blob: 684474158ba6c6eb948c84bde25459d13bb499c5 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
|
{ pkgs, config, ... }:
let
domain = "idm.oxapentane.com";
kanidm-ip = "10.89.88.20";
proxy-ip = "10.89.88.1";
in
{
# mythic beasts cert
sops.secrets = {
"mythicbeasts-acme/api-id" = { mode = "0400"; };
"mythicbeasts-acme/api-secret" = { mode = "0400"; };
};
security.acme = {
acceptTerms = true;
certs.${domain} = {
dnsProvider = "mythicbeasts";
credentialFiles = {
MYTHICBEASTS_USERNAME_FILE = config.sops.secrets."mythicbeasts-acme/api-id".path;
MYTHICBEASTS_PASSWORD_FILE = config.sops.secrets."mythicbeasts-acme/api-secret".path;
};
group = "kanidm";
reloadServices = [
"kanidm.service"
];
};
};
# make sure cert exists before starting kanidm
systemd.services.kanidm = {
requires = [
"acme-${domain}.service"
];
after = [
"acme-${domain}.service"
];
};
services.kanidm = {
package = pkgs.kanidm_1_10;
server = {
enable = true;
settings = {
bindaddress = "${kanidm-ip}:8443";
domain = domain;
origin = "https://${domain}";
tls_chain = "/var/lib/acme/${domain}/fullchain.pem";
tls_key = "/var/lib/acme/${domain}/key.pem";
http_client_address_info = {
"x-forward-for" = [
proxy-ip
];
};
online_backup = {
path = "/var/lib/kanidm/backups";
schedule = "00 03 * * *";
versions = 31;
};
};
};
client = {
enable = true;
settings.uri = "https://${domain}";
};
};
}
|
