forked from DGNum/infrastructure
106 lines
2.7 KiB
Nix
106 lines
2.7 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
nixpkgs,
|
|
...
|
|
}:
|
|
|
|
let
|
|
inherit (lib) escapeRegex concatStringsSep;
|
|
|
|
domain = "sso.dgnum.eu";
|
|
port = 8443;
|
|
|
|
cert = config.security.acme.certs.${domain};
|
|
|
|
allowedDomains = builtins.map escapeRegex (
|
|
(builtins.map (s: "${s}.dgnum.eu") [
|
|
# DGNum subdomains
|
|
"cloud"
|
|
"git"
|
|
"videos"
|
|
"social"
|
|
"demarches"
|
|
"netbird"
|
|
])
|
|
++ [
|
|
# Extra domains
|
|
"netbird-beta.hubrecht.ovh"
|
|
]
|
|
);
|
|
in
|
|
{
|
|
services.kanidm = {
|
|
enableServer = true;
|
|
|
|
package = nixpkgs.unstable.kanidm;
|
|
|
|
serverSettings = {
|
|
inherit domain;
|
|
|
|
origin = "https://${domain}";
|
|
|
|
bindaddress = "127.0.0.1:${builtins.toString port}";
|
|
ldapbindaddress = "0.0.0.0:636";
|
|
|
|
trust_x_forward_for = true;
|
|
|
|
tls_chain = "${cert.directory}/fullchain.pem";
|
|
tls_key = "${cert.directory}/key.pem";
|
|
};
|
|
};
|
|
|
|
users.users.kanidm.extraGroups = [ cert.group ];
|
|
|
|
dgn-web.internalPorts.kanidm = port;
|
|
|
|
services.nginx = {
|
|
enable = true;
|
|
|
|
virtualHosts.${domain} = {
|
|
enableACME = true;
|
|
forceSSL = true;
|
|
locations."/" = {
|
|
proxyPass = "https://127.0.0.1:${builtins.toString port}";
|
|
|
|
extraConfig = ''
|
|
if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {
|
|
return 444;
|
|
}
|
|
|
|
set $origin $http_origin;
|
|
|
|
if ($origin !~ '^https?://(${concatStringsSep "|" allowedDomains})$') {
|
|
set $origin 'https://${domain}';
|
|
}
|
|
|
|
proxy_hide_header Access-Control-Allow-Origin;
|
|
|
|
if ($request_method = 'OPTIONS') {
|
|
add_header 'Access-Control-Allow-Origin' "$origin" always;
|
|
add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
|
|
add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
|
|
add_header 'Access-Control-Allow-Credentials' 'true' always;
|
|
|
|
add_header Access-Control-Max-Age 1728000;
|
|
add_header Content-Type 'text/plain charset=UTF-8';
|
|
add_header Content-Length 0;
|
|
return 204;
|
|
}
|
|
|
|
if ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
|
|
add_header Access-Control-Allow-Origin "$origin" always;
|
|
add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
|
|
add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
|
|
add_header Access-Control-Allow-Credentials true always;
|
|
}
|
|
'';
|
|
};
|
|
};
|
|
};
|
|
|
|
networking.firewall.allowedTCPPorts = [ 636 ];
|
|
networking.firewall.allowedUDPPorts = [ 636 ];
|
|
|
|
dgn-backups.jobs.kanidm.settings.paths = [ "/var/lib/kanidm" ];
|
|
}
|