1 files changed, 68 insertions, 0 deletions
diff --git a/microvms/kanidm/kanidm.nix b/microvms/kanidm/kanidm.nix
new file mode 100644
index 0000000..6844741
--- /dev/null
+++ b/microvms/kanidm/kanidm.nix
@@ -0,0 +1,68 @@
+{ pkgs, config, ... }:
+let
+  domain = "idm.oxapentane.com";
+  kanidm-ip = "10.89.88.20";
+  proxy-ip = "10.89.88.1";
+in
+{
+  # mythic beasts cert
+  sops.secrets = {
+    "mythicbeasts-acme/api-id" = { mode = "0400"; };
+    "mythicbeasts-acme/api-secret" = { mode = "0400"; };
+  };
+
+  security.acme = {
+    acceptTerms = true;
+
+    certs.${domain} = {
+      dnsProvider = "mythicbeasts";
+      credentialFiles = {
+        MYTHICBEASTS_USERNAME_FILE = config.sops.secrets."mythicbeasts-acme/api-id".path;
+        MYTHICBEASTS_PASSWORD_FILE = config.sops.secrets."mythicbeasts-acme/api-secret".path;
+      };
+      group = "kanidm";
+      reloadServices = [
+        "kanidm.service"
+      ];
+    };
+  };
+
+  # make sure cert exists before starting kanidm
+  systemd.services.kanidm = {
+    requires = [
+      "acme-${domain}.service"
+    ];
+    after = [
+      "acme-${domain}.service"
+    ];
+  };
+
+  services.kanidm = {
+    package = pkgs.kanidm_1_10;
+    server = {
+      enable = true;
+      settings = {
+        bindaddress = "${kanidm-ip}:8443";
+        domain = domain;
+        origin = "https://${domain}";
+        tls_chain = "/var/lib/acme/${domain}/fullchain.pem";
+        tls_key = "/var/lib/acme/${domain}/key.pem";
+        http_client_address_info = {
+          "x-forward-for" = [
+            proxy-ip
+          ];
+        };
+
+        online_backup = {
+          path = "/var/lib/kanidm/backups";
+          schedule = "00 03 * * *";
+          versions = 31;
+        };
+      };
+    };
+    client = {
+      enable = true;
+      settings.uri = "https://${domain}";
+    };
+  };
+}