treewide: nixfmt
This commit is contained in:
WilliButz
parent
d653af66b3
commit
dbfc2207df
14 changed files with 688 additions and 564 deletions
430
module.nix
430
module.nix
|
|
@ -1,41 +1,49 @@
|
|||
{ config
|
||||
, lib
|
||||
, pkgs
|
||||
, ...
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (lib)
|
||||
types;
|
||||
types
|
||||
;
|
||||
|
||||
inherit (lib.attrsets)
|
||||
attrNames
|
||||
getAttrs
|
||||
mapAttrsToList;
|
||||
mapAttrsToList
|
||||
;
|
||||
|
||||
inherit (lib.lists)
|
||||
flatten
|
||||
toList;
|
||||
toList
|
||||
;
|
||||
|
||||
inherit (lib.modules)
|
||||
mkDefault
|
||||
mkIf
|
||||
mkMerge
|
||||
mkOverride;
|
||||
mkOverride
|
||||
;
|
||||
|
||||
inherit (lib.options)
|
||||
mkEnableOption
|
||||
mkOption;
|
||||
mkOption
|
||||
;
|
||||
|
||||
inherit (lib.strings)
|
||||
concatStringsSep
|
||||
optionalString
|
||||
versionOlder;
|
||||
versionOlder
|
||||
;
|
||||
|
||||
inherit (lib.trivial)
|
||||
boolToString
|
||||
isBool;
|
||||
isBool
|
||||
;
|
||||
|
||||
settingsFormat = pkgs.formats.yaml {};
|
||||
settingsFormat = pkgs.formats.yaml { };
|
||||
in
|
||||
{
|
||||
options.services = {
|
||||
|
|
@ -50,7 +58,7 @@ in
|
|||
settings = mkOption {
|
||||
type = types.submodule {
|
||||
freeformType = settingsFormat.type;
|
||||
options = {};
|
||||
options = { };
|
||||
};
|
||||
};
|
||||
|
||||
|
|
@ -141,211 +149,233 @@ in
|
|||
|
||||
config = mkMerge [
|
||||
# authentik server
|
||||
(mkIf config.services.authentik.enable (let
|
||||
cfg = config.services.authentik;
|
||||
(mkIf config.services.authentik.enable (
|
||||
let
|
||||
cfg = config.services.authentik;
|
||||
|
||||
# https://goauthentik.io/docs/installation/docker-compose#startup
|
||||
tz = "UTC";
|
||||
# https://goauthentik.io/docs/installation/docker-compose#startup
|
||||
tz = "UTC";
|
||||
|
||||
# Passed to each service and to the `ak` wrapper using `systemd-run(1)`
|
||||
serviceDefaults = {
|
||||
DynamicUser = true;
|
||||
User = "authentik";
|
||||
EnvironmentFile = mkIf (cfg.environmentFile != null) [ cfg.environmentFile ];
|
||||
};
|
||||
akOptions = flatten (mapAttrsToList
|
||||
# Map defaults for each authentik service (listed above) to command line parameters for
|
||||
# `systemd-run(1)` in order to spin up an environment with correct (dynamic) user,
|
||||
# state directory and environment to run `ak` inside.
|
||||
(k: vs: map
|
||||
(v: "--property ${k}=${if isBool v then boolToString v else toString v}")
|
||||
(toList vs))
|
||||
# Read serviceDefaults from `authentik.service`. That way, module system primitives (mk*)
|
||||
# can be used inside `serviceDefaults` and it doesn't need to be evaluated here again.
|
||||
(getAttrs (attrNames serviceDefaults) config.systemd.services.authentik.serviceConfig // {
|
||||
StateDirectory = "authentik";
|
||||
}));
|
||||
in
|
||||
{
|
||||
services = {
|
||||
authentik.settings = {
|
||||
blueprints_dir = mkDefault "${cfg.authentikComponents.staticWorkdirDeps}/blueprints";
|
||||
template_dir = mkDefault "${cfg.authentikComponents.staticWorkdirDeps}/templates";
|
||||
postgresql = mkIf cfg.createDatabase {
|
||||
user = mkDefault "authentik";
|
||||
name = mkDefault "authentik";
|
||||
host = mkDefault "";
|
||||
# Passed to each service and to the `ak` wrapper using `systemd-run(1)`
|
||||
serviceDefaults = {
|
||||
DynamicUser = true;
|
||||
User = "authentik";
|
||||
EnvironmentFile = mkIf (cfg.environmentFile != null) [ cfg.environmentFile ];
|
||||
};
