merge config with unit for keycloak

all-packages.nix

@@ -34,10 +34,7 @@ let
     PHPFPMSiteConfig = callPackage ./php-fpm/siteconfig.nix {inherit utils;};
     mkPHPFPMSiteConfig = callPackage ./php-fpm/mksiteconfig.nix {inherit PHPFPMSiteConfig;};
 
-    KeycloakConfig = callPackage ./keycloak/config.nix {inherit utils;};
+    mkKeycloakService = callPackage ./keycloak/unit.nix {inherit utils;};
-    mkKeycloakConfig = callPackage ./keycloak/mkconfig.nix {inherit KeycloakConfig;};
-    KeycloakService = callPackage ./keycloak/unit.nix {inherit utils;};
-    mkKeycloakService = callPackage ./keycloak/mkunit.nix {inherit KeycloakService;};
 
     mkKeycloakHaproxyService = callPackage ./keycloak-haproxy/unit.nix {inherit utils;};
 

keycloak-cli-config/unit.nix

@@ -14,7 +14,8 @@
 , keys
 , debug ? false
 }:
-{...}:
+{ ...
+}:
 
 # https://github.com/adorsys/keycloak-config-cli
 

keycloak/config.nix

@@ -1,62 +0,0 @@
-{ stdenv
-, pkgs
-, lib
-, utils
-}:
-{ configDir ? "/etc/keycloak"
-, configFile ? "keycloak.conf"
-, logLevel ? "INFO"
-, metricsEnabled ? false
-, hostname
-
-, dbType ? "postgres"
-, dbUsername ? "keycloak"
-, dbHost ? x: "localhost"
-, dbPort ? "5432"
-, dbDatabase ? "keycloak"
-}:
-{ KeycloakPostgresDB
-}:
-
-assert lib.assertOneOf "dbType" dbType ["postgres"];
-
-utils.mkConfigFile {
-  name = configFile;
-  dir = configDir;
-  content = ''
-  # The password of the database user is given by an environment variable.
-  db=${dbType}
-  db-username=${dbUsername}
-  db-url-host=${dbHost {inherit KeycloakPostgresDB;}}
-  db-url-port=${dbPort}
-  db-url-database=${dbDatabase}
-  # db-url-properties=  # Would be used for ssl, see https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/web-apps/keycloak.nix#L491
-  
-  # Observability
-  
-  # If the server should expose metrics and healthcheck endpoints.
-  metrics-enabled=${if metricsEnabled then "true" else "false"}
-  
-  # HTTP
-  
-  # The file path to a server certificate or certificate chain in PEM format.
-  #https-certificate-file=''${kc.home.dir}conf/server.crt.pem
-  
-  # The file path to a private key in PEM format.
-  #https-certificate-key-file=''${kc.home.dir}conf/server.key.pem
-  
-  # The proxy address forwarding mode if the server is behind a reverse proxy.
-  # https://www.keycloak.org/server/reverseproxy
-  proxy=edge
-  
-  # Do not attach route to cookies and rely on the session affinity capabilities from reverse proxy
-  #spi-sticky-session-encoder-infinispan-should-attach-route=false
-  
-  # Hostname for the Keycloak server.
-  hostname=${hostname}
-  
-  spi-x509cert-lookup-provider=haproxy
-  
-  log-level=${logLevel}
-  '';
-}

keycloak/mkconfig.nix

@@ -1,32 +0,0 @@
-{ KeycloakConfig
-}:
-{ name
-, configDir ? "/etc/keycloak"
-, configFile ? "keycloak.conf"
-, logLevel ? "INFO"
-, metricsEnabled ? false
-, hostname ? "keycloak.hostname.com"
-
-, dbType ? "postgres"
-, dbUsername ? "keycloak"
-, dbHost ? x: "localhost"
-, dbPort ? "5432"
-, dbDatabase ? "keycloak"
-
-, dependsOn ? {}
-}:
-
-{
-  inherit name configDir configFile;
-
-  inherit hostname;
-
-  pkg = KeycloakConfig {
-    inherit configDir configFile hostname;
-    inherit logLevel metricsEnabled;
-    inherit dbType dbUsername dbHost dbPort dbDatabase;
-  };
-
-  inherit dependsOn;
-  type = "fileset";
-}

