treewide: format
All checks were successful
Check flake / build-amd64-linux (push) Successful in 2m53s
All checks were successful
Check flake / build-amd64-linux (push) Successful in 2m53s
This commit is contained in:
@ -1,4 +1,9 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
|
||||
{
|
||||
imports = [
|
||||
@ -13,7 +18,7 @@
|
||||
firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [
|
||||
22 # SSH
|
||||
22 # SSH
|
||||
];
|
||||
};
|
||||
};
|
||||
@ -37,7 +42,10 @@
|
||||
groups = {
|
||||
jellyfin = { };
|
||||
};
|
||||
extraGroups.acme.members = [ "kanidm" "nginx" ];
|
||||
extraGroups.acme.members = [
|
||||
"kanidm"
|
||||
"nginx"
|
||||
];
|
||||
};
|
||||
|
||||
services.openssh.settings.PermitRootLogin = lib.mkForce "prohibit-password";
|
||||
@ -47,26 +55,28 @@
|
||||
group = "acme";
|
||||
};
|
||||
|
||||
services.kanidm = let
|
||||
baseDomain = "vimium.com";
|
||||
domain = "auth.${baseDomain}";
|
||||
uri = "https://${domain}";
|
||||
in {
|
||||
package = pkgs.unstable.kanidm;
|
||||
enableClient = true;
|
||||
enableServer = true;
|
||||
clientSettings = {
|
||||
inherit uri;
|
||||
services.kanidm =
|
||||
let
|
||||
baseDomain = "vimium.com";
|
||||
domain = "auth.${baseDomain}";
|
||||
uri = "https://${domain}";
|
||||
in
|
||||
{
|
||||
package = pkgs.unstable.kanidm;
|
||||
enableClient = true;
|
||||
enableServer = true;
|
||||
clientSettings = {
|
||||
inherit uri;
|
||||
};
|
||||
serverSettings = {
|
||||
bindaddress = "[::1]:3013";
|
||||
ldapbindaddress = "[::1]:636";
|
||||
domain = baseDomain;
|
||||
origin = uri;
|
||||
tls_chain = "${config.security.acme.certs.${domain}.directory}/full.pem";
|
||||
tls_key = "${config.security.acme.certs.${domain}.directory}/key.pem";
|
||||
};
|
||||
};
|
||||
serverSettings = {
|
||||
bindaddress = "[::1]:3013";
|
||||
ldapbindaddress = "[::1]:636";
|
||||
domain = baseDomain;
|
||||
origin = uri;
|
||||
tls_chain = "${config.security.acme.certs.${domain}.directory}/full.pem";
|
||||
tls_key = "${config.security.acme.certs.${domain}.directory}/key.pem";
|
||||
};
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts = {
|
||||
"auth.vimium.com" = {
|
||||
|
@ -1,4 +1,10 @@
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
modulesPath,
|
||||
...
|
||||
}:
|
||||
|
||||
{
|
||||
imports = [
|
||||
@ -7,7 +13,12 @@
|
||||
|
||||
boot = {
|
||||
initrd = {
|
||||
availableKernelModules = [ "ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi" ];
|
||||
availableKernelModules = [
|
||||
"ata_piix"
|
||||
"uhci_hcd"
|
||||
"xen_blkfront"
|
||||
"vmw_pvscsi"
|
||||
];
|
||||
kernelModules = [ "nvme" ];
|
||||
};
|
||||
loader.grub.device = "/dev/sda";
|
||||
@ -23,4 +34,3 @@
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
|
Reference in New Issue
Block a user