Compare commits
4 Commits
zitadel
...
8ca88da93a
Author | SHA1 | Date | |
---|---|---|---|
8ca88da93a
|
|||
cf6898565b
|
|||
cc97ede099
|
|||
6ddb31c36f
|
286
flake.lock
generated
286
flake.lock
generated
@@ -21,6 +21,47 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"authentik-nix": {
|
||||
"inputs": {
|
||||
"authentik-src": "authentik-src",
|
||||
"flake-compat": "flake-compat",
|
||||
"flake-parts": "flake-parts",
|
||||
"flake-utils": "flake-utils",
|
||||
"napalm": "napalm",
|
||||
"nixpkgs": "nixpkgs_2",
|
||||
"poetry2nix": "poetry2nix"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1722879849,
|
||||
"narHash": "sha256-Hg1I6vmrxWz6RrVROXn1RDCPniOJx93QQg99x/wSkjY=",
|
||||
"owner": "nix-community",
|
||||
"repo": "authentik-nix",
|
||||
"rev": "80fc87361809f78b8a8cd7e57a14b66a726379ef",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-community",
|
||||
"repo": "authentik-nix",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"authentik-src": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1722875733,
|
||||
"narHash": "sha256-LPNcvKiVrwPwc3G/j0a7KoMKAMScbzui0C3IgWXP+g4=",
|
||||
"owner": "goauthentik",
|
||||
"repo": "authentik",
|
||||
"rev": "8f207c75046d722c17dee2bcf65fa386b06f5b9a",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "goauthentik",
|
||||
"ref": "version/2024.6.3",
|
||||
"repo": "authentik",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"blobs": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
@@ -61,8 +102,8 @@
|
||||
},
|
||||
"deploy-rs": {
|
||||
"inputs": {
|
||||
"flake-compat": "flake-compat",
|
||||
"nixpkgs": "nixpkgs_2",
|
||||
"flake-compat": "flake-compat_2",
|
||||
"nixpkgs": "nixpkgs_3",
|
||||
"utils": "utils"
|
||||
},
|
||||
"locked": {
|
||||
@@ -169,6 +210,22 @@
|
||||
}
|
||||
},
|
||||
"flake-compat_3": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1696426674,
|
||||
"narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
|
||||
"owner": "edolstra",
|
||||
"repo": "flake-compat",
|
||||
"rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "edolstra",
|
||||
"repo": "flake-compat",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-compat_4": {
|
||||
"locked": {
|
||||
"lastModified": 1696426674,
|
||||
"narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
|
||||
@@ -182,7 +239,7 @@
|
||||
"url": "https://flakehub.com/f/edolstra/flake-compat/1.tar.gz"
|
||||
}
|
||||
},
|
||||
"flake-compat_4": {
|
||||
"flake-compat_5": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1696426674,
|
||||
@@ -199,6 +256,24 @@
|
||||
}
|
||||
},
|
||||
"flake-parts": {
|
||||
"inputs": {
|
||||
"nixpkgs-lib": "nixpkgs-lib"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1719745305,
|
||||
"narHash": "sha256-xwgjVUpqSviudEkpQnioeez1Uo2wzrsMaJKJClh+Bls=",
|
||||
"owner": "hercules-ci",
|
||||
"repo": "flake-parts",
|
||||
"rev": "c3c5ecc05edc7dafba779c6c1a61cd08ac6583e9",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "hercules-ci",
|
||||
"repo": "flake-parts",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-parts_2": {
|
||||
"inputs": {
|
||||
"nixpkgs-lib": [
|
||||
"nixvim",
|
||||
@@ -219,9 +294,27 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-utils": {
|
||||
"inputs": {
|
||||
"systems": "systems_2"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1710146030,
|
||||
"narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"git-hooks": {
|
||||
"inputs": {
|
||||
"flake-compat": "flake-compat_4",
|
||||
"flake-compat": "flake-compat_5",
|
||||
"gitignore": "gitignore",
|
||||
"nixpkgs": [
|
||||
"nixvim",
|
||||
@@ -365,6 +458,31 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"napalm": {
|
||||
"inputs": {
|
||||
"flake-utils": [
|
||||
"authentik-nix",
|
||||
"flake-utils"
|
||||
],
|
||||
"nixpkgs": [
|
||||
"authentik-nix",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1717929455,
