diff options
| -rw-r--r-- | flake.nix | 1 | ||||
| -rw-r--r-- | hosts/cloud/proxy/default.nix | 10 | ||||
| -rw-r--r-- | microvms/kanidm/default.nix | 28 | ||||
| -rw-r--r-- | microvms/kanidm/kanidm.nix | 68 | ||||
| -rw-r--r-- | modules/wg/mgmt.nix | 8 | ||||
| -rw-r--r-- | modules/wg/proxy.nix | 8 |
6 files changed, 122 insertions, 1 deletions
@@ -48,6 +48,7 @@ "miniflux" "stream" "cgit" + "kanidm" ]; microvm-unstable-list = [ "immich" diff --git a/hosts/cloud/proxy/default.nix b/hosts/cloud/proxy/default.nix index 35cd9c3..555a124 100644 --- a/hosts/cloud/proxy/default.nix +++ b/hosts/cloud/proxy/default.nix @@ -38,7 +38,15 @@ in }; virtualHosts."auth.oxapentane.com".extraConfig = '' - respond "Temporary unavailable due to maintenance" 503 + respond "Not Found" 404 + ''; + + virtualHosts."idm.oxapentane.com".extraConfig = '' + reverse_proxy https://10.89.88.20:8443 { + transport http { + tls_server_name idm.oxapentane.com + } + } ''; virtualHosts."immich.oxapentane.com".extraConfig = '' diff --git a/microvms/kanidm/default.nix b/microvms/kanidm/default.nix new file mode 100644 index 0000000..13a837b --- /dev/null +++ b/microvms/kanidm/default.nix @@ -0,0 +1,28 @@ +{ config, ... }: +{ + imports = [ + ../lib + ./kanidm.nix + ]; + + oxalab.vm.number = 10; + + networking.hostName = "kanidm"; + system.stateVersion = "26.05"; + + sops.secrets = { + "wg/0xa-proxy" = { + owner = config.users.users.systemd-network.name; + }; + "wg/0xa-mgmt" = { + owner = config.users.users.systemd-network.name; + }; + }; + + + microvm = { + mem = 1 * 1024; + vcpu = 2; + }; + +} diff --git a/microvms/kanidm/kanidm.nix b/microvms/kanidm/kanidm.nix new file mode 100644 index 0000000..6844741 --- /dev/null +++ b/microvms/kanidm/kanidm.nix @@ -0,0 +1,68 @@ +{ pkgs, config, ... }: +let + domain = "idm.oxapentane.com"; + kanidm-ip = "10.89.88.20"; + proxy-ip = "10.89.88.1"; +in +{ + # mythic beasts cert + sops.secrets = { + "mythicbeasts-acme/api-id" = { mode = "0400"; }; + "mythicbeasts-acme/api-secret" = { mode = "0400"; }; + }; + + security.acme = { + acceptTerms = true; + + certs.${domain} = { + dnsProvider = "mythicbeasts"; + credentialFiles = { + MYTHICBEASTS_USERNAME_FILE = config.sops.secrets."mythicbeasts-acme/api-id".path; + MYTHICBEASTS_PASSWORD_FILE = config.sops.secrets."mythicbeasts-acme/api-secret".path; + }; + group = "kanidm"; + reloadServices = [ + "kanidm.service" + ]; + }; + }; + + # make sure cert exists before starting kanidm + systemd.services.kanidm = { + requires = [ + "acme-${domain}.service" + ]; + after = [ + "acme-${domain}.service" + ]; + }; + + services.kanidm = { + package = pkgs.kanidm_1_10; + server = { + enable = true; + settings = { + bindaddress = "${kanidm-ip}:8443"; + domain = domain; + origin = "https://${domain}"; + tls_chain = "/var/lib/acme/${domain}/fullchain.pem"; + tls_key = "/var/lib/acme/${domain}/key.pem"; + http_client_address_info = { + "x-forward-for" = [ + proxy-ip + ]; + }; + + online_backup = { + path = "/var/lib/kanidm/backups"; + schedule = "00 03 * * *"; + versions = 31; + }; + }; + }; + client = { + enable = true; + settings.uri = "https://${domain}"; + }; + }; +} diff --git a/modules/wg/mgmt.nix b/modules/wg/mgmt.nix index 7166666..ef3dc00 100644 --- a/modules/wg/mgmt.nix +++ b/modules/wg/mgmt.nix @@ -55,6 +55,14 @@ publicKey = "zN2Dr/ZGMh1Ftparszp22Qnbz2ISJU12iDVatebOHUE="; privateKeyFile = config.sops.secrets."wg/0xa-mgmt".path; }; + "kanidm" = { + address = [ + "10.89.87.11/24" + "fd31:185d:722e::11/48" + ]; + publicKey = "n3t6ImxSiEivxQzXXqLZZBxgyDOw/y8P4pvLglkfHWI="; + privateKeyFile = config.sops.secrets."wg/0xa-mgmt".path; + }; }; } ]; diff --git a/modules/wg/proxy.nix b/modules/wg/proxy.nix index ada0a8e..3e40b40 100644 --- a/modules/wg/proxy.nix +++ b/modules/wg/proxy.nix @@ -79,6 +79,14 @@ publicKey = "E9cs2Lq5hsBkz5UoUviJEf22pF0EpX6IYGm9L8D7QDc="; privateKeyFile = config.sops.secrets."wg/0xa-proxy".path; }; + "kanidm" = { + address = [ + "10.89.88.20/24" + "fd31:185d:722f::20/48" + ]; + publicKey = "eLw320v+OzITi6DyYi9sEvAHN75VYO8S4ysSH4ggG34="; + privateKeyFile = config.sops.secrets."wg/0xa-proxy".path; + }; }; } ]; |