infrastructure/machines/vault01/k-radius/default.nix
Tom Hubrecht ccfbc4be42
Some checks failed
build configuration / build_rescue01 (push) Successful in 1m7s
build configuration / build_storage01 (push) Successful in 1m9s
build configuration / build_web02 (push) Successful in 1m8s
build configuration / build_compute01 (push) Successful in 1m29s
lint / check (push) Successful in 26s
build configuration / build_web01 (push) Successful in 1m36s
build configuration / build_vault01 (push) Failing after 8m54s
feat(radius): Move configuration from compute01 to vaul01
2024-04-08 22:21:17 +02:00

61 lines
1.4 KiB
Nix

{ config, lib, ... }:
{
imports = [ ./module.nix ];
services.k-radius = {
enable = true;
settings = {
# URL to the Kanidm server
uri = "https://sso.dgnum.eu";
# verify the hostname of the Kanidm server
verify_hostnames = "true";
# Strict CA verification
verify_ca = "false";
verify_certificate = "false";
# Path to the kanidm ca
# Default vlans for groups that don't specify one.
radius_default_vlan = 99;
# A list of Kanidm groups which must be a member
# before they can authenticate via RADIUS.
radius_required_groups = [ "radius_access@sso.dgnum.eu" ];
# A mapping between Kanidm groups and VLANS
radius_groups = [
{
spn = "dgnum_members@sso.dgnum.eu";
vlan = 1;
}
{
spn = "dgnum_clients@sso.dgnum.eu";
vlan = 2;
}
];
};
authTokenFile = config.age.secrets."radius-auth_token_file".path;
privateKeyPasswordFile = config.age.secrets."radius-private_key_password_file".path;
certs = builtins.listToAttrs (
builtins.map (name: lib.nameValuePair name config.age.secrets."radius-${name}_pem_file".path) [
"ca"
"cert"
"dh"
"key"
]
);
radiusClients = { };
};
age-secrets.autoMatch = [ "radius" ];
networking.firewall.allowedTCPPorts = [ 1812 ];
networking.firewall.allowedUDPPorts = [ 1812 ];
}