|
||||
"narHash": "sha256-BiI5xWygriOJuNISnGAeL0KYxrEMnjgpg+7wDskVBhI=",
|
||||
"owner": "nix-community",
|
||||
"repo": "napalm",
|
||||
"rev": "e1babff744cd278b56abe8478008b4a9e23036cf",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-community",
|
||||
"repo": "napalm",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nix-darwin": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
@@ -386,6 +504,28 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nix-github-actions": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"authentik-nix",
|
||||
"poetry2nix",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1703863825,
|
||||
"narHash": "sha256-rXwqjtwiGKJheXB43ybM8NwWB8rO2dSRrEqes0S7F5Y=",
|
||||
"owner": "nix-community",
|
||||
"repo": "nix-github-actions",
|
||||
"rev": "5163432afc817cf8bd1f031418d1869e4c9d5547",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-community",
|
||||
"repo": "nix-github-actions",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixos-hardware": {
|
||||
"locked": {
|
||||
"lastModified": 1723310128,
|
||||
@@ -404,7 +544,7 @@
|
||||
"nixos-mailserver": {
|
||||
"inputs": {
|
||||
"blobs": "blobs",
|
||||
"flake-compat": "flake-compat_2",
|
||||
"flake-compat": "flake-compat_3",
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
],
|
||||
@@ -457,6 +597,18 @@
|
||||
"type": "indirect"
|
||||
}
|
||||
},
|
||||
"nixpkgs-lib": {
|
||||
"locked": {
|
||||
"lastModified": 1717284937,
|
||||
"narHash": "sha256-lIbdfCsf8LMFloheeE6N31+BMIeixqyQWbSr2vk79EQ=",
|
||||
"type": "tarball",
|
||||
"url": "https://github.com/NixOS/nixpkgs/archive/eb9ceca17df2ea50a250b6b27f7bf6ab0186f198.tar.gz"
|
||||
},
|
||||
"original": {
|
||||
"type": "tarball",
|
||||
"url": "https://github.com/NixOS/nixpkgs/archive/eb9ceca17df2ea50a250b6b27f7bf6ab0186f198.tar.gz"
|
||||
}
|
||||
},
|
||||
"nixpkgs-unstable": {
|
||||
"locked": {
|
||||
"lastModified": 1723175592,
|
||||
@@ -473,6 +625,22 @@
|
||||
}
|
||||
},
|
||||
"nixpkgs_2": {
|
||||
"locked": {
|
||||
"lastModified": 1720542800,
|
||||
"narHash": "sha256-ZgnNHuKV6h2+fQ5LuqnUaqZey1Lqqt5dTUAiAnqH0QQ=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "feb2849fdeb70028c70d73b848214b00d324a497",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"ref": "nixos-unstable",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs_3": {
|
||||
"locked": {
|
||||
"lastModified": 1702272962,
|
||||
"narHash": "sha256-D+zHwkwPc6oYQ4G3A1HuadopqRwUY/JkMwHz1YF7j4Q=",
|
||||
@@ -488,7 +656,7 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs_3": {
|
||||
"nixpkgs_4": {
|
||||
"locked": {
|
||||
"lastModified": 1723282977,
|
||||
"narHash": "sha256-oTK91aOlA/4IsjNAZGMEBz7Sq1zBS0Ltu4/nIQdYDOg=",
|
||||
@@ -506,15 +674,15 @@
|
||||
"nixvim": {
|
||||
"inputs": {
|
||||
"devshell": "devshell",
|
||||
"flake-compat": "flake-compat_3",
|
||||
"flake-parts": "flake-parts",
|
||||
"flake-compat": "flake-compat_4",
|
||||
"flake-parts": "flake-parts_2",
|
||||
"git-hooks": "git-hooks",
|
||||
"home-manager": "home-manager_3",
|
||||
"nix-darwin": "nix-darwin",
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
],
|
||||
"treefmt-nix": "treefmt-nix"
|
||||
"treefmt-nix": "treefmt-nix_2"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1722925293,
|
||||
@@ -541,11 +709,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1723232379,
|
||||
"narHash": "sha256-F4Y3f9305aHGWKqAd3s2GyNRONdpDBuNuK4TCSdaHz8=",
|
||||
"lastModified": 1723391864,
|
||||
"narHash": "sha256-nX/aloqD8ZHcuPS7sk7fx1txTaXCi+o6iYm0mIX4uIE=",
|
||||
"owner": "nix-community",
|
||||
"repo": "plasma-manager",
|
||||
"rev": "22bea90404c5ff6457913a03c1a54a3caa5b1c57",
|
||||
"rev": "f843f4258eea57c5ba60f6ce1d96d12d6494b56e",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -554,9 +722,38 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"poetry2nix": {
|
||||
"inputs": {
