diff options
| -rw-r--r-- | ops/machines/whitby/default.nix | 35 | ||||
| -rw-r--r-- | ops/modules/www/auth.tvl.fyi.nix | 24 | ||||
| -rw-r--r-- | ops/secrets/keycloak-db.age | bin | 0 -> 589 bytes | |||
| -rw-r--r-- | ops/secrets/secrets.nix | 1 |
4 files changed, 59 insertions, 1 deletions
diff --git a/ops/machines/whitby/default.nix b/ops/machines/whitby/default.nix index dbd8c61640..045e037fda 100644 --- a/ops/machines/whitby/default.nix +++ b/ops/machines/whitby/default.nix @@ -23,6 +23,7 @@ in { "${depot.path}/ops/modules/tvl-slapd/default.nix" "${depot.path}/ops/modules/tvl-sso/default.nix" "${depot.path}/ops/modules/www/atward.tvl.fyi.nix" + "${depot.path}/ops/modules/www/auth.tvl.fyi.nix" "${depot.path}/ops/modules/www/b.tvl.fyi.nix" "${depot.path}/ops/modules/www/cache.tvl.su.nix" "${depot.path}/ops/modules/www/cl.tvl.fyi.nix" @@ -210,6 +211,7 @@ in { gerrit-queue.file = secretFile "gerrit-queue"; grafana.file = secretFile "grafana"; irccat.file = secretFile "irccat"; + keycloak-db.file = secretFile "keycloak-db"; nix-cache-priv.file = secretFile "nix-cache-priv"; owothia.file = secretFile "owothia"; panettone.file = secretFile "panettone"; @@ -417,8 +419,9 @@ in { services.postgresqlBackup = { enable = true; databases = [ - "tvldb" + "keycloak" "panettone" + "tvldb" ]; }; @@ -546,9 +549,39 @@ in { }]; }; }; + # Contains GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET. systemd.services.grafana.serviceConfig.EnvironmentFile = "/run/agenix/grafana"; + services.keycloak = { + enable = true; + httpPort = "5925"; # "kycl" + frontendUrl = "https://auth.tvl.fyi/auth/"; + + database = { + type = "postgresql"; + passwordFile = "/run/agenix/keycloak-db"; + createLocally = false; + }; + + # Configure Keycloak to look at forwarded headers from the reverse + # proxy. + extraConfig = { + "subsystem=undertow" = { + "server=default-server" = { + "http-listener=default" = { + proxy-address-forwarding = "true"; + }; + }; + }; + }; + }; + + # Allow Keycloak access to the LDAP module by forcing in the JVM + # configuration + systemd.services.keycloak.environment.PREPEND_JAVA_OPTS = + "--add-exports=java.naming/com.sun.jndi.ldap=ALL-UNNAMED"; + security.sudo.extraRules = [ { groups = ["wheel"]; diff --git a/ops/modules/www/auth.tvl.fyi.nix b/ops/modules/www/auth.tvl.fyi.nix new file mode 100644 index 0000000000..e0c031bf70 --- /dev/null +++ b/ops/modules/www/auth.tvl.fyi.nix @@ -0,0 +1,24 @@ +{ config, ... }: + +{ + imports = [ + ./base.nix + ]; + + config = { + services.nginx.virtualHosts."auth.tvl.fyi" = { + serverName = "auth.tvl.fyi"; + enableACME = true; + forceSSL = true; + + extraConfig = '' + location / { + proxy_pass http://localhost:${config.services.keycloak.httpPort}; + proxy_set_header X-Forwarded-For $remote_addr; + proxy_set_header X-Forwarded-Proto https; + proxy_set_header Host $host; + } + ''; + }; + }; +} diff --git a/ops/secrets/keycloak-db.age b/ops/secrets/keycloak-db.age new file mode 100644 index 0000000000..5942bf24c2 --- /dev/null +++ b/ops/secrets/keycloak-db.age Binary files differdiff --git a/ops/secrets/secrets.nix b/ops/secrets/secrets.nix index 825b1caf2c..57cd6598f5 100644 --- a/ops/secrets/secrets.nix +++ b/ops/secrets/secrets.nix @@ -24,6 +24,7 @@ in { "gerrit-queue.age" = default; "grafana.age" = default; "irccat.age" = default; + "keycloak-db.age" = default; "nix-cache-priv.age" = default; "nix-cache-pub.age" = default; "owothia.age" = default; |