mdebray/tvl-depot
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

chore(ops/modules): remove oauth2_proxy module

Browse source 
This was dropped from whitby itself in cl/8905, but didn't drop the
module because we were worried someone else might still be using it.

However, this relies on the "oauth2-proxy" client ID, which only has the
following supported redirect uris (as per ops/keycloak/clients.tf):

 - https://login.tvl.fyi/oauth2/callback
 - http://localhost:4774/oauth2/callback

… which means, noone can really run this properly anyways, so let's
drop it.

We can always restore it from git.

Change-Id: I7d700f59a62cce1254ad4ba0792a7d7b3960b769
Reviewed-on: https://cl.tvl.fyi/c/depot/+/8913
Reviewed-by: sterni <sternenseemann@systemli.org>
Tested-by: BuildkiteCI
Autosubmit: flokli <flokli@flokli.de>
This commit is contained in:
Florian Klink 2023-07-02 00:35:31 +02:00 committed by clbot
parent 2aaabb709f
commit 5f42c8132d
1 changed files with 0 additions and 60 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

60
ops/modules/oauth2_proxy.nix
View file

@ -1,60 +0,0 @@
# Configuration for oauth2_proxy, which is used as a handler for nginx
# auth-request setups.
#
# This module exports a helper function at
# `config.services.depot.oauth2_proxy.withAuth` that can be wrapped
# around nginx server configuration blocks to configure their
# authentication setup.
{ config, depot, pkgs, lib, ... }:
let
description = "OAuth2 proxy to authenticate TVL services";
cfg = config.services.depot.oauth2_proxy;
configFile = pkgs.writeText "oauth2_proxy.cfg" ''
email_domains = [ "*" ]
http_address = "127.0.0.1:${toString cfg.port}"
provider = "keycloak-oidc"
client_id = "oauth2-proxy"
oidc_issuer_url = "https://auth.tvl.fyi/auth/realms/TVL"
reverse_proxy = true
set_xauthrequest = true
'';
# Depend on the Keycloak service if it is running on the same
# machine.
depends_on = lib.optional config.services.keycloak.enable "keycloak.service";
in
{
options.services.depot.oauth2_proxy = {
enable = lib.mkEnableOption description;
port = lib.mkOption {
description = "Port to listen on";
type = lib.types.int;
default = 2884; # "auth"
};
secretsFile = lib.mkOption {
type = lib.types.str;
description = "EnvironmentFile from which to load secrets";
default = config.age.secretsDir + "/oauth2_proxy";
};
};
config = lib.mkIf cfg.enable {
systemd.services.oauth2_proxy = {
inherit description;
after = depends_on;
wants = depends_on;
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Restart = "always";
RestartSec = "5s";
DynamicUser = true;
EnvironmentFile = cfg.secretsFile;
ExecStart = "${pkgs.oauth2-proxy}/bin/oauth2-proxy --config ${configFile}";
};
};
};
}