infrastructure/machines/nixos/vault01/k-radius/default.nix

# SPDX-FileCopyrightText: 2024 Tom Hubrecht <tom.hubrecht@dgnum.eu>
#
# SPDX-License-Identifier: EUPL-1.2

{ config, lib, ... }:
let
  inherit (lib) genList;
in
{
  imports = [ ./module.nix ];

  services.k-radius = {
    enable = true;

    domain = "radius.dgnum.eu";

    radiusClients = {
      ap = {
        ipaddr = "0.0.0.0/0";
        secret = config.age.secrets."radius-ap-radius-secret_file".path;
      };
    };

    settings = {
      # URL to the Kanidm server
      uri = "https://sso.dgnum.eu";

      # verify the hostname of the Kanidm server
      verify_hostnames = "true";

      # Strict CA verification
      verify_ca = "false";
      verify_certificate = "false";

      # Path to the kanidm ca

      # Default vlans for groups that don't specify one.
      radius_default_vlan = 99;

      # A list of Kanidm groups which must be a member
      # before they can authenticate via RADIUS.
      radius_required_groups = [ "radius_access@sso.dgnum.eu" ];

      # A mapping between Kanidm groups and VLANS
      radius_groups = genList (id: rec {
        vlan = 4094 - id;
        spn = "vlan_${toString vlan}@sso.dgnum.eu";
      }) 850;
    };

    authTokenFile = config.age.secrets."radius-auth_token_file".path;
  };

  age-secrets.autoMatch = [ "radius" ];

  networking.firewall.allowedTCPPorts = [ 1812 ];
  networking.firewall.allowedUDPPorts = [ 1812 ];
}