1
0
Fork 0

only use ldap for home-assistant login

This commit is contained in:
ibizaman 2023-08-25 09:51:20 -07:00
parent be24e241d7
commit d41b93df43
3 changed files with 104 additions and 1 deletions

View file

@ -11,6 +11,7 @@
imports = [
modules/authelia.nix
modules/backup.nix
modules/hledger.nix
modules/home-assistant.nix
modules/jellyfin.nix
modules/ldap.nix

102
modules/hledger.nix Normal file
View file

@ -0,0 +1,102 @@
{ config, pkgs, lib, ... }:
let
cfg = config.shb.hledger;
fqdn = "${cfg.subdomain}.${cfg.domain}";
in
{
options.shb.hledger = {
enable = lib.mkEnableOption "selfhostblocks.hledger";
subdomain = lib.mkOption {
type = lib.types.str;
description = "Subdomain under which Authelia will be served.";
example = "ha";
};
domain = lib.mkOption {
type = lib.types.str;
description = "domain under which Authelia will be served.";
example = "mydomain.com";
};
port = lib.mkOption {
type = lib.types.int;
description = "HLedger port";
default = 5000;
};
localNetworkIPRange = lib.mkOption {
type = lib.types.str;
description = "Local network range, to restrict access to the UI to only those IPs.";
default = null;
example = "192.168.1.1/24";
};
};
config = lib.mkIf cfg.enable {
services.hledger-web = {
enable = true;
baseUrl = fqdn;
stateDir = "/var/lib/hledger";
journalFiles = ["hledger.journal"];
host = "127.0.0.1";
port = cfg.port;
capabilities.view = true;
capabilities.add = true;
capabilities.manage = true;
extraOptions = [
# https://hledger.org/1.30/hledger-web.html
# "--capabilities-header=HLEDGER-CAP"
"--forecast"
];
};
services.nginx = {
enable = true;
virtualHosts.${fqdn} = {
forceSSL = true;
sslCertificate = "/var/lib/acme/${cfg.domain}/cert.pem";
sslCertificateKey = "/var/lib/acme/${cfg.domain}/key.pem";
locations."/" = {
proxyPass = "http://${toString config.services.hledger-web.host}:${toString config.services.hledger-web.port}";
# proxyWebsockets = true;
extraConfig = lib.mkIf (cfg.localNetworkIPRange != null) ''
allow ${cfg.localNetworkIPRange};
'';
};
};
};
shb.authelia.rules = [
# {
# domain = fqdn;
# policy = "bypass";
# resources = [
# "^/api.*"
# "^/auth/token.*"
# "^/.external_auth=."
# "^/service_worker.js"
# "^/static/.*"
# ];
# }
{
domain = fqdn;
policy = "two_factor";
}
];
shb.backup.instances.hledger = {
sourceDirectories = [
config.services.hledger-web.stateDir
];
};
};
}

View file

@ -100,7 +100,7 @@ in
time_zone = "America/Los_Angeles";
auth_providers = [
# Ensure you have the homeassistant provider enabled if you want to continue using your existing accounts
{ type = "homeassistant"; }
# { type = "homeassistant"; }
{ type = "command_line";
command = ldap_auth_script + "/bin/ldap_auth.sh";
# Only allow users in the 'homeassistant_user' group to login.