|
||||
akOptions = flatten (
|
||||
mapAttrsToList
|
||||
# Map defaults for each authentik service (listed above) to command line parameters for
|
||||
# `systemd-run(1)` in order to spin up an environment with correct (dynamic) user,
|
||||
# state directory and environment to run `ak` inside.
|
||||
(k: vs: map (v: "--property ${k}=${if isBool v then boolToString v else toString v}") (toList vs))
|
||||
# Read serviceDefaults from `authentik.service`. That way, module system primitives (mk*)
|
||||
# can be used inside `serviceDefaults` and it doesn't need to be evaluated here again.
|
||||
(
|
||||
getAttrs (attrNames serviceDefaults) config.systemd.services.authentik.serviceConfig
|
||||
// {
|
||||
StateDirectory = "authentik";
|
||||
}
|
||||
)
|
||||
);
|
||||
in
|
||||
{
|
||||
services = {
|
||||
authentik.settings = {
|
||||
blueprints_dir = mkDefault "${cfg.authentikComponents.staticWorkdirDeps}/blueprints";
|
||||
template_dir = mkDefault "${cfg.authentikComponents.staticWorkdirDeps}/templates";
|
||||
postgresql = mkIf cfg.createDatabase {
|
||||
user = mkDefault "authentik";
|
||||
name = mkDefault "authentik";
|
||||
host = mkDefault "";
|
||||
};
|
||||
cert_discovery_dir = mkIf (cfg.nginx.enable && cfg.nginx.enableACME) "env://CREDENTIALS_DIRECTORY";
|
||||
storage.media = {
|
||||
backend = mkDefault "file";
|
||||
file = mkDefault {
|
||||
path = "/var/lib/authentik/media";
|
||||
};
|
||||
};
|
||||
media.enable_upload = mkDefault true;
|
||||
};
|
||||
cert_discovery_dir = mkIf (cfg.nginx.enable && cfg.nginx.enableACME) "env://CREDENTIALS_DIRECTORY";
|
||||
storage.media = {
|
||||
backend = mkDefault "file";
|
||||
file = mkDefault {
|
||||
path = "/var/lib/authentik/media";
|
||||
redis.servers.authentik = {
|
||||
enable = true;
|
||||
port = 6379;
|
||||
};
|
||||
postgresql = mkIf cfg.createDatabase {
|
||||
enable = true;
|
||||
ensureDatabases = [ "authentik" ];
|
||||
ensureUsers = [
|
||||
{
|
||||
name = "authentik";
|
||||
ensureDBOwnership = true;
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
environment.systemPackages = [
|
||||
(pkgs.writeShellScriptBin "ak" ''
|
||||
exec ${config.systemd.package}/bin/systemd-run --pty --collect \
|
||||
${concatStringsSep " \\\n" akOptions} \
|
||||
--working-directory /var/lib/authentik \
|
||||
-- ${cfg.authentikComponents.manage}/bin/manage.py "$@"
|
||||
'')
|
||||
];
|
||||
|
||||
environment.etc."authentik/config.yml".source =
|
||||
settingsFormat.generate "authentik.yml" cfg.settings;
|
||||
|
||||
systemd.services = {
|
||||
authentik-migrate = {
|
||||
requiredBy = [ "authentik.service" ];
|
||||
requires = lib.optionals cfg.createDatabase [ "postgresql.service" ];
|
||||
wants = [ "network-online.target" ];
|
||||
after = [ "network-online.target" ] ++ lib.optionals cfg.createDatabase [ "postgresql.service" ];
|
||||
before = [ "authentik.service" ];
|
||||
restartTriggers = [ config.environment.etc."authentik/config.yml".source ];
|
||||
environment.TZ = tz;
|
||||
serviceConfig = mkMerge [
|
||||
serviceDefaults
|
||||
{
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
RuntimeDirectory = "authentik-migrate";
|
||||
WorkingDirectory = "%t/authentik-migrate";
|
||||
ExecStartPre = [
|
||||
# needs access to "authentik/sources/schemas"
|
||||
"${pkgs.coreutils}/bin/ln -svf ${cfg.authentikComponents.staticWorkdirDeps}/authentik"
|
||||
];
|
||||
ExecStart = "${cfg.authentikComponents.migrate}/bin/migrate.py";
