233 lines
9.1 KiB
Nix
233 lines
9.1 KiB
Nix
{
|
|
description = "Nix package, NixOS module and VM integration test for authentik";
|
|
|
|
inputs = {
|
|
flake-utils.url = "github:numtide/flake-utils";
|
|
flake-parts.url = "github:hercules-ci/flake-parts";
|
|
nixpkgs.url = "github:NixOS/nixpkgs/nixos-23.05";
|
|
poetry2nix = {
|
|
url = "github:nix-community/poetry2nix";
|
|
inputs = {
|
|
nixpkgs.follows = "nixpkgs";
|
|
flake-utils.follows = "flake-utils";
|
|
};
|
|
};
|
|
napalm = {
|
|
url = "github:nix-community/napalm";
|
|
inputs = {
|
|
nixpkgs.follows = "nixpkgs";
|
|
flake-utils.follows = "flake-utils";
|
|
};
|
|
};
|
|
authentik-src = { # change version string in outputs as well when updating
|
|
url = "github:goauthentik/authentik/version/2023.8.1";
|
|
flake = false;
|
|
};
|
|
};
|
|
|
|
outputs = inputs@{
|
|
self,
|
|
nixpkgs,
|
|
flake-parts,
|
|
poetry2nix,
|
|
napalm,
|
|
authentik-src,
|
|
...
|
|
}:
|
|
|
|
flake-parts.lib.mkFlake
|
|
{ inherit inputs; }
|
|
({ inputs, lib, withSystem, ... }:
|
|
let
|
|
authentik-version = "2023.8.1"; # to pass to the drvs of some components
|
|
in {
|
|
systems = [
|
|
"x86_64-linux"
|
|
"aarch64-linux" # not tested
|
|
];
|
|
flake = {
|
|
nixosModules.default = { pkgs, ... }: {
|
|
imports = [ ./module.nix ];
|
|
services.authentik.authentikComponents = withSystem pkgs.stdenv.hostPlatform.system (
|
|
{ config, ... }:
|
|
{ inherit (config.packages) celery staticWorkdirDeps migrate pythonEnv frontend gopkgs docs; }
|
|
);
|
|
};
|
|
};
|
|
perSystem = { inputs', pkgs, system, ... }: let
|
|
inherit (inputs'.poetry2nix.legacyPackages)
|
|
mkPoetryEnv
|
|
defaultPoetryOverrides;
|
|
in {
|
|
packages = rec {
|
|
docs = napalm.legacyPackages.${system}.buildPackage "${authentik-src}/website" {
|
|
version = authentik-version; # 0.0.0 specified upstream in package.json
|
|
NODE_ENV = "production";
|
|
nodejs = pkgs.nodejs_20;
|
|
npmCommands = [
|
|
"cp -v ${authentik-src}/SECURITY.md ../SECURITY.md"
|
|
"cp -vr ${authentik-src}/blueprints ../blueprints"
|
|
"npm install --include=dev"
|
|
"npm run build-docs-only"
|
|
];
|
|
installPhase = ''
|
|
mv -v ../website $out
|
|
'';
|
|
};
|
|
frontend = napalm.legacyPackages.${system}.buildPackage "${authentik-src}/web" {
|
|
version = authentik-version; # 0.0.0 specified upstream in package.json
|
|
packageLock = let
|
|
fix-napalm-registry-500-response = pkgs.writeText "lockfile.patch" ''
|
|
diff --git a/web/package-lock.json b/web/package-lock.json
|
|
index 028accd89..6c3590120 100644
|
|
--- a/web/package-lock.json
|
|
+++ b/web/package-lock.json
|
|
@@ -22959,8 +22959,7 @@
|
|
"url": "https://github.com/chalk/wrap-ansi?sponsor=1"
|
|
}
|
|
},
|
|
- "node_modules/wrap-ansi-cjs": {
|
|
- "name": "wrap-ansi",
|
|
+ "node_modules/wrap-ansi-cjs/node_modules/wrap-ansi": {
|
|
"version": "7.0.0",
|
|
"resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
|
|
"integrity": "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==",
|
|
'';
|
|
srcWithFullyResolvedLockfile = pkgs.applyPatches {
|
|
name = "authentik-src-with-patched-package-lock";
|
|
src = authentik-src;
|
|
patches = [
|
|
fix-napalm-registry-500-response
|
|
];
|
|
};
|
|
in "${srcWithFullyResolvedLockfile}/web/package-lock.json";
|
|
NODE_ENV = "production";
|
|
nodejs = pkgs.nodejs_20;
|
|
preBuild = ''
|
|
ln -sv ${docs} ../website
|
|
'';
|
|
npmCommands = [
|
|
"npm install --include=dev --nodedir=${pkgs.nodejs_20}/include/node --loglevel verbose --ignore-scripts"
|
|
"npm run build"
|
|
];
|
|
installPhase = ''
|
|
mkdir $out
|
|
mv dist $out/dist
|
|
cp -r authentik icons $out
|
|
'';
|
|
};
|
|
pythonEnv = mkPoetryEnv {
|
|
projectDir = authentik-src;
|
|
python = pkgs.python311;
|
|
