dotfiles/systems/jeeves/kanidm.md

Kanidm on Jeeves

Kanidm is served at https://auth.tmmworkshop.com. Portal terminates public HTTPS and forwards requests over Tailscale to Jeeves on port 8443, verifying Jeeves's TLS certificate. Only the Tailscale interface exposes that backend port.

The service module is automatically imported by services/default.nix. services/kanidm.nix pins Kanidm to the 1.11 release series; review the upgrade guide before changing that series. The flake lock determines the patch release.

Before deployment

1. Point auth.tmmworkshop.com at Portal's public address, using the same DNS arrangement as gitea.tmmworkshop.com. Port 80 must reach Portal for ACME.
2. Enable HTTPS certificates in Tailscale. Jeeves must be able to obtain a certificate for jeeves.taile39c31.ts.net.
3. Allow Portal to reach Jeeves on TCP 8443 in your Tailscale policy.

The trusted proxy address in services/kanidm.nix is Portal's current Tailscale IPv4 address, 100.80.102.33. Update it if Portal is re-enrolled with a new address. HAProxy connects over IPv4 and replaces incoming X-Forwarded-For headers.

Deploy

Ensure the new Nix file is tracked by Git before using this Git-backed flake. From this repository, using the existing SSH aliases:

nixos-rebuild switch --flake .#jeeves --target-host jeeves --sudo
nixos-rebuild switch --flake .#portal-1 --target-host portal-1 --sudo

Deploy Jeeves first, then Portal. Portal manages the public Let's Encrypt certificate. kanidm-tls.service on Jeeves obtains the backend certificate and checks for renewal daily, restarting Kanidm only when the certificate changes. Private keys are generated at runtime and never stored in this repository or the Nix store.

On Jeeves, check startup:

sudo systemctl status kanidm-tls.service kanidm.service
sudo journalctl -u kanidm-tls.service -u kanidm.service -n 100

If the initial certificate request fails, fix the Tailscale HTTPS configuration and run sudo systemctl restart kanidm.service; its dependency retries the certificate request. A successful oneshot certificate service normally appears as inactive after finishing.

After both hosts are deployed:

curl --fail https://auth.tmmworkshop.com/status

First login

On Jeeves, recover the initial administrator passwords interactively:

sudo kanidmd recover-account admin
sudo kanidmd recover-account idm_admin
kanidm login --name idm_admin
kanidm person create richie "Richie"
kanidm person credential create-reset-token richie

Store the recovered passwords securely. Follow the reset URL to enroll your personal account's passkey. admin manages the Kanidm server; idm_admin manages people, groups, and application integrations. Creating richie does not automatically grant administrator rights. The client is installed and configured to use https://auth.tmmworkshop.com.

Register each website as its own OAuth2/OIDC client and each backend identity as a service account, then grant application scopes through groups. This deployment does not create application clients or change existing sites' login settings. See the OAuth2 guide and service-account guide.

Storage and recovery

• Database: /var/lib/kanidm/kanidm.db on Jeeves's existing ZFS /var filesystem.
• Online backups: /var/lib/kanidm/backups, daily at 02:30, retaining 14.
• Backend certificate and key: /var/lib/kanidm-tls, readable by Kanidm.
• Server configuration: /etc/kanidm/server.toml.

The existing root_pool/var snapshot policy covers the database and backups. Copy backups off Jeeves as part of disaster recovery; local snapshots do not protect against loss of the host. Follow Kanidm's backup and restore instructions.

The configured identity domain and origin are both auth.tmmworkshop.com. Changing them after enrollment can affect passkeys and application integrations; follow the domain rename guide.