init flake with package, module and test

2023-06-02 16:17:47 +02:00 · 2023-06-02 16:17:47 +02:00 · 4a424259e4
commit 4a424259e4
parent 235ba8ada1
9 changed files with 19230 additions and 0 deletions
--- a/module.nix
+++ b/module.nix
@ -0,0 +1,120 @@
+{ config
+, lib
+, pkgs
+, ...
+}:
+let
+  cfg = config.services.authentik;
+
+  inherit (lib)
+    types;
+
+  inherit (lib.modules)
+    mkDefault
+    mkIf;
+
+  inherit (lib.options)
+    mkEnableOption
+    mkOption;
+
+  inherit (pkgs.authentik)
+    migrate
+    gopkgs
+    celery
+    staticWorkdirDeps;
+
+  settingsFormat = pkgs.formats.yaml {};
+in
+{
+  options.services.authentik = {
+    enable = mkEnableOption "authentik";
+
+    settings = mkOption {
+      type = types.submodule {
+        freeformType = settingsFormat.type;
+        options = {};
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services = {
+      authentik.settings = {
+        blueprints_dir = mkDefault "${pkgs.authentik.staticWorkdirDeps}/blueprints";
+        template_dir = mkDefault "${pkgs.authentik.staticWorkdirDeps}/templates";
+      };
+      redis.servers.authentik = {
+        enable = true;
+        port = 6379;
+      };
+      postgresql = {
+        enable = true;
+        package = pkgs.postgresql_14;
+      };
+    };
+
+    # https://goauthentik.io/docs/installation/docker-compose#explanation
+    time.timeZone = "UTC";
+
+    environment.etc."authentik/config.yml".source = settingsFormat.generate "authentik.yml" cfg.settings;
+
+    systemd.services = {
+      authentik-migrate = {
+        requiredBy = [ "authentik.service" ];
+        requires = [ "postgresql.service" ];
+        after = [ "postgresql.service" ];
+        before = [ "authentik.service" ];
+        serviceConfig = {
+          Type = "oneshot";
+          RemainAfterExit = true;
+          Environment = [
+            "AUTHENTIK_POSTGRESQL__USER=authentik"
+            "AUTHENTIK_POSTGRESQL__NAME=authentik"
+          ];
+          DynamicUser = true;
+          ExecStart = "${pkgs.authentik.migrate}/bin/migrate.py";
+        };
+      };
+      authentik-worker = {
+        requiredBy = [ "authentik.service" ];
+        before = [ "authentik.service" ];
+        serviceConfig = {
+          Environment = [
+            "AUTHENTIK_POSTGRESQL__USER=authentik"
+            "AUTHENTIK_POSTGRESQL__NAME=authentik"
+          ];
+          RuntimeDirectory = "authentik";
+          WorkingDirectory = "%t/authentik";
+          DynamicUser = true;
+          # TODO maybe make this configurable
+          ExecStart = "${pkgs.authentik.celery}/bin/celery -A authentik.root.celery worker -Ofair --max-tasks-per-child=1 --autoscale 3,1 -E -B -s /tmp/celerybeat-schedule -Q authentik,authentik_scheduled,authentik_events";
+        };
+      };
+      authentik = {
+        wantedBy = [ "multi-user.target" ];
+        after = [
+          "network-online.target"
+          "postgresql.service"
+          "redis-authentik.service"
+        ];
+        preStart = ''
+          ln -svf ${pkgs.authentik.staticWorkdirDeps}/* /var/lib/authentik/
+        '';
+        serviceConfig = {
+          Environment = [
+            "AUTHENTIK_ERROR_REPORTING__ENABLED=false"
+            "AUTHENTIK_DISABLE_UPDATE_CHECK=true"
+            "AUTHENTIK_DISABLE_STARTUP_ANALYTICS=true"
+            "AUTHENTIK_AVATARS=initials"
+          ];
+          StateDirectory = "authentik";
+          UMask = "0027";
+          # TODO /run might be sufficient
+          WorkingDirectory = "%S/authentik";
+          DynamicUser = true;
+          ExecStart = "${pkgs.authentik.gopkgs}/bin/server";
+        };
+      };
+    };
+  };
+}