overrides = [ defaultPoetryOverrides ] ++ (import ./poetry2nix-python-overrides.nix pkgs);
|
|
};
|
|
# server + outposts
|
|
gopkgs = pkgs.buildGo120Module {
|
|
pname = "authentik-gopkgs";
|
|
version = authentik-version;
|
|
prePatch = ''
|
|
sed -i"" -e 's,./web/dist/,${frontend}/dist/,' web/static.go
|
|
sed -i"" -e 's,./web/dist/,${frontend}/dist/,' internal/web/static.go
|
|
sed -i"" -e 's,./lifecycle/gunicorn.conf.py,${staticWorkdirDeps}/lifecycle/gunicorn.conf.py,' internal/gounicorn/gounicorn.go
|
|
'';
|
|
src = pkgs.lib.cleanSourceWith {
|
|
src = authentik-src;
|
|
filter = (path: _:
|
|
(builtins.any (x: x) (
|
|
(map (infix: pkgs.lib.hasInfix infix path) [
|
|
"/authentik"
|
|
"/cmd"
|
|
"/internal"
|
|
])
|
|
++
|
|
(map (suffix: pkgs.lib.hasSuffix suffix path) [
|
|
"/web"
|
|
"/web/static.go"
|
|
"/web/robots.txt"
|
|
"/web/security.txt"
|
|
"go.mod"
|
|
"go.sum"
|
|
])
|
|
))
|
|
);
|
|
};
|
|
subPackages = [
|
|
"cmd/ldap"
|
|
"cmd/server"
|
|
"cmd/proxy"
|
|
"cmd/radius"
|
|
];
|
|
vendorSha256 = "sha256-womCCrXBoG3xhiqe0NnqNVuf+ecIPHVaCRbzNcsHs4o=";
|
|
nativeBuildInputs = [ pkgs.makeWrapper ];
|
|
postInstall = ''
|
|
wrapProgram $out/bin/server --prefix PATH : ${pythonEnv}/bin
|
|
wrapProgram $out/bin/server --prefix PYTHONPATH : ${staticWorkdirDeps}
|
|
'';
|
|
};
|
|
staticWorkdirDeps = pkgs.linkFarm "authentik-static-workdir-deps" [
|
|
{ name = "authentik"; path = "${authentik-src}/authentik"; }
|
|
{ name = "locale"; path = "${authentik-src}/locale"; }
|
|
{ name = "blueprints"; path = "${authentik-src}/blueprints"; }
|
|
{ name = "internal"; path = "${authentik-src}/internal"; }
|
|
{ name = "lifecycle"; path = "${authentik-src}/lifecycle"; }
|
|
{ name = "schemas"; path = "${authentik-src}/schemas"; }
|
|
{ name = "web"; path = frontend; }
|
|
];
|
|
migrate = pkgs.runCommandLocal "authentik-migrate.py" {
|
|
nativeBuildInputs = [ pkgs.makeWrapper ];
|
|
} ''
|
|
mkdir -vp $out/bin
|
|
cp ${authentik-src}/lifecycle/migrate.py $out/bin/migrate.py
|
|
chmod +w $out/bin/migrate.py
|
|
patchShebangs $out/bin/migrate.py
|
|
substituteInPlace $out/bin/migrate.py \
|
|
--replace \
|
|
'migration in Path(__file__).parent.absolute().glob("system_migrations/*.py")' \
|
|
'migration in Path("${staticWorkdirDeps}/lifecycle").glob("system_migrations/*.py")'
|
|
wrapProgram $out/bin/migrate.py \
|
|
--prefix PATH : ${pythonEnv}/bin \
|
|
--prefix PYTHONPATH : ${staticWorkdirDeps}
|
|
'';
|
|
# worker
|
|
celery = pkgs.runCommandLocal "authentik-celery" {
|
|
nativeBuildInputs = [ pkgs.makeWrapper ];
|
|
} ''
|
|
mkdir -vp $out/bin
|
|
ln -sv ${pythonEnv}/bin/celery $out/bin/celery
|
|
wrapProgram $out/bin/celery \
|
|
--prefix PYTHONPATH : ${staticWorkdirDeps}
|
|
'';
|
|
# terraform provider
|
|
terraform-provider-authentik = pkgs.buildGo118Module rec {
|
|
pname = "terraform-provider-authentik";
|
|
version = "2023.8.0";
|
|
src = pkgs.fetchFromGitHub {
|
|
owner = "goauthentik";
|
|
repo = pname;
|
|
rev = "v${version}";
|
|
sha256 = "sha256-AIf+l26TqFS8Nfe/Qu0rZtCEHzWO1Jao8/KIY1IrriQ=";
|
|
};
|
|
doCheck = false; # tests are run against authentik -> vm test
|
|
vendorSha256 = "sha256-U4dYBFPQodmVyIXsapsstSe50G3HmBv9bvPfJq84CDU=";
|
|
postInstall = ''
|
|
path="$out/libexec/terraform-providers/registry.terraform.io/goauthentik/authentik/${version}/''${GOOS}_''${GOARCH}/"
|
|
mkdir -p "$path"
|
|
mv $out/bin/${pname} $path/${pname}_v${version}
|
|
rmdir $out/bin
|
|
'';
|
|
};
|
|
};
|
|
checks.default = (import ./test.nix {
|
|
inherit pkgs;
|
|
inherit (self) nixosModules;
|
|
});
|
|
devShells.default = pkgs.mkShell {
|
|
packages = [
|
|
# to generate a v2 lockfile from the v3 lockfile provided by upstream:
|
|
# npm install --lockfile-version 2 --package-lock-only
|
|
pkgs.nodejs
|
|
];
|
|
};
|
|
};
|
|
});
|
|
}
|