs = let
inherit (config.services) nginx;
inherit (nginx) access;
in {
${access.kanidm.domain} = {
inherit (nginx) group;
extraDomainNames = mkMerge [
[ access.kanidm.localDomain ]
(mkIf config.services.tailscale.enable [ access.kanidm.tailDomain ])
];
};
${access.proxmox.domain} = {
inherit (nginx) group;
extraDomainNames = mkMerge [
[ access.proxmox.localDomain ]
(mkIf config.services.tailscale.enable [ access.proxmox.tailDomain ])
];
};
${access.plex.domain} = {
inherit (nginx) group;
extraDomainNames = [ access.plex.localDomain ];
};
};
services.nginx = let
inherit (config.services.nginx) access;
inherit (mediabox.services) plex;
inherit (tei.services) kanidm;
in {
access.plex = assert plex.enable; {
url = "http://${mediabox.networking.access.hostnameForNetwork.local}:32400";
};
access.kanidm = assert kanidm.enableServer; {
domain = kanidm.server.frontend.domain;
host = tei.networking.access.hostnameForNetwork.local;
port = kanidm.server.frontend.port;
ldapPort = kanidm.server.ldap.port;
};
virtualHosts = {
${access.kanidm.domain} = {
useACMEHost = access.kanidm.domain;
};
${access.proxmox.domain} = {
useACMEHost = access.proxmox.domain;
};
${access.plex.domain} = {
addSSL = true;
useACMEHost = access.plex.domain;
};
};
};
systemd.network.networks.eth0 = {