tamipes/authentik-nix
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

module: use postgres peer auth instead of password auth

Browse source
This commit is contained in:
WilliButz 2023-06-07 14:05:05 +02:00
parent b51c438d24
commit 3c661c5095
No known key found for this signature in database
GPG key ID: FB0513677AB15BEA
2 changed files with 20 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

24
module.nix
View file

@ -35,6 +35,11 @@ in
options = {}; options = {};
}; };
}; };
createDatabase = mkOption {
type = types.bool;
default = true;
};
}; };
config = mkIf cfg.enable { config = mkIf cfg.enable {
@ -42,6 +47,11 @@ in
authentik.settings = { authentik.settings = {
blueprints_dir = mkDefault "${pkgs.authentik.staticWorkdirDeps}/blueprints"; blueprints_dir = mkDefault "${pkgs.authentik.staticWorkdirDeps}/blueprints";
template_dir = mkDefault "${pkgs.authentik.staticWorkdirDeps}/templates"; template_dir = mkDefault "${pkgs.authentik.staticWorkdirDeps}/templates";
postgresql = {
user = mkDefault "authentik";
name = mkDefault "authentik";
host = mkDefault "";
};
}; };
redis.servers.authentik = { redis.servers.authentik = {
enable = true; enable = true;
@ -50,6 +60,10 @@ in
postgresql = { postgresql = {
enable = true; enable = true;
package = pkgs.postgresql_14; package = pkgs.postgresql_14;
ensureDatabases = mkIf cfg.createDatabase [ "authentik" ];
ensureUsers = mkIf cfg.createDatabase [
{ name = "authentik"; ensurePermissions."DATABASE authentik" = "ALL PRIVILEGES"; }
];
}; };
}; };
@ -67,11 +81,8 @@ in
serviceConfig = { serviceConfig = {
Type = "oneshot"; Type = "oneshot";
RemainAfterExit = true; RemainAfterExit = true;
Environment = [
"AUTHENTIK_POSTGRESQL__USER=authentik"
"AUTHENTIK_POSTGRESQL__NAME=authentik"
];
DynamicUser = true; DynamicUser = true;
User = "authentik";
ExecStart = "${pkgs.authentik.migrate}/bin/migrate.py"; ExecStart = "${pkgs.authentik.migrate}/bin/migrate.py";
}; };
}; };
@ -79,13 +90,10 @@ in
requiredBy = [ "authentik.service" ]; requiredBy = [ "authentik.service" ];
before = [ "authentik.service" ]; before = [ "authentik.service" ];
serviceConfig = { serviceConfig = {
Environment = [
"AUTHENTIK_POSTGRESQL__USER=authentik"
"AUTHENTIK_POSTGRESQL__NAME=authentik"
];
RuntimeDirectory = "authentik"; RuntimeDirectory = "authentik";
WorkingDirectory = "%t/authentik"; WorkingDirectory = "%t/authentik";
DynamicUser = true; DynamicUser = true;
User = "authentik";
# TODO maybe make this configurable # TODO maybe make this configurable
ExecStart = "${pkgs.authentik.celery}/bin/celery -A authentik.root.celery worker -Ofair --max-tasks-per-child=1 --autoscale 3,1 -E -B -s /tmp/celerybeat-schedule -Q authentik,authentik_scheduled,authentik_events"; ExecStart = "${pkgs.authentik.celery}/bin/celery -A authentik.root.celery worker -Ofair --max-tasks-per-child=1 --autoscale 3,1 -E -B -s /tmp/celerybeat-schedule -Q authentik,authentik_scheduled,authentik_events";
}; };

19
test.nix
View file

@ -4,10 +4,7 @@
}: }:
let let
# use a root-owned EnvironmentFile in production instead (systemd.services.<name>.serviceConfig.EnvironmentFile) # use a root-owned EnvironmentFile in production instead (systemd.services.<name>.serviceConfig.EnvironmentFile)
secrets = { authentiksecret = "thissecretwillbeinthenixstore";
authentiksecret = "thissecretwillbeinthenixstore";
postgresql = "dontusethisinproduction";
};
in in
pkgs.nixosTest { pkgs.nixosTest {
name = "authentik"; name = "authentik";
@ -26,22 +23,14 @@ pkgs.nixosTest {
services.authentik.enable = true; services.authentik.enable = true;
services.postgresql.initialScript = pkgs.writeText "psql-init.sql" ''
CREATE DATABASE authentik;
CREATE USER authentik WITH PASSWORD '${secrets.postgresql}';
GRANT ALL PRIVILEGES ON DATABASE authentik TO authentik
'';
systemd.services.authentik-migrate.serviceConfig.Environment = [ systemd.services.authentik-migrate.serviceConfig.Environment = [
"AUTHENTIK_POSTGRESQL__PASSWORD=${secrets.postgresql}" "AUTHENTIK_SECRET_KEY=${authentiksecret}"
"AUTHENTIK_SECRET_KEY=${secrets.authentiksecret}"
]; ];
systemd.services.authentik-worker.serviceConfig.Environment = [ systemd.services.authentik-worker.serviceConfig.Environment = [
"AUTHENTIK_POSTGRESQL__PASSWORD=${secrets.postgresql}" "AUTHENTIK_SECRET_KEY=${authentiksecret}"
"AUTHENTIK_SECRET_KEY=${secrets.authentiksecret}"
]; ];
systemd.services.authentik.serviceConfig.Environment = [ systemd.services.authentik.serviceConfig.Environment = [
"AUTHENTIK_POSTGRESQL__PASSWORD=${secrets.postgresql}" "AUTHENTIK_SECRET_KEY=${authentiksecret}"
"AUTHENTIK_SECRET_KEY=${secrets.authentiksecret}"
]; ];
services.xserver.enable = true; services.xserver.enable = true;