infrastructure/machines/compute01/k-radius/default.nix
Tom Hubrecht 4716f8a398
All checks were successful
build configuration / build_compute01 (push) Successful in 1m6s
build configuration / build_storage01 (push) Successful in 44s
build configuration / build_web01 (push) Successful in 57s
npins update / npins_update (push) Successful in 46s
feat(modules): Replace dgn-secrets by age-secrets
2024-01-09 14:48:33 +01:00

62 lines
1.5 KiB
Nix

{ config, lib, ... }:
{
imports = [ ./module.nix ];
services.k-radius = {
enable = true;
settings = {
# URL to the Kanidm server
uri = "https://sso.dgnum.eu";
# verify the hostname of the Kanidm server
verify_hostnames = "true";
# Strict CA verification
verify_ca = "false";
verify_certificate = "false";
# Path to the kanidm ca
# Default vlans for groups that don't specify one.
radius_default_vlan = 99;
# A list of Kanidm groups which must be a member
# before they can authenticate via RADIUS.
radius_required_groups = [ "radius_access@sso.dgnum.eu" ];
# A mapping between Kanidm groups and VLANS
radius_groups = [
{
spn = "dgnum_members@idm.example.com";
vlan = 1;
}
{
spn = "dgnum_clients@idm.example.com";
vlan = 2;
}
];
};
authTokenFile = config.age.secrets."radius-auth_token_file".path;
privateKeyPasswordFile =
config.age.secrets."radius-private_key_password_file".path;
certs = builtins.listToAttrs (builtins.map (name:
lib.nameValuePair name
config.age.secrets."radius-${name}_pem_file".path) [
"ca"
"cert"
"dh"
"key"
]);
radiusClients = { };
};
age-secrets.matches."^radius-.*$" = { owner = "radius"; };
networking.firewall.allowedTCPPorts = [ 1812 ];
networking.firewall.allowedUDPPorts = [ 1812 ];
}