only use ldap for home-assistant login
This commit is contained in:
parent
be24e241d7
commit
d41b93df43
3 changed files with 104 additions and 1 deletions
|
@ -11,6 +11,7 @@
|
|||
imports = [
|
||||
modules/authelia.nix
|
||||
modules/backup.nix
|
||||
modules/hledger.nix
|
||||
modules/home-assistant.nix
|
||||
modules/jellyfin.nix
|
||||
modules/ldap.nix
|
||||
|
|
102
modules/hledger.nix
Normal file
102
modules/hledger.nix
Normal file
|
@ -0,0 +1,102 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
|
||||
let
|
||||
cfg = config.shb.hledger;
|
||||
|
||||
fqdn = "${cfg.subdomain}.${cfg.domain}";
|
||||
in
|
||||
{
|
||||
options.shb.hledger = {
|
||||
enable = lib.mkEnableOption "selfhostblocks.hledger";
|
||||
|
||||
subdomain = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "Subdomain under which Authelia will be served.";
|
||||
example = "ha";
|
||||
};
|
||||
|
||||
domain = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "domain under which Authelia will be served.";
|
||||
example = "mydomain.com";
|
||||
};
|
||||
|
||||
port = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
description = "HLedger port";
|
||||
default = 5000;
|
||||
};
|
||||
|
||||
localNetworkIPRange = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "Local network range, to restrict access to the UI to only those IPs.";
|
||||
default = null;
|
||||
example = "192.168.1.1/24";
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
services.hledger-web = {
|
||||
enable = true;
|
||||
baseUrl = fqdn;
|
||||
|
||||
stateDir = "/var/lib/hledger";
|
||||
journalFiles = ["hledger.journal"];
|
||||
|
||||
host = "127.0.0.1";
|
||||
port = cfg.port;
|
||||
|
||||
capabilities.view = true;
|
||||
capabilities.add = true;
|
||||
capabilities.manage = true;
|
||||
extraOptions = [
|
||||
# https://hledger.org/1.30/hledger-web.html
|
||||
# "--capabilities-header=HLEDGER-CAP"
|
||||
"--forecast"
|
||||
];
|
||||
};
|
||||
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
|
||||
virtualHosts.${fqdn} = {
|
||||
forceSSL = true;
|
||||
sslCertificate = "/var/lib/acme/${cfg.domain}/cert.pem";
|
||||
sslCertificateKey = "/var/lib/acme/${cfg.domain}/key.pem";
|
||||
|
||||
locations."/" = {
|
||||
proxyPass = "http://${toString config.services.hledger-web.host}:${toString config.services.hledger-web.port}";
|
||||
# proxyWebsockets = true;
|
||||
|
||||
extraConfig = lib.mkIf (cfg.localNetworkIPRange != null) ''
|
||||
allow ${cfg.localNetworkIPRange};
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
shb.authelia.rules = [
|
||||
# {
|
||||
# domain = fqdn;
|
||||
# policy = "bypass";
|
||||
# resources = [
|
||||
# "^/api.*"
|
||||
# "^/auth/token.*"
|
||||
# "^/.external_auth=."
|
||||
# "^/service_worker.js"
|
||||
# "^/static/.*"
|
||||
# ];
|
||||
# }
|
||||
{
|
||||
domain = fqdn;
|
||||
policy = "two_factor";
|
||||
}
|
||||
];
|
||||
|
||||
shb.backup.instances.hledger = {
|
||||
sourceDirectories = [
|
||||
config.services.hledger-web.stateDir
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
|
@ -100,7 +100,7 @@ in
|
|||
time_zone = "America/Los_Angeles";
|
||||
auth_providers = [
|
||||
# Ensure you have the homeassistant provider enabled if you want to continue using your existing accounts
|
||||
{ type = "homeassistant"; }
|
||||
# { type = "homeassistant"; }
|
||||
{ type = "command_line";
|
||||
command = ldap_auth_script + "/bin/ldap_auth.sh";
|
||||
# Only allow users in the 'homeassistant_user' group to login.
|
||||
|
|
Loading…
Reference in a new issue