grace/dots

dotfiles/nix configs

git clone https://git.gae.moe/grace/dots

Grace Yoderidk003ed04

main
branchesidkmainvulcanwafrn-testingall refs →
4.5 KiB130 linesraw
1{ config, ... }:
2
3{
4  services.authelia.instances.main = {
5    enable = true;
6    secrets = {
7      jwtSecretFile = "/etc/secrets/authelia/jwt";
8      storageEncryptionKeyFile = "/etc/secrets/authelia/storage";
9      sessionSecretFile = "/etc/secrets/authelia/session";
10      oidcHmacSecretFile = "/etc/secrets/authelia/oidc-hmac";
11      oidcIssuerPrivateKeyFile = "/etc/secrets/authelia/oidc-key.pem";
12    };
13    settings = {
14      theme = "dark";
15      log.level = "info";
16      server.address = "tcp://127.0.0.1:9091/";
17      server.endpoints.authz = {
18        auth-request = {
19          implementation = "AuthRequest";
20          authn_strategies = [ { name = "CookieSession"; } ];
21        };
22        git = {
23          implementation = "AuthRequest";
24          authn_strategies = [
25            {
26              name = "HeaderAuthorization";
27              schemes = [ "Basic" ];
28            }
29          ];
30        };
31      };
32      authentication_backend = {
33        password_reset.disable = true;
34        password_change.disable = true;
35        file.path = "/run/credentials/authelia-main.service/users.yml";
36      };
37      access_control = {
38        default_policy = "deny";
39        rules = [
40          {
41            domain = [
42              "files.gae.moe"
43              "books.gae.moe"
44              "term.gae.moe"
45              "i.git.gae.moe"
46            ];
47            policy = "one_factor";
48            subject = [ "group:users" ];
49          }
50        ];
51      };
52      session.cookies = [
53        {
54          domain = "gae.moe";
55          authelia_url = "https://auth.gae.moe";
56          default_redirection_url = "https://files.gae.moe";
57        }
58      ];
59      storage.local.path = "/var/lib/authelia-main/db.sqlite3";
60      notifier.filesystem.filename = "/var/lib/authelia-main/notifications.txt";
61      identity_providers.oidc.clients = [
62        {
63          client_id = "zipline";
64          client_name = "Zipline";
65          client_secret = ''{{ secret (printf "%s/zipline-client-secret" (mustEnv "CREDENTIALS_DIRECTORY")) | trim }}'';
66          public = false;
67          authorization_policy = "one_factor";
68          require_pkce = true;
69          pkce_challenge_method = "S256";
70          redirect_uris = [ "https://l.gae.moe/api/auth/oauth/oidc" ];
71          scopes = [ "openid" "profile" "email" "offline_access" ];
72          response_types = [ "code" ];
73          grant_types = [ "authorization_code" "refresh_token" ];
74          token_endpoint_auth_method = "client_secret_post";
75          userinfo_signed_response_alg = "none";
76        }
77        {
78          client_id = "immich";
79          client_name = "Immich";
80          client_secret = ''{{ secret (printf "%s/immich-client-secret" (mustEnv "CREDENTIALS_DIRECTORY")) | trim }}'';
81          public = false;
82          authorization_policy = "one_factor";
83          require_pkce = true;
84          pkce_challenge_method = "S256";
85          redirect_uris = [
86            "https://img.gae.moe/auth/login"
87            "https://img.gae.moe/user-settings"
88            "app.immich:///oauth-callback"
89          ];
90          scopes = [
91            "openid"
92            "profile"
93            "email"
94          ];
95          response_types = [ "code" ];
96          grant_types = [ "authorization_code" ];
97          token_endpoint_auth_method = "client_secret_basic";
98          userinfo_signed_response_alg = "none";
99        }
100        {
101          client_id = "jellyfin";
102          client_name = "Jellyfin";
103          client_secret = ''{{ secret (printf "%s/jellyfin-client-secret" (mustEnv "CREDENTIALS_DIRECTORY")) | trim }}'';
104          public = false;
105          authorization_policy = "one_factor";
106          require_pkce = true;
107          pkce_challenge_method = "S256";
108          redirect_uris = [ "https://fin.gae.moe/sso/OID/redirect/authelia" ];
109          scopes = [
110            "openid"
111            "profile"
112            "groups"
113          ];
114          response_types = [ "code" ];
115          grant_types = [ "authorization_code" ];
116          token_endpoint_auth_method = "client_secret_post";
117          userinfo_signed_response_alg = "none";
118        }
119      ];
120    };
121  };
122
123  systemd.services.authelia-main.serviceConfig.LoadCredential = [
124    "zipline-client-secret:/etc/secrets/authelia/zipline-client-secret"
125    "users.yml:/etc/secrets/authelia/users.yml"
126    "immich-client-secret:/etc/secrets/authelia/immich-client-secret"
127    "jellyfin-client-secret:/etc/secrets/authelia/jellyfin-client-secret"
128  ];
129  environment.systemPackages = [ config.services.authelia.instances.main.package ];
130}