|
||||
"flake-utils": [
|
||||
"authentik-nix",
|
||||
"flake-utils"
|
||||
],
|
||||
"nix-github-actions": "nix-github-actions",
|
||||
"nixpkgs": [
|
||||
"authentik-nix",
|
||||
"nixpkgs"
|
||||
],
|
||||
"systems": "systems_3",
|
||||
"treefmt-nix": "treefmt-nix"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1719549552,
|
||||
"narHash": "sha256-efvBV+45uQA6r7aov48H6MhvKp1QUIyIX5gh9oueUzs=",
|
||||
"owner": "nix-community",
|
||||
"repo": "poetry2nix",
|
||||
"rev": "4fd045cdb85f2a0173021a4717dc01d92d7ab2b2",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-community",
|
||||
"repo": "poetry2nix",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"root": {
|
||||
"inputs": {
|
||||
"agenix": "agenix",
|
||||
"authentik-nix": "authentik-nix",
|
||||
"deploy-rs": "deploy-rs",
|
||||
"disko": "disko",
|
||||
"firefox-gnome-theme": "firefox-gnome-theme",
|
||||
@@ -565,7 +762,7 @@
|
||||
"kvlibadwaita": "kvlibadwaita",
|
||||
"nixos-hardware": "nixos-hardware",
|
||||
"nixos-mailserver": "nixos-mailserver",
|
||||
"nixpkgs": "nixpkgs_3",
|
||||
"nixpkgs": "nixpkgs_4",
|
||||
"nixpkgs-unstable": "nixpkgs-unstable",
|
||||
"nixvim": "nixvim",
|
||||
"plasma-manager": "plasma-manager",
|
||||
@@ -576,11 +773,11 @@
|
||||
"secrets": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1723385164,
|
||||
"narHash": "sha256-/z4nBwpHsGWl1gmGv7FQQgoOcPwUaVzL7rfjI5nTOLg=",
|
||||
"lastModified": 1723415003,
|
||||
"narHash": "sha256-zSzDvI0sHayG5se7ALXhJhl41tConoWYbdqeow6OmBo=",
|
||||
"ref": "refs/heads/master",
|
||||
"rev": "b47efe67031e12a2d5560b94fdb4de7dca3df80c",
|
||||
"revCount": 24,
|
||||
"rev": "db951141cab2de0b4176f4f6fc42a50b30dd3950",
|
||||
"revCount": 26,
|
||||
"type": "git",
|
||||
"url": "ssh://git@git.vimium.com/jordan/nix-secrets.git"
|
||||
},
|
||||
@@ -620,6 +817,35 @@
|
||||
}
|
||||
},
|
||||
"systems_3": {
|
||||
"locked": {
|
||||
"lastModified": 1681028828,
|
||||
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"id": "systems",
|
||||
"type": "indirect"
|
||||
}
|
||||
},
|
||||
"systems_4": {
|
||||
"locked": {
|
||||
"lastModified": 1681028828,
|
||||
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"systems_5": {
|
||||
"locked": {
|
||||
"lastModified": 1681028828,
|
||||
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
|
||||
@@ -651,6 +877,28 @@
|
||||
}
|
||||
},
|
||||
"treefmt-nix": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"authentik-nix",
|
||||
"poetry2nix",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1718522839,
|
||||
"narHash": "sha256-ULzoKzEaBOiLRtjeY3YoGFJMwWSKRYOic6VNw2UyTls=",
|
||||
"owner": "numtide",
|
||||
"repo": "treefmt-nix",
|
||||
"rev": "68eb1dc333ce82d0ab0c0357363ea17c31ea1f81",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "numtide",
|
||||
"repo": "treefmt-nix",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"treefmt-nix_2": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"nixvim",
|
||||
@@ -673,7 +921,7 @@
|
||||
},
|
||||
"utils": {
|
||||
"inputs": {
|
||||
"systems": "systems_2"
|
||||
"systems": "systems_4"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1701680307,
|
||||
@@ -691,7 +939,7 @@
|
||||
},
|
||||
"utils_2": {
|
||||
"inputs": {
|
||||
"systems": "systems_3"
|
||||
"systems": "systems_5"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1709126324,
|
||||
|
@@ -6,6 +6,7 @@
|
||||
nixpkgs-unstable.url = "nixpkgs/nixos-unstable";
|
||||
# nixpkgs-master.url = "nixpkgs";
|
||||
agenix.url = "github:ryantm/agenix";
|
||||
authentik-nix.url = "github:nix-community/authentik-nix";
|
||||
deploy-rs.url = "github:serokell/deploy-rs";
|
||||
disko = {
|
||||
url = "github:nix-community/disko";
|
||||
|
@@ -6,7 +6,7 @@
|
||||
];
|
||||
|
||||
nixpkgs.overlays = [
|
||||
(import ../overlays/gnome)
|
||||
(import ../overlays/gnome.nix)
|
||||
];
|
||||
|
||||
services.printing.enable = true;
