diff options
| author | Grisha Shipunov | 2026-07-26 20:32:54 +0000 |
|---|---|---|
| committer | Grisha Shipunov | 2026-08-01 19:00:44 +0000 |
| commit | cc89163f31ee00b1402b1ebf6070eda29d4c97f9 (patch) | |
| tree | 97acde7d124a4a6b35158eb58678b68ba92e919f | |
| parent | d1f771dd9eeb680cbd7ffef5a8667dae5bbb4837 (diff) | |
:authentik: yeet
| -rw-r--r-- | flake.lock | 325 | ||||
| -rw-r--r-- | flake.nix | 11 | ||||
| -rw-r--r-- | microvms/auth/authentik.nix | 17 | ||||
| -rw-r--r-- | microvms/auth/default.nix | 78 | ||||
| -rw-r--r-- | microvms/auth/secrets.yaml | 39 |
5 files changed, 27 insertions, 443 deletions
@@ -1,48 +1,5 @@ { "nodes": { - "authentik-nix": { - "inputs": { - "authentik-src": "authentik-src", - "flake-compat": "flake-compat", - "flake-parts": "flake-parts", - "flake-utils": "flake-utils", - "nixpkgs": "nixpkgs", - "pyproject-build-systems": "pyproject-build-systems", - "pyproject-nix": "pyproject-nix", - "systems": "systems", - "uv2nix": "uv2nix" - }, - "locked": { - "lastModified": 1785488913, - "narHash": "sha256-5kEMR7Pbaldsz5PBYJ6z5o1AxxdnWbGoDkFngl4SXFI=", - "owner": "nix-community", - "repo": "authentik-nix", - "rev": "d9a66712def0b044b86dc13f7a319641bbd2a34b", - "type": "github" - }, - "original": { - "owner": "nix-community", - "repo": "authentik-nix", - "type": "github" - } - }, - "authentik-src": { - "flake": false, - "locked": { - "lastModified": 1784731584, - "narHash": "sha256-/HdXzjjvuSW7zjbCNJKm3Fj8gvIwfrDf8mOYev0yuIg=", - "owner": "goauthentik", - "repo": "authentik", - "rev": "0c67ea476be6319f1b2a41cb0f5ed128af37b99b", - "type": "github" - }, - "original": { - "owner": "goauthentik", - "ref": "version/2026.5.6", - "repo": "authentik", - "type": "github" - } - }, "crane": { "locked": { "lastModified": 1781825982, @@ -63,22 +20,6 @@ "locked": { "lastModified": 1767039857, "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=", - "owner": "edolstra", - "repo": "flake-compat", - "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab", - "type": "github" - }, - "original": { - "owner": "edolstra", - "repo": "flake-compat", - "type": "github" - } - }, - "flake-compat_2": { - "flake": false, - "locked": { - "lastModified": 1767039857, - "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=", "owner": "NixOS", "repo": "flake-compat", "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab", @@ -90,63 +31,6 @@ "type": "github" } }, - "flake-parts": { - "inputs": { - "nixpkgs-lib": "nixpkgs-lib" - }, - "locked": { - "lastModified": 1782949081, - "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=", - "owner": "hercules-ci", - "repo": "flake-parts", - "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e", - "type": "github" - }, - "original": { - "owner": "hercules-ci", - "repo": "flake-parts", - "type": "github" - } - }, - "flake-utils": { - "inputs": { - "systems": [ - "authentik-nix", - "systems" - ] - }, - "locked": { - "lastModified": 1731533236, - "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=", - "owner": "numtide", - "repo": "flake-utils", - "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b", - "type": "github" - }, - "original": { - "owner": "numtide", - "repo": "flake-utils", - "type": "github" - } - }, - "flake-utils_2": { - "inputs": { - "systems": "systems_2" - }, - "locked": { - "lastModified": 