keycloak/mkunit.nix

@@ -1,30 +0,0 @@
-{ KeycloakService
-}:
-{ name
-, configDir
-, configFile
-, user
-, group
-, postgresServiceName
-, initialAdminUsername ? "admin"
-, keys
-
-, dependsOn ? {}
-}:
-{
-  inherit name configDir configFile;
-
-  inherit initialAdminUsername;
-
-  pkg = KeycloakService {
-    inherit configDir configFile;
-    inherit user group;
-    inherit keys initialAdminUsername;
-    inherit postgresServiceName;
-  };
-
-  systemdUnitFile = "${name}.service";
-
-  inherit dependsOn;
-  type = "systemd-unit";
-}

keycloak/unit.nix

@@ -3,16 +3,25 @@
 , lib
 , utils
 }:
-{ configDir ? "/etc/keycloak"
+{ name
-, configFile ? "keycloak.conf"
 , user ? "keycloak"
 , group ? "keycloak"
 , dbType ? "postgres"
 , postgresServiceName
 , initialAdminUsername ? null
 , keys
+
+, logLevel ? "INFO"
+, metricsEnabled ? false
+, hostname
+
+, dbUsername ? "keycloak"
+, dbHost ? x: "localhost"
+, dbPort ? "5432"
+, dbDatabase ? "keycloak"
+
+, KeycloakPostgresDB
 }:
-{ ... }:
 
 assert lib.assertOneOf "dbType" dbType ["postgres"];
 
@@ -25,74 +34,125 @@ let
   };
 in
 
-with lib.attrsets;
+{
-utils.systemd.mkService rec {
+  inherit name;
-  name = "keycloak";
 
-  content = ''
+  inherit initialAdminUsername;
-  [Unit]
-  Description=Keycloak server
-  After=network-online.target
-  Wants=network-online.target systemd-networkd-wait-online.service ${postgresServiceName}
-  After=${utils.keyServiceDependencies keys}
-  Wants=${utils.keyServiceDependencies keys}
-  
-  [Service]
-  User=${user}
-  Group=${group}
-  
-  ${utils.keyEnvironmentFile keys.dbPassword}
-  ${if initialAdminUsername != null then "Environment=KEYCLOAK_ADMIN="+initialAdminUsername else ""}
-  ${if hasAttr "initialAdminPassword" keys then utils.keyEnvironmentFile keys.initialAdminPassword else ""}
-  Environment=PATH=${pkgs.coreutils}/bin
-  Environment=KC_HOME_DIR="/run/keycloak"
 
-  # running the ExecStartPre as root is not ideal, but at the moment
+  systemdUnitFile = "${name}.service";
-  # the only solution for Quarkus modifying the serialized
-  # data under <keycloak-home>/lib/quarkus
-  # Raised upstream as https://github.com/keycloak/keycloak/discussions/10323
-  # ExecStartPre=!${keycloak}/bin/kc.sh -cf ${configDir}/${configFile} build
-  ExecStart=${keycloak}/bin/kc.sh -cf ${configDir}/${configFile} start
 
