gensokyo-zone/infrastructure
1
0
Fork 0
mirror of https://github.com/gensokyo-zone/infrastructure.git synced 2026-02-09 04:19:19 -08:00
Code Issues Projects Releases Packages Wiki Activity Actions

style: alejandra $(fd -e nix)

Browse source
This commit is contained in:
Kat Inskip 2024-03-13 15:08:42 -07:00
parent 97d9eecd3c
commit e63304937d
Signed by: kat
GPG key ID: 465E64DECEA8CF0F
91 changed files with 1422 additions and 1102 deletions
Download patch file Download diff file Expand all files Collapse all files

37
nixos/access/freeipa.nix
View file

@ -3,8 +3,7 @@
meta,
lib,
...
}:
let
}: let
inherit (lib.options) mkOption mkEnableOption;
inherit (lib.modules) mkIf mkMerge mkBefore mkDefault;
inherit (lib.strings) optionalString concatStringsSep;
@ -56,18 +55,22 @@ in {
type = str;
};
preread = {
enable = mkEnableOption "ssl preread" // {
default = true;
};
enable =
mkEnableOption "ssl preread"
// {
default = true;
};
port = mkOption {
type = port;
default = 444;
};
};
kerberos = {
enable = mkEnableOption "proxy kerberos" // {
default = true;
};
enable =
mkEnableOption "proxy kerberos"
// {
default = true;
};
ports = {
ticket = mkOption {
type = port;
@ -86,7 +89,10 @@ in {
proxyPass = mkOption {
type = str;
default = let
scheme = if access.port == 443 then "https" else "http";
scheme =
if access.port == 443
then "https"
else "http";
in "${scheme}://${access.host}:${toString access.port}";
};
domain = mkOption {
@ -130,7 +136,7 @@ in {
port = mkDefault access.ldapPort;
useACMEHost = mkDefault access.useACMEHost;
};
resolver.addresses = mkIf access.preread.enable [ "[::1]" "127.0.0.1:5353" ];
resolver.addresses = mkIf access.preread.enable ["[::1]" "127.0.0.1:5353"];
defaultSSLListenPort = mkIf access.preread.enable access.preread.port;
streamConfig = let
preread = ''
@ -174,10 +180,11 @@ in {
proxy_pass ${access.host}:${toString access.kerberos.ports.kpasswd};
}
'';
in mkMerge [
(mkIf access.preread.enable preread)
(mkIf access.kerberos.enable kerberos)
];
in
mkMerge [
(mkIf access.preread.enable preread)
(mkIf access.kerberos.enable kerberos)
];
virtualHosts = {
${access.domain} = {
inherit locations extraConfig;
@ -207,7 +214,7 @@ in {
local.enable = true;
inherit locations;
};
${ldap.domain} = { config, ... }: {
${ldap.domain} = {config, ...}: {
useACMEHost = mkDefault virtualHosts.${access.domain}.useACMEHost;
addSSL = mkDefault (config.useACMEHost != null);
globalRedirect = access.domain;