patrick/nix-config
1
1
Fork 0
Code Issues Pull requests Projects Wiki Activity

feat: paperless oauth

Browse source
This commit is contained in:
Patrick 2024-03-12 22:49:54 +01:00
parent 654b1c0318
commit 4f8a3c32bf
Signed by: patrick
GPG key ID: 451F95EFB8BECD0F
4 changed files with 49 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

BIN
hosts/elisabeth/secrets/kanidm/generated/oauth2-paperless.age Normal file
View file

Binary file not shown.

BIN
hosts/elisabeth/secrets/kanidm/secrets.nix.age
View file

Binary file not shown.

20
modules/services/kanidm.nix
View file

@ -33,6 +33,11 @@ in {
mode = "440";
group = "kanidm";
};
oauth2-paperless = {
generator.script = "alnum";
mode = "440";
group = "kanidm";
};
oauth2-forgejo = {
generator.script = "alnum";
mode = "440";
@ -60,6 +65,21 @@ in {
inherit (config.secrets.secrets.local.kanidm) persons;
groups."paperless.access" = {
members = ["paperless.admins"];
};
# currently not usable
groups."paperless.admins" = {
members = ["administrator"];
};
systems.oauth2.paperless = {
displayName = "paperless";
originUrl = "https://ppl.${config.secrets.secrets.global.domains.web}/";
basicSecretFile = config.age.secrets.oauth2-paperless.path;
scopeMaps."paperless.access" = ["openid" "email" "profile"];
preferShortUsername = true;
};
groups."nextcloud.access" = {
members = ["nextcloud.admins"];
};

29
modules/services/paperless.nix
View file

@ -1,4 +1,6 @@
{
pkgs,
nodes,
config,
lib,
...
@ -81,6 +83,22 @@ in {
PAPERLESS_CORS_ALLOWED_HOSTS = "https://${paperlessdomain}";
PAPERLESS_TRUSTED_PROXIES = lib.net.cidr.host config.secrets.secrets.global.net.ips.elisabeth config.secrets.secrets.global.net.privateSubnetv4;
PAPERLESS_APPS = "allauth.socialaccount.providers.openid_connect";
PAPERLESS_SOCIALACCOUNT_PROVIDERS = builtins.toJSON {
openid_connect = {
OAUTH_PKCE_PROVIDER = "True";
APPS = [
rec {
provider_id = "kanidm";
name = "Kanidm";
client_id = "paperless";
settings.server_url = "https://auth.${config.secrets.secrets.global.domains.web}/oauth2/openid/${client_id}/.well-known/openid-configuration";
}
];
};
};
# let nginx do all the compression
PAPERLESS_ENABLE_COMPRESSION = false;
PAPERLESS_CONSUMER_ENABLE_BARCODES = true;
@ -110,4 +128,15 @@ in {
mode = "0770";
}
];
# Mirror the original oauth2 secret
age.secrets.paperless-oauth2-client-secret = {
inherit (nodes.elisabeth-kanidm.config.age.secrets.oauth2-paperless) rekeyFile;
mode = "440";
group = "paperless";
};
systemd.services.paperless-web.script = lib.mkBefore ''
paperlessClientSecret=$(< ${config.age.secrets.paperless-oauth2-client-secret.path})
export PAPERLESS_SOCIALACCOUNT_PROVIDERS="$( <<< $PAPERLESS_SOCIALACCOUNT_PROVIDERS ${pkgs.jq}/bin/jq -c --arg paperlessClientSecret "$paperlessClientSecret" '.openid_connect.APPS.[0].secret = $paperlessClientSecret')"
'';
}