1731533236, - "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=", - "owner": "numtide", - "repo": "flake-utils", - "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b", - "type": "github" - }, - "original": { - "owner": "numtide", - "repo": "flake-utils", - "type": "github" - } - }, "gitignore": { "inputs": { "nixpkgs": [ @@ -201,11 +85,11 @@ "spectrum": "spectrum" }, "locked": { - "lastModified": 1785486846, - "narHash": "sha256-bWmnG2nQJe05AReeeJo5WVA3dqGwTeh7N8+sWivrO1Y=", + "lastModified": 1784666190, + "narHash": "sha256-xgfS6slV7J3baMooNN1UuBi51RIgg9y0DbCxfSA0668=", "owner": "microvm-nix", "repo": "microvm.nix", - "rev": "c103a89f25e6d2c98cee242474fe6867d3266677", + "rev": "fa5340ac684cdce8a22b6d4a0bcebb0cc999275e", "type": "github" }, "original": { @@ -216,14 +100,14 @@ }, "nixos-hardware": { "inputs": { - "nixpkgs": "nixpkgs_2" + "nixpkgs": "nixpkgs" }, "locked": { - "lastModified": 1785232496, - "narHash": "sha256-65EQYIRRpTdpH8lUiB6Mvo5uBkG60aBIzAJuALfx+O0=", + "lastModified": 1784723954, + "narHash": "sha256-1CfD8ZUjCkTgjsneLZ/lxCHhgDfqxxE7/GX0MmsgiqA=", "owner": "NixOS", "repo": "nixos-hardware", - "rev": "2e790b0a6be8ec2b76174ac0931b8ff11919ec98", + "rev": "a017f5b72210026af5b3ac5949f08d94380a6fbd", "type": "github" }, "original": { @@ -235,68 +119,37 @@ }, "nixpkgs": { "locked": { - "lastModified": 1785090369, - "narHash": "sha256-m0pDuRJG7EDo9ri+4Ksu83VsI+PlxNC9lNBfydejce4=", - "owner": "NixOS", - "repo": "nixpkgs", - "rev": "624af665418d3c65d544145b4d34ad696439570e", - "type": "github" - }, - "original": { - "owner": "NixOS", - "ref": "nixos-unstable", - "repo": "nixpkgs", - "type": "github" - } - }, - "nixpkgs-lib": { - "locked": { - "lastModified": 1782614948, - "narHash": "sha256-ePjCwr1sNm9NYUqywL7QfK3JnlS015msC+eBu2zKlp8=", - "owner": "nix-community", - "repo": "nixpkgs.lib", - "rev": "db3f255737b94216eb71cce308e2912cf6bc2d7c", - "type": "github" - }, - "original": { - "owner": "nix-community", - "repo": "nixpkgs.lib", - "type": "github" - } - }, - "nixpkgs-unstable": { - "locked": { - "lastModified": 1785454630, - "narHash": "sha256-Lr/ImHlbXabw7KPWfXWY4kkiiHb24PkmBZVVIm28V/c=", - "rev": "1559d3daa3ecc813a650b79375ea61b6741b8746", + "lastModified": 1767892417, + "narHash": "sha256-8bW3q88CEg2u4hSP66Vf4lpbLonHz7hqDNBMcCY7E9U=", + "rev": "3497aa5c9457a9d88d71fa93a4a8368816fbeeba", "type": "tarball", - "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1044798.1559d3daa3ec/nixexprs.tar.xz" + "url": "https://releases.nixos.org/nixos/unstable/nixos-26.05pre924538.3497aa5c9457/nixexprs.tar.xz" }, "original": { "type": "tarball", "url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz" } }, - "nixpkgs_2": { + "nixpkgs-unstable": { "locked": { - "lastModified": 1767892417, - "narHash": "sha256-8bW3q88CEg2u4hSP66Vf4lpbLonHz7hqDNBMcCY7E9U=", - "rev": "3497aa5c9457a9d88d71fa93a4a8368816fbeeba", + "lastModified": 