102 lines
3.3 KiB
Nix
102 lines
3.3 KiB
Nix
{ config, pkgs, ... }:
|
|
let
|
|
certificateDir = "/var/lib/kanidm-tls";
|
|
in
|
|
{
|
|
services.kanidm = {
|
|
# Pin the minor release: Kanidm upgrades require following its upgrade guide.
|
|
package = pkgs.kanidm_1_11;
|
|
server = {
|
|
enable = true;
|
|
settings = {
|
|
domain = "auth.tmmworkshop.com";
|
|
origin = "https://auth.tmmworkshop.com";
|
|
bindaddress = "0.0.0.0:8443";
|
|
db_fs_type = "zfs";
|
|
tls_chain = "${certificateDir}/certificate.pem";
|
|
tls_key = "${certificateDir}/private-key.pem";
|
|
|
|
# Only Portal may supply the original client address. HAProxy replaces
|
|
# X-Forwarded-For, so clients cannot supply a forged address themselves.
|
|
http_client_address_info.x-forward-for = [ "100.80.102.33" ];
|
|
|
|
# /var/lib/kanidm is on root_pool/var, which is already snapshotted.
|
|
online_backup = {
|
|
schedule = "30 2 * * *";
|
|
versions = 14;
|
|
};
|
|
};
|
|
};
|
|
client = {
|
|
enable = true;
|
|
settings.uri = "https://auth.tmmworkshop.com";
|
|
};
|
|
};
|
|
|
|
systemd = {
|
|
services = {
|
|
kanidm = {
|
|
requires = [ "kanidm-tls.service" ];
|
|
after = [ "kanidm-tls.service" ];
|
|
};
|
|
|
|
# Kanidm requires TLS even behind HAProxy. Use Jeeves's Tailscale
|
|
# certificate so Portal can verify both the CA and the backend hostname.
|
|
# HTTPS certificates must be enabled in the Tailscale admin console.
|
|
kanidm-tls = {
|
|
description = "Obtain and renew Kanidm's backend TLS certificate";
|
|
requires = [ "tailscaled.service" ];
|
|
wants = [ "tailscaled-autoconnect.service" ];
|
|
after = [
|
|
"tailscaled.service"
|
|
"tailscaled-autoconnect.service"
|
|
];
|
|
path = [
|
|
config.services.tailscale.package
|
|
pkgs.coreutils
|
|
pkgs.systemd
|
|
];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
User = "root";
|
|
Group = "kanidm";
|
|
StateDirectory = "kanidm-tls";
|
|
StateDirectoryMode = "0750";
|
|
RuntimeDirectory = "kanidm-tls";
|
|
RuntimeDirectoryMode = "0700";
|
|
UMask = "0077";
|
|
TimeoutStartSec = "2min";
|
|
};
|
|
script = ''
|
|
set -euo pipefail
|
|
tailscale cert --min-validity 720h \
|
|
--cert-file /run/kanidm-tls/certificate.pem \
|
|
--key-file /run/kanidm-tls/private-key.pem \
|
|
jeeves.taile39c31.ts.net
|
|
|
|
if ! cmp -s /run/kanidm-tls/certificate.pem ${certificateDir}/certificate.pem \
|
|
|| ! cmp -s /run/kanidm-tls/private-key.pem ${certificateDir}/private-key.pem; then
|
|
install -m 0640 -o root -g kanidm /run/kanidm-tls/certificate.pem ${certificateDir}/certificate.pem
|
|
install -m 0640 -o root -g kanidm /run/kanidm-tls/private-key.pem ${certificateDir}/private-key.pem
|
|
|
|
# The NixOS service bind-mounts the certificate files, so restart to
|
|
# pick up renewals. Do not wait on a service that depends on this one.
|
|
if systemctl is-active --quiet kanidm.service; then
|
|
systemctl --no-block try-restart kanidm.service
|
|
fi
|
|
fi
|
|
'';
|
|
};
|
|
};
|
|
|
|
timers.kanidm-tls = {
|
|
wantedBy = [ "timers.target" ];
|
|
timerConfig = {
|
|
OnCalendar = "daily";
|
|
Persistent = true;
|
|
RandomizedDelaySec = "1h";
|
|
};
|
|
};
|
|
};
|
|
}
|