|
||||
Restart = "on-failure";
|
||||
RestartSec = "1s";
|
||||
inherit (config.systemd.services.authentik.serviceConfig) StateDirectory;
|
||||
}
|
||||
];
|
||||
};
|
||||
authentik-worker = {
|
||||
requiredBy = [ "authentik.service" ];
|
||||
wants = [ "network-online.target" ];
|
||||
after = [ "network-online.target" ];
|
||||
before = [ "authentik.service" ];
|
||||
restartTriggers = [ config.environment.etc."authentik/config.yml".source ];
|
||||
preStart = ''
|
||||
ln -svf ${config.services.authentik.authentikComponents.staticWorkdirDeps}/* /run/authentik/
|
||||
'';
|
||||
environment.TZ = tz;
|
||||
serviceConfig = mkMerge [
|
||||
serviceDefaults
|
||||
{
|
||||
RuntimeDirectory = "authentik";
|
||||
WorkingDirectory = "%t/authentik";
|
||||
ExecStart = "${cfg.authentikComponents.manage}/bin/manage.py worker";
|
||||
Restart = "on-failure";
|
||||
RestartSec = "1s";
|
||||
LoadCredential = mkIf (cfg.nginx.enable && cfg.nginx.enableACME) [
|
||||
"${cfg.nginx.host}.pem:${config.security.acme.certs.${cfg.nginx.host}.directory}/fullchain.pem"
|
||||
"${cfg.nginx.host}.key:${config.security.acme.certs.${cfg.nginx.host}.directory}/key.pem"
|
||||
];
|
||||
# needs access to $StateDirectory/media/public
|
||||
inherit (config.systemd.services.authentik.serviceConfig) StateDirectory;
|
||||
}
|
||||
];
|
||||
};
|
||||
authentik = {
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
wants = [ "network-online.target" ];
|
||||
after = [
|
||||
"network-online.target"
|
||||
"redis-authentik.service"
|
||||
] ++ (lib.optionals cfg.createDatabase [ "postgresql.service" ]);
|
||||
restartTriggers = [ config.environment.etc."authentik/config.yml".source ];
|
||||
preStart = ''
|
||||
ln -svf ${cfg.authentikComponents.staticWorkdirDeps}/* /var/lib/authentik/
|
||||
${optionalString (cfg.settings.storage.media.backend == "file") ''
|
||||
mkdir -p ${cfg.settings.storage.media.file.path}
|
||||
''}
|
||||
'';
|
||||
environment.TZ = tz;
|
||||
serviceConfig = mkMerge [
|
||||
serviceDefaults
|
||||
{
|
||||
StateDirectory = "authentik";
|
||||
UMask = "0027";
|
||||
# TODO /run might be sufficient
|
||||
WorkingDirectory = "%S/authentik";
|
||||
ExecStart = "${cfg.authentikComponents.gopkgs}/bin/server";
|
||||
Restart = "on-failure";
|
||||
RestartSec = "1s";
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
services.nginx = mkIf cfg.nginx.enable {
|
||||
enable = true;
|
||||
recommendedTlsSettings = true;
|
||||
recommendedProxySettings = true;
|
||||
virtualHosts.${cfg.nginx.host} = {
|
||||
inherit (cfg.nginx) enableACME;
|
||||
forceSSL = cfg.nginx.enableACME;
|
||||
locations."/" = {
|
||||
proxyWebsockets = true;
|
||||
proxyPass = "https://localhost:9443";
|
||||
};
|
||||
};
|
||||
media.enable_upload = mkDefault true;
|
||||
};
|
||||
redis.servers.authentik = {
|
||||
enable = true;
|
||||
port = 6379;
|
||||
};
|
||||
postgresql = mkIf cfg.createDatabase {
|
||||
enable = true;
|
||||
ensureDatabases = [ "authentik" ];
|
||||
ensureUsers = [
|
||||
{ name = "authentik"; ensureDBOwnership = true; }
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
))
|
||||
|
||||
environment.systemPackages = [
|
||||
(pkgs.writeShellScriptBin "ak" ''
|
||||
exec ${config.systemd.package}/bin/systemd-run --pty --collect \
|
||||
${concatStringsSep " \\\n" akOptions} \
|
||||
--working-directory /var/lib/authentik \
|
||||
