From 36268a51b81bad88aedb40dac55582be945fc3ab Mon Sep 17 00:00:00 2001
From: Grisha Shipunov
Date: Sun, 2 Aug 2026 11:07:55 +0000
Subject: kanidm: init

---
 flake.nix                     |  1 +
 hosts/cloud/proxy/default.nix | 10 ++++++-
 microvms/kanidm/default.nix   | 28 ++++++++++++++++++
 microvms/kanidm/kanidm.nix    | 68 +++++++++++++++++++++++++++++++++++++++++++
 modules/wg/mgmt.nix           |  8 +++++
 modules/wg/proxy.nix          |  8 +++++
 6 files changed, 122 insertions(+), 1 deletion(-)
 create mode 100644 microvms/kanidm/default.nix
 create mode 100644 microvms/kanidm/kanidm.nix

diff --git a/flake.nix b/flake.nix
index f80186e..543f166 100644
--- a/flake.nix
+++ b/flake.nix
@@ -48,6 +48,7 @@
             "miniflux"
             "stream"
             "cgit"
+            "kanidm"
           ];
           microvm-unstable-list = [
             "immich"
diff --git a/hosts/cloud/proxy/default.nix b/hosts/cloud/proxy/default.nix
index 35cd9c3..555a124 100644
--- a/hosts/cloud/proxy/default.nix
+++ b/hosts/cloud/proxy/default.nix
@@ -38,7 +38,15 @@ in
     };
 
     virtualHosts."auth.oxapentane.com".extraConfig = ''
-      respond "Temporary unavailable due to maintenance" 503
+      respond "Not Found" 404
+    '';
+
+    virtualHosts."idm.oxapentane.com".extraConfig = ''
+      reverse_proxy https://10.89.88.20:8443 {
+        transport http {
+          tls_server_name idm.oxapentane.com
+        }
+      }
     '';
 
     virtualHosts."immich.oxapentane.com".extraConfig = ''
diff --git a/microvms/kanidm/default.nix b/microvms/kanidm/default.nix
new file mode 100644
index 0000000..13a837b
--- /dev/null
+++ b/microvms/kanidm/default.nix
@@ -0,0 +1,28 @@
+{ config, ... }:
+{
+  imports = [
+    ../lib
+    ./kanidm.nix
+  ];
+
+  oxalab.vm.number = 10;
+
+  networking.hostName = "kanidm";
+  system.stateVersion = "26.05";
+
+  sops.secrets = {
+    "wg/0xa-proxy" = {
+      owner = config.users.users.systemd-network.name;
+    };
+    "wg/0xa-mgmt" = {
+      owner = config.users.users.systemd-network.name;
+    };
+  };
+
+
+  microvm = {
+    mem = 1 * 1024;
+    vcpu = 2;
+  };
+
+}
diff --git a/microvms/kanidm/kanidm.nix b/microvms/kanidm/kanidm.nix
new file mode 100644
index 0000000..6844741
--- /dev/null
+++ b/microvms/kanidm/kanidm.nix
@@ -0,0 +1,68 @@
+{ pkgs, config, ... }:
+let
+  domain = "idm.oxapentane.com";
+  kanidm-ip = "10.89.88.20";
+  proxy-ip = "10.89.88.1";
+in
+{
+  # mythic beasts cert
+  sops.secrets = {
+    "mythicbeasts-acme/api-id" = { mode = "0400"; };
+    "mythicbeasts-acme/api-secret" = { mode = "0400"; };
+  };
+
+  security.acme = {
+    acceptTerms = true;
+
+    certs.${domain} = {
+      dnsProvider = "mythicbeasts";
+      credentialFiles = {
+        MYTHICBEASTS_USERNAME_FILE = config.sops.secrets."mythicbeasts-acme/api-id".path;
+        MYTHICBEASTS_PASSWORD_FILE = config.sops.secrets."mythicbeasts-acme/api-secret".path;
+      };
+      group = "kanidm";
+      reloadServices = [
+        "kanidm.service"
+      ];
+    };
+  };
+
+  # make sure cert exists before starting kanidm
+  systemd.services.kanidm = {
+    requires = [
+      "acme-${domain}.service"
+    ];
+    after = [
+      "acme-${domain}.service"
+    ];
+  };
+
+  services.kanidm = {
+    package = pkgs.kanidm_1_10;
+    server = {
+      enable = true;
+      settings = {
+        bindaddress = "${kanidm-ip}:8443";
+        domain = domain;
+        origin = "https://${domain}";
+        tls_chain = "/var/lib/acme/${domain}/fullchain.pem";
+        tls_key = "/var/lib/acme/${domain}/key.pem";
+        http_client_address_info = {
+          "x-forward-for" = [
+            proxy-ip
+          ];
+        };
+
+        online_backup = {
+          path = "/var/lib/kanidm/backups";
+          schedule = "00 03 * * *";
+          versions = 31;
+        };
+      };
+    };
+    client = {
+      enable = true;
+      settings.uri = "https://${domain}";
+    };
+  };
+}
diff --git a/modules/wg/mgmt.nix b/modules/wg/mgmt.nix
index 7166666..ef3dc00 100644
--- a/modules/wg/mgmt.nix
+++ b/modules/wg/mgmt.nix
@@ -55,6 +55,14 @@
           publicKey = "zN2Dr/ZGMh1Ftparszp22Qnbz2ISJU12iDVatebOHUE=";
           privateKeyFile = config.sops.secrets."wg/0xa-mgmt".path;
         };
+        "kanidm" = {
+          address = [
+            "10.89.87.11/24"
+            "fd31:185d:722e::11/48"
+          ];
+          publicKey = "n3t6ImxSiEivxQzXXqLZZBxgyDOw/y8P4pvLglkfHWI=";
+          privateKeyFile = config.sops.secrets."wg/0xa-mgmt".path;
+        };
       };
     }
   ];
diff --git a/modules/wg/proxy.nix b/modules/wg/proxy.nix
index ada0a8e..3e40b40 100644
--- a/modules/wg/proxy.nix
+++ b/modules/wg/proxy.nix
@@ -79,6 +79,14 @@
           publicKey = "E9cs2Lq5hsBkz5UoUviJEf22pF0EpX6IYGm9L8D7QDc=";
           privateKeyFile = config.sops.secrets."wg/0xa-proxy".path;
         };
+        "kanidm" = {
+          address = [
+            "10.89.88.20/24"
+            "fd31:185d:722f::20/48"
+          ];
+          publicKey = "eLw320v+OzITi6DyYi9sEvAHN75VYO8S4ysSH4ggG34=";
+          privateKeyFile = config.sops.secrets."wg/0xa-proxy".path;
+        };
       };
     }
   ];
-- 
cgit v1.3.1