forked from DGNum/infrastructure
Tom Hubrecht
88d9b8c3e3
Signed-off-by: Tom Hubrecht <tom.hubrecht@dgnum.eu> Acked-by: Ryan Lahfa <ryan.lahfa@dgnum.eu> Acked-by: Maurice Debray <maurice.debray@dgnum.eu> Acked-by: Lubin Bailly <lubin.bailly@dgnum.eu> Acked-by: Jean-Marc Gailis <jean-marc.gailis@dgnum.eu> as the legal authority, at the time of writing, in DGNum. Acked-by: Elias Coppens <elias.coppens@dgnum.eu> as a member, at the time of writing, of the DGNum executive counsel.
62 lines
1.4 KiB
Nix
62 lines
1.4 KiB
Nix
# SPDX-FileCopyrightText: 2024 Tom Hubrecht <tom.hubrecht@dgnum.eu>
|
|
#
|
|
# SPDX-License-Identifier: EUPL-1.2
|
|
|
|
{ config, ... }:
|
|
|
|
{
|
|
imports = [ ./module.nix ];
|
|
|
|
services.k-radius = {
|
|
enable = true;
|
|
|
|
domain = "radius.dgnum.eu";
|
|
|
|
radiusClients = {
|
|
ap = {
|
|
ipaddr = "0.0.0.0/0";
|
|
secret = config.age.secrets."radius-ap-radius-secret_file".path;
|
|
};
|
|
};
|
|
|
|
settings = {
|
|
# URL to the Kanidm server
|
|
uri = "https://sso.dgnum.eu";
|
|
|
|
# verify the hostname of the Kanidm server
|
|
verify_hostnames = "true";
|
|
|
|
# Strict CA verification
|
|
verify_ca = "false";
|
|
verify_certificate = "false";
|
|
|
|
# Path to the kanidm ca
|
|
|
|
# Default vlans for groups that don't specify one.
|
|
radius_default_vlan = 99;
|
|
|
|
# A list of Kanidm groups which must be a member
|
|
# before they can authenticate via RADIUS.
|
|
radius_required_groups = [ "radius_access@sso.dgnum.eu" ];
|
|
|
|
# A mapping between Kanidm groups and VLANS
|
|
radius_groups = [
|
|
{
|
|
spn = "dgnum_members@sso.dgnum.eu";
|
|
vlan = 1;
|
|
}
|
|
{
|
|
spn = "dgnum_clients@sso.dgnum.eu";
|
|
vlan = 2;
|
|
}
|
|
];
|
|
};
|
|
|
|
authTokenFile = config.age.secrets."radius-auth_token_file".path;
|
|
};
|
|
|
|
age-secrets.autoMatch = [ "radius" ];
|
|
|
|
networking.firewall.allowedTCPPorts = [ 1812 ];
|
|
networking.firewall.allowedUDPPorts = [ 1812 ];
|
|
}
|