-- ${cfg.authentikComponents.manage}/bin/manage.py "$@"
|
||||
'')
|
||||
];
|
||||
|
||||
environment.etc."authentik/config.yml".source = settingsFormat.generate "authentik.yml" cfg.settings;
|
||||
|
||||
systemd.services = {
|
||||
authentik-migrate = {
|
||||
requiredBy = [ "authentik.service" ];
|
||||
requires = lib.optionals cfg.createDatabase [ "postgresql.service" ];
|
||||
wants = [ "network-online.target" ];
|
||||
after = [ "network-online.target" ] ++ lib.optionals cfg.createDatabase [ "postgresql.service" ];
|
||||
before = [ "authentik.service" ];
|
||||
restartTriggers = [ config.environment.etc."authentik/config.yml".source ];
|
||||
environment.TZ = tz;
|
||||
serviceConfig = mkMerge [ serviceDefaults {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
RuntimeDirectory = "authentik-migrate";
|
||||
WorkingDirectory = "%t/authentik-migrate";
|
||||
ExecStartPre = [
|
||||
# needs access to "authentik/sources/schemas"
|
||||
"${pkgs.coreutils}/bin/ln -svf ${cfg.authentikComponents.staticWorkdirDeps}/authentik"
|
||||
];
|
||||
ExecStart = "${cfg.authentikComponents.migrate}/bin/migrate.py";
|
||||
Restart = "on-failure";
|
||||
RestartSec = "1s";
|
||||
inherit (config.systemd.services.authentik.serviceConfig) StateDirectory;
|
||||
} ];
|
||||
};
|
||||
authentik-worker = {
|
||||
requiredBy = [ "authentik.service" ];
|
||||
wants = [ "network-online.target" ];
|
||||
after = [ "network-online.target" ];
|
||||
before = [ "authentik.service" ];
|
||||
restartTriggers = [ config.environment.etc."authentik/config.yml".source ];
|
||||
preStart = ''
|
||||
ln -svf ${config.services.authentik.authentikComponents.staticWorkdirDeps}/* /run/authentik/
|
||||
'';
|
||||
environment.TZ = tz;
|
||||
serviceConfig = mkMerge [ serviceDefaults {
|
||||
RuntimeDirectory = "authentik";
|
||||
WorkingDirectory = "%t/authentik";
|
||||
ExecStart = "${cfg.authentikComponents.manage}/bin/manage.py worker";
|
||||
Restart = "on-failure";
|
||||
RestartSec = "1s";
|
||||
LoadCredential = mkIf (cfg.nginx.enable && cfg.nginx.enableACME) [
|
||||
"${cfg.nginx.host}.pem:${config.security.acme.certs.${cfg.nginx.host}.directory}/fullchain.pem"
|
||||
"${cfg.nginx.host}.key:${config.security.acme.certs.${cfg.nginx.host}.directory}/key.pem"
|
||||
];
|
||||
# needs access to $StateDirectory/media/public
|
||||
inherit (config.systemd.services.authentik.serviceConfig) StateDirectory;
|
||||
} ];
|
||||
};
|
||||
authentik = {
|
||||
# LDAP outpost
|
||||
(mkIf config.services.authentik-ldap.enable (
|
||||
let
|
||||
cfg = config.services.authentik-ldap;
|
||||
in
|
||||
{
|
||||
systemd.services.authentik-ldap = {
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
wants = [ "network-online.target" ];
|
||||
after = [
|
||||
"network-online.target"
|
||||
"redis-authentik.service"
|
||||
] ++ (lib.optionals cfg.createDatabase [ "postgresql.service" ]);
|
||||
restartTriggers = [ config.environment.etc."authentik/config.yml".source ];
|
||||
preStart = ''
|
||||
ln -svf ${cfg.authentikComponents.staticWorkdirDeps}/* /var/lib/authentik/
|
||||
${optionalString (cfg.settings.storage.media.backend == "file") ''
|
||||
mkdir -p ${cfg.settings.storage.media.file.path}
|
||||
''}
|
||||
'';
|
||||
environment.TZ = tz;
|
||||
serviceConfig = mkMerge [ serviceDefaults {
|
||||
StateDirectory = "authentik";
|
||||
"authentik.service"
|
||||
];
|
||||
serviceConfig = {
|
||||
RuntimeDirectory = "authentik-ldap";
|