1784796856, + "narHash": "sha256-vwxWgF+Gj276WznzGb1LxGsK/39HaQwgQXiU3EkC844=", + "rev": "e2587caef70cea85dd97d7daab492899902dbf5d", "type": "tarball", - "url": "https://releases.nixos.org/nixos/unstable/nixos-26.05pre924538.3497aa5c9457/nixexprs.tar.xz" + "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1040357.e2587caef70c/nixexprs.tar.xz" }, "original": { "type": "tarball", "url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz" } }, - "nixpkgs_3": { + "nixpkgs_2": { "locked": { - "lastModified": 1785386831, - "narHash": "sha256-xQPrEWR75P2lZ/p9pAzIeMd4PtkckDLj6ojo+tWjZQw=", - "rev": "21ea275a7c46aef9d4d6ddc962e6d562e9d94183", + "lastModified": 1784856561, + "narHash": "sha256-/HjbyQqfFs3cG7o/zJ25RPaLZqS9a88z6vOGhMoZwRs=", + "rev": "597283ad8aa0b331c788e97c4c262d58877074ef", "type": "tarball", - "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.6503.21ea275a7c46/nixexprs.tar.xz" + "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.5984.597283ad8aa0/nixexprs.tar.xz" }, "original": { "type": "tarball", @@ -305,7 +158,7 @@ }, "pre-commit": { "inputs": { - "flake-compat": "flake-compat_2", + "flake-compat": "flake-compat", "gitignore": "gitignore", "nixpkgs": [ "lanzaboote", @@ -326,67 +179,14 @@ "type": "github" } }, - "pyproject-build-systems": { - "inputs": { - "nixpkgs": [ - "authentik-nix", - "nixpkgs" - ], - "pyproject-nix": [ - "authentik-nix", - "pyproject-nix" - ], - "uv2nix": [ - "authentik-nix", - "uv2nix" - ] - }, - "locked": { - "lastModified": 1785115949, - "narHash": "sha256-8AM37BfyGaL2v/SZyg4PupRxJ01Y4htvM+WrTjWrPpo=", - "owner": "pyproject-nix", - "repo": "build-system-pkgs", - "rev": "62c0d86027edb1c4f39a5facc09876348144f7c9", - "type": "github" - }, - "original": { - "owner": "pyproject-nix", - "repo": "build-system-pkgs", - "type": "github" - } - }, - "pyproject-nix": { - "inputs": { - "nixpkgs": [ - "authentik-nix", - "nixpkgs" - ] - }, - "locked": { - "lastModified": 1784591072, - "narHash": "sha256-zP/WaDxrRu8GANZM61+V2LT/7ycEEdoyLWn7M6WzU7M=", - "owner": "pyproject-nix", - "repo": "pyproject.nix", - "rev": "e3b599ca2e7fcf93d4edf65d7f19bbf6491724f3", - "type": "github" - }, - "original": { - "owner": "pyproject-nix", - "repo": "pyproject.nix", - "type": "github" - } - }, "root": { "inputs": { - "authentik-nix": "authentik-nix", - "flake-utils": "flake-utils_2", "lanzaboote": "lanzaboote", "microvm": "microvm", "nixos-hardware": "nixos-hardware", - "nixpkgs": "nixpkgs_3", + "nixpkgs": "nixpkgs_2", "nixpkgs-unstable": "nixpkgs-unstable", "sops-nix": "sops-nix", - "tmux-yank": "tmux-yank", "website": "website" } }, @@ -447,85 +247,14 @@ "url": "https://spectrum-os.org/git/spectrum" } }, - "systems": { - "locked": { - "lastModified": 1689347949, - "narHash": "sha256-12tWmuL2zgBgZkdoB6qXZsgJEH9LR3oUgpaQq2RbI80=", - "owner": "nix-systems", - "repo": "default-linux", - "rev": "31732fcf5e8fea42e59c2488ad31a0e651500f68", - "type": "github" - }, - "original": { - "owner": "nix-systems", - "repo": "default-linux", - "type": "github" - } - }, - "systems_2": { - "locked": { - "lastModified": 1681028828, - "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", - "owner": "nix-systems", - "repo": "default", - "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", - "type": "github" - }, - "original": { - "owner": "nix-systems", - "repo": "default", - "type": "github" - } - }, - "tmux-yank": { - "flake": false, - "locked": { - "lastModified": 