cst1/infrastructure
1
0
Fork 0
forked from DGNum/infrastructure
Code Pull requests Activity

fix(kanidm): Revert switch to simpleProxies

Browse source 
As we proxy to an https endpoint, this was not supported
This commit is contained in:
Tom Hubrecht 2024-10-12 22:11:34 +02:00
parent 9ea51137fc
commit 06653220bb
Signed by: thubrecht
SSH key fingerprint: SHA256:r+nK/SIcWlJ0zFZJGHtlAoRwq1Rm+WcKAm5ADYMoQPc
1 changed files with 41 additions and 31 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

22
machines/compute01/kanidm/default.nix
View file

@ -8,9 +8,8 @@
let let
inherit (lib) escapeRegex concatStringsSep; inherit (lib) escapeRegex concatStringsSep;
host = "sso.dgnum.eu"; domain = "sso.dgnum.eu";
port = 8443; port = 8443;
domain = host;
cert = config.security.acme.certs.${domain}; cert = config.security.acme.certs.${domain};
@ -41,7 +40,7 @@ in
origin = "https://${domain}"; origin = "https://${domain}";
bindaddress = "127.0.0.1:8443"; bindaddress = "127.0.0.1:${builtins.toString port}";
ldapbindaddress = "0.0.0.0:636"; ldapbindaddress = "0.0.0.0:636";
trust_x_forward_for = true; trust_x_forward_for = true;
@ -53,9 +52,18 @@ in
users.users.kanidm.extraGroups = [ cert.group ]; users.users.kanidm.extraGroups = [ cert.group ];
dgn-web.simpleProxies.kanidm = { dgn-web.internalPorts.kanidm = port;
inherit host port;
vhostConfig.locations."/".extraConfig = '' services.nginx = {
enable = true;
virtualHosts.${domain} = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "https://127.0.0.1:${builtins.toString port}";
extraConfig = ''
if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) { if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {
return 444; return 444;
} }
@ -88,6 +96,8 @@ in
} }
''; '';
}; };
};
};
networking.firewall.allowedTCPPorts = [ 636 ]; networking.firewall.allowedTCPPorts = [ 636 ];
networking.firewall.allowedUDPPorts = [ 636 ]; networking.firewall.allowedUDPPorts = [ 636 ];