forked from DGNum/infrastructure
Tom Hubrecht
ecbad0a638
This adds subdirectories for the different types of systems, for the modules and the machines
58 lines
1.3 KiB
Nix
58 lines
1.3 KiB
Nix
{ config, ... }:
|
|
|
|
{
|
|
imports = [ ./module.nix ];
|
|
|
|
services.k-radius = {
|
|
enable = true;
|
|
|
|
domain = "radius.dgnum.eu";
|
|
|
|
radiusClients = {
|
|
ap = {
|
|
ipaddr = "0.0.0.0/0";
|
|
secret = config.age.secrets."radius-ap-radius-secret_file".path;
|
|
};
|
|
};
|
|
|
|
settings = {
|
|
# URL to the Kanidm server
|
|
uri = "https://sso.dgnum.eu";
|
|
|
|
# verify the hostname of the Kanidm server
|
|
verify_hostnames = "true";
|
|
|
|
# Strict CA verification
|
|
verify_ca = "false";
|
|
verify_certificate = "false";
|
|
|
|
# Path to the kanidm ca
|
|
|
|
# Default vlans for groups that don't specify one.
|
|
radius_default_vlan = 99;
|
|
|
|
# A list of Kanidm groups which must be a member
|
|
# before they can authenticate via RADIUS.
|
|
radius_required_groups = [ "radius_access@sso.dgnum.eu" ];
|
|
|
|
# A mapping between Kanidm groups and VLANS
|
|
radius_groups = [
|
|
{
|
|
spn = "dgnum_members@sso.dgnum.eu";
|
|
vlan = 1;
|
|
}
|
|
{
|
|
spn = "dgnum_clients@sso.dgnum.eu";
|
|
vlan = 2;
|
|
}
|
|
];
|
|
};
|
|
|
|
authTokenFile = config.age.secrets."radius-auth_token_file".path;
|
|
};
|
|
|
|
age-secrets.autoMatch = [ "radius" ];
|
|
|
|
networking.firewall.allowedTCPPorts = [ 1812 ];
|
|
networking.firewall.allowedUDPPorts = [ 1812 ];
|
|
}
|