tamipes/authentik-nix
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add RAC outpost

Browse source 
Co-authored-by: Maximilian Bosch <maximilian@mbosch.me>
This commit is contained in:
Victor Nawothnig 2025-03-06 16:26:19 +01:00 • committed by Maximilian Bosch
parent 3082a94074
commit e31ed431d7
No known key found for this signature in database
2 changed files with 73 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

57
module.nix
View file

@ -204,6 +204,29 @@ in
};
};
# RAC oupost
authentik-rac = {
enable = mkEnableOption "authentik RAC outpost";
environmentFile = mkOption {
type = types.nullOr pathToSecret;
default = null;
example = "/run/secrets/authentik-rac/authentik-rac-env";
description = ''
Environment file as defined in {manpage}`systemd.exec(5)`.
Secrets may be passed to the service without adding them to the world-readable
/nix/store, by specifying the desied secrets as environment variables according
to the authentic documentation.
```
# example content
AUTHENTIK_TOKEN=<token from authentik for this outpost>
```
'';
};
};
# RADIUS oupost
authentik-radius = {
enable = mkEnableOption "authentik RADIUS outpost";
@ -497,6 +520,40 @@ in
}
))
# RAC outpost
(mkIf config.services.authentik-rac.enable (
let
cfg = config.services.authentik-rac;
in
{
assertions = [
{
assertion = config.services.authentik.authentikComponents.gopkgs?rac;
message = ''
guacamole-server is not available on the host's platform!
'';
}
];
systemd.services.authentik-rac = {
wantedBy = [ "multi-user.target" ];
wants = [ "network-online.target" ];
after = [
"network-online.target"
"authentik.service"
];
serviceConfig = {
RuntimeDirectory = "authentik-rac";
UMask = "0027";
WorkingDirectory = "%t/authentik-rac";
DynamicUser = true;
ExecStart = "${config.services.authentik.authentikComponents.gopkgs.rac}/bin/rac";
EnvironmentFile = mkIf (cfg.environmentFile != null) [ cfg.environmentFile ];
Restart = "on-failure";
};
};
}
))
# RADIUS outpost
(mkIf config.services.authentik-radius.enable (
let