-  # ReadWritePaths=/var/lib/keycloak
+  pkg = { KeycloakPostgresDB }:
-  # ReadWritePaths=/var/log/keycloak
+    let
-  # ReadWritePaths=/usr/share/java/keycloak/lib/quarkus
+      configFile = pkgs.writeText "keycloak.conf" ''
-  # ReadOnlyPaths=${configDir}
+      # The password of the database user is given by an environment variable.
-  RuntimeDirectory=keycloak
+      db=${dbType}
-  DynamicUser=true
+      db-username=${dbUsername}
-  
+      db-url-host=${dbHost {inherit KeycloakPostgresDB;}}
-  # Disable timeout logic and wait until process is stopped
+      db-url-port=${dbPort}
-  TimeoutStopSec=0
+      db-url-database=${dbDatabase}
-  TimeoutStartSec=10min
+      # db-url-properties=  # Would be used for ssl, see https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/web-apps/keycloak.nix#L491
-  
+
-  # SIGTERM signal is used to stop the Java process
+      # Observability
-  KillSignal=SIGTERM
+
-  
+      # If the server should expose metrics and healthcheck endpoints.
-  # Send the signal only to the JVM rather than its control group
+      metrics-enabled=${if metricsEnabled then "true" else "false"}
-  KillMode=process
+
-  
+      # HTTP
-  # Java process is never killed
+
-  SendSIGKILL=no
+      # The file path to a server certificate or certificate chain in PEM format.
-  
+      #https-certificate-file=''${kc.home.dir}conf/server.crt.pem
-  # When a JVM receives a SIGTERM signal it exits with code 143
+
-  SuccessExitStatus=143
+      # The file path to a private key in PEM format.
-  
+      #https-certificate-key-file=''${kc.home.dir}conf/server.key.pem
-  # Hardening options
+
-  # CapabilityBoundingSet=
+      # The proxy address forwarding mode if the server is behind a reverse proxy.
-  # AmbientCapabilities=CAP_NET_BIND_SERVICES
+      # https://www.keycloak.org/server/reverseproxy
-  # NoNewPrivileges=true
+      proxy=edge
-  # Fails with:
+
-  # Failed to set up mount namespacing: /run/systemd/unit-root/var/lib/keycloak: No such file or directory
+      # Do not attach route to cookies and rely on the session affinity capabilities from reverse proxy
-  # ProtectHome=true
+      #spi-sticky-session-encoder-infinispan-should-attach-route=false
-  # ProtectSystem=strict
+
-  # ProtectKernelTunables=true
+      # Hostname for the Keycloak server.
-  # ProtectKernelModules=true
+      hostname=${hostname}
-  # ProtectControlGroups=true
+
-  # PrivateTmp=true
+      spi-x509cert-lookup-provider=haproxy
-  # PrivateDevices=true
+
-  # LockPersonality=true
+      log-level=${logLevel}
-  
+      '';
-  [Install]
+    in
-  WantedBy=multi-user.target
+    with lib.attrsets;
-  '';
+    utils.systemd.mkService rec {
+      name = "keycloak";
+
+      content = ''
+      [Unit]
+      Description=Keycloak server
+      After=network-online.target
+      Wants=network-online.target systemd-networkd-wait-online.service ${postgresServiceName}
+      After=${utils.keyServiceDependencies keys}
+      Wants=${utils.keyServiceDependencies keys}
+
+      [Service]
+      User=${user}
+      Group=${group}
+
+      ${utils.keyEnvironmentFile keys.dbPassword}
+      ${if initialAdminUsername != null then "Environment=KEYCLOAK_ADMIN="+initialAdminUsername else ""}
+      ${if hasAttr "initialAdminPassword" keys then utils.keyEnvironmentFile keys.initialAdminPassword else ""}
+      Environment=PATH=${pkgs.coreutils}/bin
+      Environment=KC_HOME_DIR="/run/keycloak"
+
+      # running the ExecStartPre as root is not ideal, but at the moment
+      # the only solution for Quarkus modifying the serialized
+      # data under <keycloak-home>/lib/quarkus
+      # Raised upstream as https://github.com/keycloak/keycloak/discussions/10323
+      # ExecStartPre=!${keycloak}/bin/kc.sh -cf ${configFile} build
+      ExecStart=${keycloak}/bin/kc.sh -cf ${configFile} start
+
+      # ReadWritePaths=/var/lib/keycloak
+      # ReadWritePaths=/var/log/keycloak
+      # ReadWritePaths=/usr/share/java/keycloak/lib/quarkus
+      RuntimeDirectory=keycloak
+      DynamicUser=true
+
+      # Disable timeout logic and wait until process is stopped
+      TimeoutStopSec=0
+      TimeoutStartSec=10min
+
+      # SIGTERM signal is used to stop the Java process
+      KillSignal=SIGTERM
+
+      # Send the signal only to the JVM rather than its control group
+      KillMode=process
+
+      # Java process is never killed
+      SendSIGKILL=no
+
+      # When a JVM receives a SIGTERM signal it exits with code 143
+      SuccessExitStatus=143
+
+      # Hardening options
+      # CapabilityBoundingSet=
+      # AmbientCapabilities=CAP_NET_BIND_SERVICES
+      # NoNewPrivileges=true
+      # Fails with:
+      # Failed to set up mount namespacing: /run/systemd/unit-root/var/lib/keycloak: No such file or directory
+      # ProtectHome=true
+      # ProtectSystem=strict
+      # ProtectKernelTunables=true
+      # ProtectKernelModules=true
+      # ProtectControlGroups=true
+      # PrivateTmp=true
+      # PrivateDevices=true
+      # LockPersonality=true
+
+      [Install]
+      WantedBy=multi-user.target
+      '';
+    };
+
+  dependsOn = {
+    inherit KeycloakPostgresDB;
+  };
+  type = "systemd-unit";
 }