feat(kanidm): add Kanidm service configuration and documentation

systems/jeeves/services/kanidm.nix

@@ -0,0 +1,101 @@
+{ config, pkgs, ... }:
+let
+  certificateDir = "/var/lib/kanidm-tls";
+in
+{
+  services.kanidm = {
+    # Pin the minor release: Kanidm upgrades require following its upgrade guide.
+    package = pkgs.kanidm_1_11;
+    server = {
+      enable = true;
+      settings = {
+        domain = "auth.tmmworkshop.com";
+        origin = "https://auth.tmmworkshop.com";
+        bindaddress = "0.0.0.0:8443";
+        db_fs_type = "zfs";
+        tls_chain = "${certificateDir}/certificate.pem";
+        tls_key = "${certificateDir}/private-key.pem";
+
+        # Only Portal may supply the original client address. HAProxy replaces
+        # X-Forwarded-For, so clients cannot supply a forged address themselves.
+        http_client_address_info.x-forward-for = [ "100.80.102.33" ];
+
+        # /var/lib/kanidm is on root_pool/var, which is already snapshotted.
+        online_backup = {
+          schedule = "30 2 * * *";
+          versions = 14;
+        };
+      };
+    };
+    client = {
+      enable = true;
+      settings.uri = "https://auth.tmmworkshop.com";
+    };
+  };
+
+  systemd = {
+    services = {
+      kanidm = {
+        requires = [ "kanidm-tls.service" ];
+        after = [ "kanidm-tls.service" ];
+      };
+
+      # Kanidm requires TLS even behind HAProxy. Use Jeeves's Tailscale
+      # certificate so Portal can verify both the CA and the backend hostname.
+      # HTTPS certificates must be enabled in the Tailscale admin console.
+      kanidm-tls = {
+        description = "Obtain and renew Kanidm's backend TLS certificate";
+        requires = [ "tailscaled.service" ];
+        wants = [ "tailscaled-autoconnect.service" ];
+        after = [
+          "tailscaled.service"
+          "tailscaled-autoconnect.service"
+        ];
+        path = [
+          config.services.tailscale.package
+          pkgs.coreutils
+          pkgs.systemd
+        ];
+        serviceConfig = {
+          Type = "oneshot";
+          User = "root";
+          Group = "kanidm";
+          StateDirectory = "kanidm-tls";
+          StateDirectoryMode = "0750";
+          RuntimeDirectory = "kanidm-tls";
+          RuntimeDirectoryMode = "0700";
+          UMask = "0077";
+          TimeoutStartSec = "2min";
+        };
+        script = ''
+          set -euo pipefail
+          tailscale cert --min-validity 720h \
+            --cert-file /run/kanidm-tls/certificate.pem \
+            --key-file /run/kanidm-tls/private-key.pem \
+            jeeves.taile39c31.ts.net
+
+          if ! cmp -s /run/kanidm-tls/certificate.pem ${certificateDir}/certificate.pem \
+            || ! cmp -s /run/kanidm-tls/private-key.pem ${certificateDir}/private-key.pem; then
+            install -m 0640 -o root -g kanidm /run/kanidm-tls/certificate.pem ${certificateDir}/certificate.pem
+            install -m 0640 -o root -g kanidm /run/kanidm-tls/private-key.pem ${certificateDir}/private-key.pem
+
+            # The NixOS service bind-mounts the certificate files, so restart to
+            # pick up renewals. Do not wait on a service that depends on this one.
+            if systemctl is-active --quiet kanidm.service; then
+              systemctl --no-block try-restart kanidm.service
+            fi
+          fi
+        '';
+      };
+    };
+
+    timers.kanidm-tls = {
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        OnCalendar = "daily";
+        Persistent = true;
+        RandomizedDelaySec = "1h";
+      };
+    };
+  };
+}