|
||||
|
@@ -55,7 +55,7 @@
|
||||
'';
|
||||
|
||||
nixpkgs.overlays = [
|
||||
(import ./../../overlays/libcamera)
|
||||
(import ./../../overlays/libcamera.nix)
|
||||
];
|
||||
|
||||
networking = {
|
||||
|
@@ -2,6 +2,7 @@
|
||||
|
||||
{
|
||||
imports = [
|
||||
self.inputs.authentik-nix.nixosModules.default
|
||||
./hardware-configuration.nix
|
||||
../server.nix
|
||||
];
|
||||
@@ -41,87 +42,21 @@
|
||||
|
||||
services.openssh.settings.PermitRootLogin = lib.mkForce "prohibit-password";
|
||||
|
||||
services.postgresql = {
|
||||
ensureUsers = [
|
||||
{
|
||||
name = "zitadel";
|
||||
ensureDBOwnership = true;
|
||||
ensureClauses = {
|
||||
superuser = true;
|
||||
};
|
||||
}
|
||||
];
|
||||
ensureDatabases = [ "zitadel" ];
|
||||
age.secrets."files/services/authentik/envfile" = {
|
||||
file = "${self.inputs.secrets}/files/services/authentik/envfile.age";
|
||||
};
|
||||
|
||||
age.secrets."files/services/zitadel/masterkey" = {
|
||||
file = "${self.inputs.secrets}/files/services/zitadel/masterkey.age";
|
||||
owner = "zitadel";
|
||||
group = "zitadel";
|
||||
};
|
||||
|
||||
systemd.services.zitadel = {
|
||||
requires = [ "postgresql.service" ];
|
||||
after = [ "postgresql.service" ];
|
||||
};
|
||||
|
||||
services.zitadel = {
|
||||
services.authentik = {
|
||||
enable = true;
|
||||
masterKeyFile = config.age.secrets."files/services/zitadel/masterkey".path;
|
||||
environmentFile = config.age.secrets."files/services/authentik/envfile".path;
|
||||
settings = {
|
||||
Database.postgres = {
|
||||
Host = "/run/postgresql";
|
||||
Port = 5432;
|
||||
Database = "zitadel";
|
||||
User = {
|
||||
Username = "zitadel";
|
||||
SSL.Mode = "disable";
|
||||
disable_startup_analytics = true;
|
||||
disable_update_check = true;
|
||||
};
|
||||
Admin = {
|
||||
ExistingDatabase = "zitadel";
|
||||
Username = "zitadel";
|
||||
SSL.Mode = "disable";
|
||||
};
|
||||
};
|
||||
ExternalDomain = "id.vimium.com";
|
||||
ExternalPort = 443;
|
||||
ExternalSecure = true;
|
||||
Machine = {
|
||||
Identification = {
|
||||
Hostname.Enabled = true;
|
||||
PrivateIp.Enabled = false;
|
||||
Webhook.Enabled = false;
|
||||
};
|
||||
};
|
||||
Port = 8081;
|
||||
WebAuthNName = "Vimium";
|
||||
};
|
||||
steps.FirstInstance = {
|
||||
InstanceName = "Vimium";
|
||||
Org.Name = "Vimium";
|
||||
Org.Human = {
|
||||
UserName = "jordan@vimium.com";
|
||||
FirstName = "Jordan";
|
||||
LastName = "Holt";
|
||||
Email = {
|
||||
Address = "jordan@vimium.com";
|
||||
Verified = true;
|
||||
};
|
||||
Password = "Password1!";
|
||||
PasswordChangeRequired = true;
|
||||
};
|
||||
LoginPolicy.AllowRegister = false;
|
||||
};
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts."id.vimium.com" = {
|
||||
nginx = {
|
||||
enable = true;
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."/" = {
|
||||
extraConfig = ''
|
||||
grpc_pass grpc://localhost:${builtins.toString config.services.zitadel.settings.Port};
|
||||
grpc_set_header Host $host:$server_port;
|
||||
'';
|
||||
host = "auth.vimium.com";
|
||||
};
|
||||
};
|
||||
|
||||
|
@@ -17,7 +17,6 @@ in {
|
||||
config = lib.mkIf cfg.enable {
|
||||
services.postgresql = {
|
||||
enable = true;
|
||||
enableJIT = true;
|
||||
initdbArgs = [
|
||||
"--allow-group-access"
|
||||
"--encoding=UTF8"
|
||||
|
@@ -118,8 +118,10 @@ in {
|
||||
serverAliases = [ "www.jdholt.com" ];
|
||||
extraConfig = nginxErrorPages + nginxEdgeHeaders + nginxStrictHeaders;
|
||||
locations."/skycam/snapshot.jpg" = {
|
||||
proxyPass = "http://skycam.mesh.vimium.net:8080/snapshot";
|
||||
extraConfig = ''
|
||||
set $backend "skycam.mesh.vimium.net:8080";
|
||||
|
||||
proxy_pass http://$backend/snapshot;
|
||||
proxy_cache skycam_cache;
|
||||
proxy_cache_valid any 10s;
|
||||
proxy_ignore_headers Cache-Control Expires Set-Cookie;
|
||||
|
Reference in New Issue
Block a user