infrastructure/machines/nixos/compute01/librenms/default.nix

# SPDX-FileCopyrightText: 2024 Tom Hubrecht <tom.hubrecht@dgnum.eu>
#
# SPDX-License-Identifier: EUPL-1.2

{ config, pkgs, ... }:

let
  host = "nms.dgnum.eu";
in

{
  imports = [ ./module.nix ];

  services.librenms = {
    enable = true;

    package =
      (pkgs.librenms.override { inherit (config.services.librenms) dataDir logDir; }).overrideAttrs
        (old: {
          patches = (old.patches or [ ]) ++ [ ./kanidm.patch ];
          vendorHash = "sha256-J/whSL1keEZKkfOtHpkJ2vSrN/s+DpUGb6RBXpQZQXg=";
        });

    hostname = host;

    settings = {
      auth.socialite = {
        configs.kanidm = {
          listener = "\\SocialiteProviders\\Kanidm\\KanidmExtendSocialite";
          client_id = "$KANIDM_CLIENT_ID";
          client_secret = "$KANIDM_CLIENT_SECRET";
          redirect = "$KANIDM_REDIRECT_URI";
          base_url = "$KANIDM_BASE_URL";
        };
        default_role = "normal";
        register = true;
      };
    };

    database = {
      createLocally = true;
      passwordFile = config.age.secrets."librenms-database_password_file".path;
    };

    environmentFile = config.age.secrets."librenms-environment_file".path;

    nginx = {
      serverName = host;
      enableACME = true;
      forceSSL = true;
    };
  };

  age-secrets.autoMatch = [ "librenms" ];
}