feat: switch to kanidm instead

hosts/elisabeth/guests.nix

@@ -17,7 +17,7 @@
   vaultwardendomain = "pw.${config.secrets.secrets.global.domains.web}";
   spotifydomain = "spotify.${config.secrets.secrets.global.domains.web}";
   apispotifydomain = "api.spotify.${config.secrets.secrets.global.domains.web}";
-  autheliadomain = "auth.${config.secrets.secrets.global.domains.web}";
+  kanidmdomain = "auth.${config.secrets.secrets.global.domains.web}";
   ipOf = hostName: lib.net.cidr.host config.secrets.secrets.global.net.ips."${config.guests.${hostName}.nodeName}" config.secrets.secrets.global.net.privateSubnetv4;
 in {
   services.nginx = {
@@ -214,20 +214,20 @@ in {
       '';
     };
 
-    upstreams.authelia = {
-      servers."${ipOf "authelia"}:${toString nodes.elisabeth-authelia.config.services.authelia.instances.main.settings.server.port}" = {};
+    upstreams.kanidm = {
+      servers."${ipOf "kanidm"}:3000" = {};
 
       extraConfig = ''
-        zone authelia 64k ;
+        zone kanidm 64k ;
         keepalive 5 ;
       '';
     };
-    virtualHosts.${autheliadomain} = {
+    virtualHosts.${kanidmdomain} = {
       forceSSL = true;
       useACMEHost = "web";
-      locations."/".proxyPass = "http://authelia";
+      locations."/".proxyPass = "https://kanidm";
       extraConfig = ''
-        client_max_body_size 4G ;
+        proxy_ssl_verify off ;
       '';
     };
   };
@@ -268,7 +268,7 @@ in {
         ../../modules/config
         ../../modules/services/${guestName}.nix
         {
-          node.secretsDir = ./secrets/${guestName};
+          node.secretsDir = config.node.secretsDir + "/${guestName}";
           systemd.network.networks."10-${config.guests.${guestName}.networking.mainLinkName}" = {
             DHCP = lib.mkForce "no";
             address = [
@@ -319,7 +319,7 @@ in {
     // mkContainer "ollama" {}
     // mkContainer "ttrss" {}
     // mkContainer "yourspotify" {}
-    // mkContainer "authelia" {}
+    // mkContainer "kanidm" {}
     // mkContainer "nextcloud" {
       enablePanzer = true;
     }

hosts/elisabeth/secrets/kanidm/host.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIITsf7dXoAEyYeT2c95jRKKyUdMAT5dAovGVnbFOtyH3

modules/config/users.nix

@@ -30,6 +30,7 @@
     freshrss = uidGid 220;
     mongodb = uidGid 221;
     authelia-main = uidGid 222;
+    kanidm = uidGid 223;
     paperless = uidGid 315;
     systemd-oom = uidGid 300;
     systemd-coredump = uidGid 301;

modules/services/ddclient.nix

@@ -1,6 +1,6 @@
 {config, ...}: {
   age.secrets.cloudflare_token_dns = {
-    rekeyFile = "${config.node.secretsDir}/cloudflare_api_token.age";
+    rekeyFile = config.node.secretsDir + "/cloudflare_api_token.age";
     mode = "440";
   };
   # So we only update the A record

modules/services/gitea.nix

@@ -88,6 +88,7 @@ in {
         ENABLE_AUTO_REGISTRATION = true;
         REGISTER_EMAIL_CONFIRM = false;
         UPDATE_AVATAR = true;
+        USERNAME = "email";
       };
       # packages.ENABLED = true;
       repository = {
@@ -107,7 +108,8 @@ in {
         # port forwarding in elisabeth
       };
       service = {
-        DISABLE_REGISTRATION = false;
+        DISABLE_REGISTRATION = true;
+        ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
         SHOW_REGISTRATION_BUTTON = true;
         REGISTER_EMAIL_CONFIRM = false;
         ENABLE_NOTIFY_MAIL = true;
@@ -140,7 +142,7 @@ in {
         "--key"
         clientId
         "--auto-discover-url"
-        "https://auth.${config.secrets.secrets.global.domains.web}/.well-known/openid-configuration"
+        "https://auth.${config.secrets.secrets.global.domains.web}/oauth2/openid/${clientId}/.well-known/openid-configuration"
         "--required-claim-name"
         "groups"
         "--scopes"

modules/services/kanidm.nix

@@ -0,0 +1,42 @@
+{config, ...}: let
+  kanidmdomain = "auth.${config.secrets.secrets.global.domains.web}";
+in {
+  networking.firewall.allowedTCPPorts = [3000];
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/kanidm";
+      user = "kanidm";
+      group = "kanidm";
+      mode = "0700";
+    }
+  ];
+  age.secrets = {
+    kanidm-cert = {
+      rekeyFile = config.node.secretsDir + "/cert.age";
+      group = "kanidm";
+      mode = "440";
+    };
+    kanidm-key = {
+      rekeyFile = config.node.secretsDir + "/key.age";
+      group = "kanidm";
+      mode = "440";
+    };
+  };
+  services.kanidm = {
+    enableServer = true;
+    serverSettings = {
+      domain = kanidmdomain;
+      origin = "https://${kanidmdomain}";
+      tls_chain = config.age.secrets.kanidm-cert.path;
+      tls_key = config.age.secrets.kanidm-key.path;
+      bindaddress = "0.0.0.0:3000";
+      trust_x_forward_for = true;
+    };
+    enableClient = true;
+    clientSettings = {
+      uri = config.services.kanidm.serverSettings.origin;
+      verify_ca = true;
+      verify_hostnames = true;
+    };
+  };
+}

modules/services/yourspotify.nix

@@ -3,7 +3,7 @@
   age.secrets.spotify = {
     owner = "your_spotify";
     mode = "440";
-    rekeyFile = "${config.node.secretsDir}/yourspotify.age";
+    rekeyFile = config.node.secretsDir + "/yourspotify.age";
   };
   services.your_spotify = {
     #enable = true;

nix/hosts.nix

@@ -32,7 +32,7 @@ inputs: let
           nixpkgs.overlays = pkgs.overlays;
           nixpkgs.config = pkgs.config;
           node.name = name;
-          node.secretsDir = ../hosts/${name}/secrets;
+          node.secretsDir = ../. + "/hosts/${name}/secrets";
         }
         ../hosts/${name}
       ];