1689770565, - "narHash": "sha256-/5HPaoOx2U2d8lZZJo5dKmemu6hKgHJYq23hxkddXpA=", - "owner": "tmux-plugins", - "repo": "tmux-yank", - "rev": "acfd36e4fcba99f8310a7dfb432111c242fe7392", - "type": "github" - }, - "original": { - "owner": "tmux-plugins", - "repo": "tmux-yank", - "type": "github" - } - }, - "uv2nix": { - "inputs": { - "nixpkgs": [ - "authentik-nix", - "nixpkgs" - ], - "pyproject-nix": [ - "authentik-nix", - "pyproject-nix" - ] - }, - "locked": { - "lastModified": 1785147819, - "narHash": "sha256-udwe836AZe8BYU+YqVc51QLuOeWKoGEmPIMF0ImUfTQ=", - "owner": "pyproject-nix", - "repo": "uv2nix", - "rev": "0983f54345137c2dd528ce2c28cb56c2cbdceb2a", - "type": "github" - }, - "original": { - "owner": "pyproject-nix", - "repo": "uv2nix", - "type": "github" - } - }, "website": { "flake": false, "locked": { - "lastModified": 1785506714, - "narHash": "sha256-7Zk2FFyvVp7/8UpXj46sMHCOo7PC3mjoi43jSozWhhk=", + "lastModified": 1783249380, + "narHash": "sha256-7ZDaGKok/PgLZt3GcA5GCtzkKwCFAQc9lgwvP7W2UcM=", "ref": "refs/heads/main", - "rev": "1b7746fb6d1e84b2f0a73d3d819a2721023190ec", - "revCount": 4, + "rev": "e23b89512dba31a8c37854d9586cf8036aa55eb0", + "revCount": 3, "type": "git", "url": "https://git.oxapentane.com/website.git" }, @@ -4,7 +4,6 @@ # nixpkgs-unstable.url = "github:gshipunov/nixpkgs?ref=nixos-unstable"; nixpkgs.url = "https://channels.nixos.org/nixos-26.05/nixexprs.tar.xz"; - flake-utils.url = "github:numtide/flake-utils"; sops-nix = { url = "github:Mic92/sops-nix"; @@ -24,19 +23,10 @@ inputs.nixpkgs.follows = "nixpkgs-unstable"; }; - authentik-nix = { - url = "github:nix-community/authentik-nix"; - }; - website = { url = "git+https://git.oxapentane.com/website.git"; flake = false; }; - - tmux-yank = { - url = "github:tmux-plugins/tmux-yank"; - flake = false; - }; }; outputs = @@ -60,7 +50,6 @@ "cgit" ]; microvm-unstable-list = [ - "auth" "immich" ]; diff --git a/microvms/auth/authentik.nix b/microvms/auth/authentik.nix deleted file mode 100644 index a1257ee..0000000 --- a/microvms/auth/authentik.nix +++ /dev/null @@ -1,17 +0,0 @@ -{ config, inputs, ... }: -{ - imports = [ - inputs.authentik-nix.nixosModules.default - ]; - sops.secrets."authentik/env" = { }; - services.authentik = { - enable = true; - environmentFile = config.sops.secrets."authentik/env".path; - settings = { - log_level = "debug"; - disable_startup_analytics = true; - avatars = "initials"; - postgresql.host = "/run/postgresql"; - }; - }; -} diff --git a/microvms/auth/default.nix b/microvms/auth/default.nix deleted file mode 100644 index 734ef43..0000000 --- a/microvms/auth/default.nix +++ /dev/null @@ -1,78 +0,0 @@ -{ config, lib, ... }: -let - mac = "02:00:00:00:00:01"; -in -{ - imports = [ - ./authentik.nix - ]; - sops.defaultSopsFile = ./secrets.yaml; - sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; - - sops.secrets = { - "wg/0xa-proxy" = { - owner = config.users.users.systemd-network.name; - }; - }; - - microvm = { - hypervisor = "cloud-hypervisor"; - vsock.cid = 3 + 1; - mem = 2 * 1024; - vcpu = 2; - interfaces = [ - { - type = "tap"; - id = "uvm-auth"; - mac = mac; - } - ]; - shares = [ - { - source = "/nix/store"; - mountPoint = "/nix/.ro-store"; - tag = "store"; - proto = "virtiofs"; - socket = "store.socket"; - } - ] - ++ - map - (dir: { - source = dir; - mountPoint = "/${dir}"; - tag = dir; - proto = "virtiofs"; - socket = "${dir}.socket"; - }) - [ - "etc" - "var" - "home" - ]; - }; - - networking.useNetworkd = true; - networking.firewall.enable = lib.mkForce false; # firewalling done by the host - - systemd.network = { - enable = true; - networks."11-host" = { - matchConfig.MACAddress = mac; - networkConfig = { - Address = "10.99.99.11/24"; - DHCP = "no"; - }; - routes = [ - { - Gateway = "10.99.99.1"; - Destination = "0.0.0.0/0"; - Metric = 1024; - } - ]; - }; - }; - - networking.hostName = "auth"; - system.stateVersion = "24.11"; -} diff --git a/microvms/auth/secrets.yaml b/microvms/auth/secrets.yaml deleted file mode 100644 index 87d2f31..0000000 --- a/microvms/auth/secrets.yaml +++ /dev/null @@ -1,39 +0,0 @@ -authentik: - env: ENC[AES256_GCM,data:XNA4bZPi9yzHrUXOIs18i9LnlsG2/jGBKgc9zPN/3ECzvvX1Q1eejKG657PgOIvuDkqyNdn4cD7iYEl8q4vX45BMb7+hCqKm5eCuOlf2z8HeqU7Jmvh+++92RIyLiv2D9LIWDIBY,iv:J3eXfDZHmxK+10uMJu6hGUEwXSTMKt/M4fsaoJr7eL4=,tag:98swY3PkL//2mCPcHZjp1A==,type:str] -wg: - 0xa-proxy: ENC[AES256_GCM,data:q6vpJZy1Cb54MhMRj0nm8QEX1a38S7Adxymex6gMtwkA6A9V3nLTHPfdJAc=,iv:EsRkUqrpUXoFVkZ8SGE2jp22SeqTlvBx8OTBCRxOjDA=,tag:JLv73iYYV6ZvJiODQOqfEQ==,type:str] -sops: - age: - - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJl9iYG5oHBq/poBn7Jf1/FGWWbAnbx+NKjs7qtT3uAK - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IHowb2lXdyBkSkFE - NXBuRDFSM2VPMThnUm5GUFE1dGMvc2lOZllEVlpxeEtWOVl0TWl3CnNzdzdwa281 - QjlDcEYwQ2sybllRSnBOSDZiNE9manVNTGN6bzAxMkpka0UKLS0tIGRnVXRreENQ - QXE3STV3dk9vWTU5RldTRGRvSXhlMjZobHk3YUMvZmoraHcKVzGIc+T5EJFC5tPl - W2xBG90+KNHicTX/OkUg2qnUq3Kdbb4DVda/rYIfpjq5NzHP6G7csJvJYhVheive - wWGaYQ== - -----END AGE ENCRYPTED FILE----- - - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAXrwZsBChUhVuF5gFEfj8GwQlnrqEttAytS5jVCfuE4 0xa@frituurpan - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFlJOElMUSBtSGRU - TG4wMUVrSEpwRi9PZS9xRExEN2d0SkZLKy9XVHJRVFp2SzhWTDAwCllHczFyVnc1 - eW9HMVRJTkh6M09JbzNnRGcxNjFuYnkyWUd5ZWRRL09YbFkKLS0tIHR4OWFnZGdY - WGMvdld3clZlUUZTa3l4VUcxN0NxVVZ5MnhuV0NEZHhnYjQKOcL30dTkKrxUAPWY - eJF58GBz4FPMJz2MDUj8UmO2IXQciV45nXSRrMXO0KspXr33N5fRKQcg2NH80wdV - iaiVrA== - -----END AGE ENCRYPTED FILE----- - - recipient: age1vzwz5s35w9g8ck9l5zaq5skrnl3mqzf3hsnc9w22sj4k8tu8kqfstpg2a8 - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByNXAxSDk3dVNRK01VdnZt - TDZWWVRFZmtzUzN3Nkh3azllRWhDenhRdDFjCjR1VnFGcWYybFhpME9pODh6OFFk - OUJLWTRvSFlKMEFzTEp3eHhoRXc2eUEKLS0tIFJIcXFCbTRVRUFsR05EaGJrS214 - V2puZzZ4djZrMTRzZzdSL2c0aHpGd2cKAGr3Gac1BcKlmpYG9S1m7RgAsEZEFvHN - 8Uf40hHABXEKB1LXo7D8CxxLWTU+w4LOLAblaG1Rcp/mM6NYvmxhFA== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2025-01-21T00:19:40Z" - mac: ENC[AES256_GCM,data:oqKBofuW0pUMjQ5vvKSj/DO4AqkZTRoDuD/KahzI9Q20Jyoj0lNTzxh872ngWdKhIizoB3yiWW9GUS0zWp8rj1yzwFmvvNXBnk2sWHbskDFIEgfom6jfmz7csmXQXaU0kFNEmTvyxnsTrhvdcETO6lZBTooFN955ECrcoxspsbA=,iv:JU7AtvTluophE0IIZJJiVvdpctxzkaWLFGwUWFcufvM=,tag:ro6Kf8QaFJq7wWtx9oOWBA==,type:str] - unencrypted_suffix: _unencrypted - version: 3.9.3 |