||||
UMask = "0027";
|
||||
# TODO /run might be sufficient
|
||||
WorkingDirectory = "%S/authentik";
|
||||
ExecStart = "${cfg.authentikComponents.gopkgs}/bin/server";
|
||||
WorkingDirectory = "%t/authentik-ldap";
|
||||
DynamicUser = true;
|
||||
ExecStart = "${config.services.authentik.authentikComponents.gopkgs}/bin/ldap";
|
||||
EnvironmentFile = mkIf (cfg.environmentFile != null) [ cfg.environmentFile ];
|
||||
Restart = "on-failure";
|
||||
RestartSec = "1s";
|
||||
} ];
|
||||
};
|
||||
};
|
||||
|
||||
services.nginx = mkIf cfg.nginx.enable {
|
||||
enable = true;
|
||||
recommendedTlsSettings = true;
|
||||
recommendedProxySettings = true;
|
||||
virtualHosts.${cfg.nginx.host} = {
|
||||
inherit (cfg.nginx) enableACME;
|
||||
forceSSL = cfg.nginx.enableACME;
|
||||
locations."/" = {
|
||||
proxyWebsockets = true;
|
||||
proxyPass = "https://localhost:9443";
|
||||
};
|
||||
};
|
||||
};
|
||||
}))
|
||||
|
||||
# LDAP outpost
|
||||
(mkIf config.services.authentik-ldap.enable (let
|
||||
cfg = config.services.authentik-ldap;
|
||||
in
|
||||
{
|
||||
systemd.services.authentik-ldap = {
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
wants = [ "network-online.target" ];
|
||||
after = [
|
||||
"network-online.target"
|
||||
"authentik.service"
|
||||
];
|
||||
serviceConfig = {
|
||||
RuntimeDirectory = "authentik-ldap";
|
||||
UMask = "0027";
|
||||
WorkingDirectory = "%t/authentik-ldap";
|
||||
DynamicUser = true;
|
||||
ExecStart = "${config.services.authentik.authentikComponents.gopkgs}/bin/ldap";
|
||||
EnvironmentFile = mkIf (cfg.environmentFile != null) [ cfg.environmentFile ];
|
||||
Restart = "on-failure";
|
||||
};
|
||||
};
|
||||
}))
|
||||
}
|
||||
))
|
||||
|
||||
# RADIUS outpost
|
||||
(mkIf config.services.authentik-radius.enable (let
|
||||
cfg = config.services.authentik-radius;
|
||||
in
|
||||
{
|
||||
systemd.services.authentik-radius = {
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
wants = [ "network-online.target" ];
|
||||
after = [
|
||||
"network-online.target"
|
||||
"authentik.service"
|
||||
];
|
||||
serviceConfig = {
|
||||
RuntimeDirectory = "authentik-radius";
|
||||
UMask = "0027";
|
||||
WorkingDirectory = "%t/authentik-radius";
|
||||
DynamicUser = true;
|
||||
ExecStart = "${config.services.authentik.authentikComponents.gopkgs}/bin/radius";
|
||||
EnvironmentFile = mkIf (cfg.environmentFile != null) [ cfg.environmentFile ];
|
||||
Restart = "on-failure";
|
||||
(mkIf config.services.authentik-radius.enable (
|
||||
let
|
||||
cfg = config.services.authentik-radius;
|
||||
in
|
||||
{
|
||||
systemd.services.authentik-radius = {
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
wants = [ "network-online.target" ];
|
||||
after = [
|
||||
"network-online.target"
|
||||
"authentik.service"
|
||||
];
|
||||
serviceConfig = {
|
||||
RuntimeDirectory = "authentik-radius";
|
||||
UMask = "0027";
|
||||
WorkingDirectory = "%t/authentik-radius";
|
||||
DynamicUser = true;
|
||||
ExecStart = "${config.services.authentik.authentikComponents.gopkgs}/bin/radius";
|
||||
EnvironmentFile = mkIf (cfg.environmentFile != null) [ cfg.environmentFile ];
|
||||
Restart = "on-failure";
|
||||
};
|
||||
};
|
||||
};
|
||||
}))
|
||||
}
|
||||
))
|
||||
|
||||
# This is an attempt to solve a rather ugly problem that was
|
||||
# caused by previously setting a default for the option
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue