Compare commits
No commits in common. "7f2aa36d27cee296072304853bd7923e0c1450f9" and "b8a570ae0d0125a1ae4ab7a13ed11bca8bb00a54" have entirely different histories.
7f2aa36d27
...
b8a570ae0d
24 changed files with 200 additions and 666 deletions
105
.github/workflows/build.yaml
vendored
105
.github/workflows/build.yaml
vendored
|
|
@ -1,105 +0,0 @@
|
|||
# name: build
|
||||
# on: push
|
||||
# jobs:
|
||||
# checks:
|
||||
# uses: nixbuild/nixbuild-action/.github/workflows/ci-workflow.yml@v19
|
||||
# with:
|
||||
# nix_conf: |
|
||||
# allow-import-from-derivation = true
|
||||
# secrets:
|
||||
# nixbuild_token: ${{ secrets.nixbuild_token }}
|
||||
|
||||
|
||||
name: "build"
|
||||
on:
|
||||
pull_request:
|
||||
push:
|
||||
branches: [ "main" ]
|
||||
|
||||
jobs:
|
||||
build-matrix:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v4
|
||||
- name: Install Nix
|
||||
uses: DeterminateSystems/nix-installer-action@main
|
||||
with:
|
||||
github-token: ${{ secrets.GITHUB_TOKEN }}
|
||||
extra-conf: "system-features = nixos-test benchmark big-parallel kvm"
|
||||
- name: Setup Caching
|
||||
uses: cachix/cachix-action@v14
|
||||
with:
|
||||
name: selfhostblocks
|
||||
authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
|
||||
- name: Generate Matrix
|
||||
id: generate-matrix
|
||||
run: |
|
||||
nix flake show --allow-import-from-derivation --json \
|
||||
| jq -c '.["checks"]["x86_64-linux"] | keys' > .output
|
||||
|
||||
cat .output
|
||||
|
||||
echo dynamic_list="$(cat .output)" >> "$GITHUB_OUTPUT"
|
||||
outputs:
|
||||
check: ${{ steps.generate-matrix.outputs.dynamic_list }}
|
||||
|
||||
manual:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v4
|
||||
- name: Install Nix
|
||||
uses: DeterminateSystems/nix-installer-action@main
|
||||
with:
|
||||
github-token: ${{ secrets.GITHUB_TOKEN }}
|
||||
extra-conf: "system-features = nixos-test benchmark big-parallel kvm"
|
||||
- name: Setup Caching
|
||||
uses: cachix/cachix-action@v14
|
||||
with:
|
||||
name: selfhostblocks
|
||||
authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
|
||||
- name: Build
|
||||
run: |
|
||||
nix \
|
||||
--print-build-logs \
|
||||
--option keep-going true \
|
||||
--show-trace \
|
||||
build .#manualHtml
|
||||
|
||||
tests:
|
||||
runs-on: ubuntu-latest
|
||||
needs: [ "build-matrix" ]
|
||||
strategy:
|
||||
matrix:
|
||||
check: ${{ fromJson(needs.build-matrix.outputs.check) }}
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v4
|
||||
- name: Install Nix
|
||||
uses: DeterminateSystems/nix-installer-action@main
|
||||
with:
|
||||
github-token: ${{ secrets.GITHUB_TOKEN }}
|
||||
extra-conf: "system-features = nixos-test benchmark big-parallel kvm"
|
||||
- name: Setup Caching
|
||||
uses: cachix/cachix-action@v14
|
||||
with:
|
||||
name: selfhostblocks
|
||||
authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
|
||||
- name: Build
|
||||
run: |
|
||||
nix build --print-build-logs --show-trace .#checks.x86_64-linux.${{ matrix.check }}
|
||||
|
||||
results:
|
||||
if: ${{ always() }}
|
||||
runs-on: ubuntu-latest
|
||||
name: Final Results
|
||||
needs: [ manual, tests ]
|
||||
steps:
|
||||
- run: |
|
||||
result="${{ needs.tests.result }}"
|
||||
if [[ $result == "success" || $result == "skipped" ]]; then
|
||||
exit 0
|
||||
else
|
||||
exit 1
|
||||
fi
|
||||
37
.github/workflows/demo.yml
vendored
37
.github/workflows/demo.yml
vendored
|
|
@ -3,31 +3,15 @@ name: Demo
|
|||
on:
|
||||
workflow_dispatch:
|
||||
pull_request:
|
||||
paths: &paths
|
||||
- 'demo/**'
|
||||
push:
|
||||
branches:
|
||||
- main
|
||||
paths: *paths
|
||||
|
||||
jobs:
|
||||
path-filter:
|
||||
runs-on: ubuntu-latest
|
||||
outputs:
|
||||
changed: ${{ steps.filter.outputs.changed }}
|
||||
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- uses: dorny/paths-filter@v3
|
||||
id: filter
|
||||
with:
|
||||
filters: |
|
||||
changed:
|
||||
- '.github/workflows/demo.yml'
|
||||
- 'demo/**'
|
||||
|
||||
build:
|
||||
needs: [ "path-filter" ]
|
||||
if: needs.path-filter.outputs.changed == 'true'
|
||||
strategy:
|
||||
matrix:
|
||||
demo:
|
||||
|
|
@ -54,7 +38,7 @@ jobs:
|
|||
|
||||
- uses: cachix/cachix-action@v14
|
||||
with:
|
||||
name: selfhostblocks
|
||||
name: mycache
|
||||
authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
|
||||
|
||||
- name: Build ${{ matrix.demo.name }} .#${{ matrix.demo.flake }}
|
||||
|
|
@ -66,15 +50,4 @@ jobs:
|
|||
--show-trace \
|
||||
build .#nixosConfigurations.${{ matrix.demo.flake }}.config.system.build.vm
|
||||
|
||||
result:
|
||||
runs-on: ubuntu-latest
|
||||
needs: [ "build" ]
|
||||
if: '!cancelled()'
|
||||
steps:
|
||||
- run: |
|
||||
result="${{ needs.build.result }}"
|
||||
if [[ $result == "success" || $result == "skipped" ]]; then
|
||||
exit 0
|
||||
else
|
||||
exit 1
|
||||
fi
|
||||
|
||||
|
|
|
|||
22
.github/workflows/garnix.yaml
vendored
Normal file
22
.github/workflows/garnix.yaml
vendored
Normal file
|
|
@ -0,0 +1,22 @@
|
|||
# Leaving commented because it does not work.
|
||||
#
|
||||
# name: "Final Results"
|
||||
#
|
||||
# on:
|
||||
# check_suite:
|
||||
# types: [completed]
|
||||
#
|
||||
# jobs:
|
||||
# results:
|
||||
# name: Final Results
|
||||
# runs-on: ubuntu-latest
|
||||
# steps:
|
||||
# - run: echo
|
||||
# - run: exit 1
|
||||
# # see https://stackoverflow.com/a/67532120/4907315
|
||||
# if: >-
|
||||
# ${{
|
||||
# contains(needs.*.result, 'failure')
|
||||
# || contains(needs.*.result, 'cancelled')
|
||||
# || contains(needs.*.result, 'skipped')
|
||||
# }}
|
||||
11
.github/workflows/pages.yml
vendored
11
.github/workflows/pages.yml
vendored
|
|
@ -2,8 +2,14 @@
|
|||
name: Deploy docs
|
||||
|
||||
on:
|
||||
# Runs on pushes targeting the default branch
|
||||
push:
|
||||
branches: ["main"]
|
||||
# TODO: needed ?
|
||||
# schedule:
|
||||
# - cron: 0 0 * * 1
|
||||
|
||||
# Allows you to run this workflow manually from the Actions tab
|
||||
workflow_dispatch:
|
||||
|
||||
# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
|
||||
|
|
@ -34,10 +40,9 @@ jobs:
|
|||
- name: Install nix
|
||||
uses: cachix/install-nix-action@v20
|
||||
|
||||
- name: Setup Caching
|
||||
uses: cachix/cachix-action@v14
|
||||
- uses: cachix/cachix-action@v14
|
||||
with:
|
||||
name: selfhostblocks
|
||||
name: mycache
|
||||
authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
|
||||
|
||||
- name: Build docs
|
||||
|
|
|
|||
17
CHANGELOG.md
17
CHANGELOG.md
|
|
@ -14,26 +14,9 @@
|
|||
- `shb.authelia.oidcClients.description` -> `shb.authelia.oidcClients.client_name`
|
||||
- `shb.authelia.oidcClients.secret` -> `shb.authelia.oidcClients.client_secret`
|
||||
- `shb.authelia.ldapEndpoint` -> `shb.authelia.ldapHostname` and `shb.authelia.ldapPort`
|
||||
- `shb.authelia.jwtSecretFile` -> `shb.authelia.jwtSecret.result.path`
|
||||
- `shb.authelia.ldapAdminPasswordFile` -> `shb.authelia.ldapAdminPassword.result.path`
|
||||
- `shb.authelia.sessionSecretFile` -> `shb.authelia.sessionSecret.result.path`
|
||||
- `shb.authelia.storageEncryptionKeyFile` -> `shb.authelia.storageEncryptionKey.result.path`
|
||||
- `shb.authelia.identityProvidersOIDCIssuerPrivateKeyFile` -> `shb.authelia.identityProvidersOIDCIssuerPrivateKey.result.path`
|
||||
- `shb.authelia.smtp.passwordFile` -> `shb.authelia.smtp.password.result.path`
|
||||
- Make Nextcloud automatically disable maintenance mode upon service restart.
|
||||
- `shb.ldap.ldapUserPasswordFile` -> `shb.ldap.ldapUserPassword.result.path`
|
||||
- `shb.ldap.jwtSecretFile` -> `shb.ldap.jwtSecret.result.path`
|
||||
- Jellyfin changes:
|
||||
- `shb.jellyfin.ldap.passwordFile` -> `shb.jellyfin.ldap.adminPassword.result.path`.
|
||||
- `shb.jellyfin.sso.secretFile` -> `shb.jellyfin.ldap.sharedSecret.result.path`.
|
||||
- + `shb.jellyfin.ldap.sharedSecretForAuthelia`.
|
||||
- Forgejo changes:
|
||||
- `shb.forgejo.ldap.adminPasswordFile` -> `shb.forgejo.ldap.adminPassword.result.path`.
|
||||
- `shb.forgejo.sso.secretFile` -> `shb.forgejo.ldap.sharedSecret.result.path`.
|
||||
- `shb.forgejo.sso.secretFileForAuthelia` -> `shb.forgejo.ldap.sharedSecretForAuthelia.result.path`.
|
||||
- `shb.forgejo.adminPasswordFile` -> `shb.forgejo.adminPassword.result.path`.
|
||||
- `shb.forgejo.databasePasswordFile` -> `shb.forgejo.databasePassword.result.path`.
|
||||
|
||||
|
||||
## User Facing Backwards Compatible Changes
|
||||
|
||||
|
|
|
|||
|
|
@ -3,7 +3,7 @@
|
|||
*Modular server management based on NixOS modules and focused on best practices.*
|
||||
|
||||
[](https://github.com/ibizaman/selfhostblocks/actions/workflows/pages.yml)
|
||||
[](https://github.com/ibizaman/selfhostblocks/actions/workflows/build.yaml)
|
||||
[](https://garnix.io) (using Garnix)
|
||||
[](https://github.com/ibizaman/selfhostblocks/actions/workflows/demo.yml)
|
||||
|
||||
SHB (Self Host Blocks) is yet another server management tool
|
||||
|
|
|
|||
|
|
@ -35,11 +35,11 @@
|
|||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1731139594,
|
||||
"narHash": "sha256-IigrKK3vYRpUu+HEjPL/phrfh7Ox881er1UEsZvw9Q4=",
|
||||
"lastModified": 1728492678,
|
||||
"narHash": "sha256-9UTxR8eukdg+XZeHgxW5hQA9fIKHsKCdOIUycTryeVw=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "76612b17c0ce71689921ca12d9ffdc9c23ce40b2",
|
||||
"rev": "5633bcff0c6162b9e4b5f1264264611e950c8ec7",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
|
|||
22
flake.nix
22
flake.nix
|
|
@ -26,6 +26,7 @@
|
|||
src = nixpkgs;
|
||||
inherit patches;
|
||||
};
|
||||
|
||||
pkgs = import patchedNixpkgs {
|
||||
inherit system;
|
||||
};
|
||||
|
|
@ -33,7 +34,6 @@
|
|||
allModules = [
|
||||
modules/blocks/authelia.nix
|
||||
modules/blocks/davfs.nix
|
||||
modules/blocks/hardcodedsecret.nix
|
||||
modules/blocks/ldap.nix
|
||||
modules/blocks/monitoring.nix
|
||||
modules/blocks/nginx.nix
|
||||
|
|
@ -79,14 +79,12 @@
|
|||
|
||||
checks =
|
||||
let
|
||||
inherit (pkgs.lib) foldl foldlAttrs mergeAttrs optionalAttrs;
|
||||
|
||||
importFiles = files:
|
||||
map (m: pkgs.callPackage m {}) files;
|
||||
|
||||
mergeTests = foldl mergeAttrs {};
|
||||
mergeTests = pkgs.lib.lists.foldl pkgs.lib.trivial.mergeAttrs {};
|
||||
|
||||
flattenAttrs = root: attrset: foldlAttrs (acc: name: value: acc // {
|
||||
flattenAttrs = root: attrset: pkgs.lib.attrsets.foldlAttrs (acc: name: value: acc // {
|
||||
"${root}_${name}" = value;
|
||||
}) {} attrset;
|
||||
|
||||
|
|
@ -98,21 +96,19 @@
|
|||
);
|
||||
|
||||
shblib = pkgs.callPackage ./lib {};
|
||||
in (optionalAttrs (system == "x86_64-linux") ({
|
||||
in (rec {
|
||||
modules = shblib.check {
|
||||
inherit pkgs;
|
||||
tests =
|
||||
mergeTests (importFiles [
|
||||
./test/modules/arr.nix
|
||||
./test/modules/davfs.nix
|
||||
# TODO: Make this not use IFD
|
||||
./test/modules/lib.nix
|
||||
./test/modules/nginx.nix
|
||||
./test/modules/postgresql.nix
|
||||
]);
|
||||
};
|
||||
|
||||
# TODO: Make this not use IFD
|
||||
lib = nix-flake-tests.lib.check {
|
||||
inherit pkgs;
|
||||
tests = pkgs.callPackage ./test/modules/lib.nix {};
|
||||
|
|
@ -123,7 +119,7 @@
|
|||
// (vm_test "deluge" ./test/services/deluge.nix)
|
||||
// (vm_test "forgejo" ./test/services/forgejo.nix)
|
||||
// (vm_test "grocy" ./test/services/grocy.nix)
|
||||
// (vm_test "homeassistant" ./test/services/home-assistant.nix)
|
||||
// (vm_test "home-assistant" ./test/services/home-assistant.nix)
|
||||
// (vm_test "jellyfin" ./test/services/jellyfin.nix)
|
||||
// (vm_test "monitoring" ./test/services/monitoring.nix)
|
||||
// (vm_test "nextcloud" ./test/services/nextcloud.nix)
|
||||
|
|
@ -135,11 +131,7 @@
|
|||
// (vm_test "postgresql" ./test/blocks/postgresql.nix)
|
||||
// (vm_test "restic" ./test/blocks/restic.nix)
|
||||
// (vm_test "ssl" ./test/blocks/ssl.nix)
|
||||
|
||||
// (vm_test "contracts-secret" ./test/contracts/secret.nix)
|
||||
));
|
||||
);
|
||||
}
|
||||
) // {
|
||||
herculesCI.ciSystems = [ "x86_64-linux" ];
|
||||
};
|
||||
);
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
{ pkgs, lib }:
|
||||
let
|
||||
inherit (builtins) isAttrs hasAttr;
|
||||
inherit (lib) concatMapStringsSep concatStringsSep mapAttrsToList;
|
||||
inherit (lib) concatStringsSep;
|
||||
in
|
||||
rec {
|
||||
# Replace secrets in a file.
|
||||
|
|
@ -31,34 +31,17 @@ rec {
|
|||
resultPath = newPath;
|
||||
};
|
||||
|
||||
genReplacement = secret:
|
||||
let
|
||||
t = { transform ? null, ... }: if isNull transform then x: x else transform;
|
||||
in
|
||||
lib.attrsets.nameValuePair (secretName secret.name) ((t secret) "$(cat ${toString secret.source})");
|
||||
|
||||
replaceSecretsScript = { file, resultPath, replacements, user ? null, permissions ? "u=r,g=r,o=" }:
|
||||
let
|
||||
templatePath = resultPath + ".template";
|
||||
|
||||
# We check that the files containing the secrets have the
|
||||
# correct permissions for us to read them in this separate
|
||||
# step. Otherwise, the $(cat ...) commands inside the sed
|
||||
# replacements could fail but not fail individually but
|
||||
# not fail the whole script.
|
||||
checkPermissions = concatMapStringsSep "\n" (pattern: "cat ${pattern.source} > /dev/null") replacements;
|
||||
|
||||
sedPatterns = concatMapStringsSep " " (pattern: "-e \"s|${pattern.name}|${pattern.value}|\"") (map genReplacement replacements);
|
||||
|
||||
sedCmd = if replacements == []
|
||||
sedPatterns = lib.strings.concatStringsSep " " (lib.attrsets.mapAttrsToList (from: to: "-e \"s|${from}|${to}|\"") replacements);
|
||||
sedCmd = if replacements == {}
|
||||
then "cat"
|
||||
else "${pkgs.gnused}/bin/sed ${sedPatterns}";
|
||||
in
|
||||
''
|
||||
set -euo pipefail
|
||||
|
||||
${checkPermissions}
|
||||
|
||||
mkdir -p $(dirname ${templatePath})
|
||||
ln -fs ${file} ${templatePath}
|
||||
rm -f ${resultPath}
|
||||
|
|
@ -88,8 +71,8 @@ rec {
|
|||
};
|
||||
};
|
||||
|
||||
secretName = names:
|
||||
"%SECRET${lib.strings.toUpper (lib.strings.concatMapStrings (s: "_" + s) names)}%";
|
||||
secretName = name:
|
||||
"%SECRET${lib.strings.toUpper (lib.strings.concatMapStrings (s: "_" + s) name)}%";
|
||||
|
||||
withReplacements = attrs:
|
||||
let
|
||||
|
|
@ -108,8 +91,15 @@ rec {
|
|||
else value // { name = name; };
|
||||
|
||||
secretsWithName = mapAttrsRecursiveCond (v: ! v ? "source") addNameField attrs;
|
||||
|
||||
allSecrets = collect (v: builtins.isAttrs v && v ? "source") secretsWithName;
|
||||
|
||||
t = { transform ? null, ... }: if isNull transform then x: x else transform;
|
||||
|
||||
genReplacement = secret:
|
||||
lib.attrsets.nameValuePair (secretName secret.name) ((t secret) "$(cat ${toString secret.source})");
|
||||
in
|
||||
collect (v: builtins.isAttrs v && v ? "source") secretsWithName;
|
||||
lib.attrsets.listToAttrs (map genReplacement allSecrets);
|
||||
|
||||
# Inspired lib.attrsets.mapAttrsRecursiveCond but also recurses on lists.
|
||||
mapAttrsRecursiveCond =
|
||||
|
|
@ -248,7 +238,7 @@ rec {
|
|||
results = pkgs.lib.runTests tests;
|
||||
in
|
||||
if results != [ ] then
|
||||
builtins.throw (concatStringsSep "\n" (map resultToString (lib.traceValSeqN 3 results)))
|
||||
builtins.throw (builtins.concatStringsSep "\n" (map resultToString (lib.traceValSeqN 3 results)))
|
||||
else
|
||||
pkgs.runCommand "nix-flake-tests-success" { } "echo > $out";
|
||||
|
||||
|
|
|
|||
|
|
@ -1,8 +1,7 @@
|
|||
{ config, options, pkgs, lib, ... }:
|
||||
{ config, pkgs, lib, ... }:
|
||||
|
||||
let
|
||||
cfg = config.shb.authelia;
|
||||
opt = options.shb.authelia;
|
||||
|
||||
contracts = pkgs.callPackage ../contracts {};
|
||||
shblib = pkgs.callPackage ../../lib {};
|
||||
|
|
@ -68,45 +67,33 @@ in
|
|||
description = "Secrets needed by Authelia";
|
||||
type = lib.types.submodule {
|
||||
options = {
|
||||
jwtSecret = contracts.secret.mkOption {
|
||||
description = "JWT secret.";
|
||||
mode = "0400";
|
||||
owner = cfg.autheliaUser;
|
||||
restartUnits = [ "authelia-${opt.subdomain}.${opt.domain}" ];
|
||||
jwtSecretFile = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
description = "File containing the JWT secret.";
|
||||
};
|
||||
ldapAdminPassword = contracts.secret.mkOption {
|
||||
description = "LDAP admin user password.";
|
||||
mode = "0400";
|
||||
owner = cfg.autheliaUser;
|
||||
restartUnits = [ "authelia-${opt.subdomain}.${opt.domain}" ];
|
||||
ldapAdminPasswordFile = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
description = "File containing the LDAP admin user password.";
|
||||
};
|
||||
sessionSecret = contracts.secret.mkOption {
|
||||
description = "Session secret.";
|
||||
mode = "0400";
|
||||
owner = cfg.autheliaUser;
|
||||
restartUnits = [ "authelia-${opt.subdomain}.${opt.domain}" ];
|
||||
sessionSecretFile = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
description = "File containing the session secret.";
|
||||
};
|
||||
storageEncryptionKey = contracts.secret.mkOption {
|
||||
description = "Storage encryption key.";
|
||||
mode = "0400";
|
||||
owner = cfg.autheliaUser;
|
||||
restartUnits = [ "authelia-${opt.subdomain}.${opt.domain}" ];
|
||||
storageEncryptionKeyFile = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
description = "File containing the storage encryption key.";
|
||||
};
|
||||
identityProvidersOIDCHMACSecret = contracts.secret.mkOption {
|
||||
description = "Identity provider OIDC HMAC secret.";
|
||||
mode = "0400";
|
||||
owner = cfg.autheliaUser;
|
||||
restartUnits = [ "authelia-${opt.subdomain}.${opt.domain}" ];
|
||||
identityProvidersOIDCHMACSecretFile = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
description = "File containing the identity provider OIDC HMAC secret.";
|
||||
};
|
||||
identityProvidersOIDCIssuerPrivateKey = contracts.secret.mkOption {
|
||||
identityProvidersOIDCIssuerPrivateKeyFile = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
description = ''
|
||||
Identity provider OIDC issuer private key.
|
||||
File containing the identity provider OIDC issuer private key.
|
||||
|
||||
Generate one with `nix run nixpkgs#openssl -- genrsa -out keypair.pem 2048`
|
||||
'';
|
||||
mode = "0400";
|
||||
owner = cfg.autheliaUser;
|
||||
restartUnits = [ "authelia-${opt.subdomain}.${opt.domain}" ];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
|
@ -220,11 +207,9 @@ in
|
|||
type = lib.types.str;
|
||||
description = "Username to connect to the SMTP host.";
|
||||
};
|
||||
password = contracts.secret.mkOption {
|
||||
passwordFile = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "File containing the password to connect to the SMTP host.";
|
||||
mode = "0400";
|
||||
owner = cfg.autheliaUser;
|
||||
restartUnits = [ "authelia-${fqdn}" ];
|
||||
};
|
||||
};
|
||||
}))
|
||||
|
|
@ -297,20 +282,19 @@ in
|
|||
user = cfg.autheliaUser;
|
||||
|
||||
secrets = {
|
||||
jwtSecretFile = cfg.secrets.jwtSecret.result.path;
|
||||
storageEncryptionKeyFile = cfg.secrets.storageEncryptionKey.result.path;
|
||||
inherit (cfg.secrets) jwtSecretFile storageEncryptionKeyFile;
|
||||
};
|
||||
# See https://www.authelia.com/configuration/methods/secrets/
|
||||
environmentVariables = {
|
||||
AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PASSWORD_FILE = toString cfg.secrets.ldapAdminPassword.result.path;
|
||||
AUTHELIA_SESSION_SECRET_FILE = toString cfg.secrets.sessionSecret.result.path;
|
||||
AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PASSWORD_FILE = toString cfg.secrets.ldapAdminPasswordFile;
|
||||
AUTHELIA_SESSION_SECRET_FILE = toString cfg.secrets.sessionSecretFile;
|
||||
# Not needed since we use peer auth.
|
||||
# AUTHELIA_STORAGE_POSTGRES_PASSWORD_FILE = "/run/secrets/authelia/postgres_password";
|
||||
AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE = toString cfg.secrets.storageEncryptionKey.result.path;
|
||||
AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET_FILE = toString cfg.secrets.identityProvidersOIDCHMACSecret.result.path;
|
||||
AUTHELIA_IDENTITY_PROVIDERS_OIDC_ISSUER_PRIVATE_KEY_FILE = toString cfg.secrets.identityProvidersOIDCIssuerPrivateKey.result.path;
|
||||
AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE = toString cfg.secrets.storageEncryptionKeyFile;
|
||||
AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET_FILE = toString cfg.secrets.identityProvidersOIDCHMACSecretFile;
|
||||
AUTHELIA_IDENTITY_PROVIDERS_OIDC_ISSUER_PRIVATE_KEY_FILE = toString cfg.secrets.identityProvidersOIDCIssuerPrivateKeyFile;
|
||||
|
||||
AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE = lib.mkIf (!(builtins.isString cfg.smtp)) (toString cfg.smtp.password.result.path);
|
||||
AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE = lib.mkIf (!(builtins.isString cfg.smtp)) (toString cfg.smtp.passwordFile);
|
||||
};
|
||||
settings = {
|
||||
server.address = "tcp://127.0.0.1:9091";
|
||||
|
|
|
|||
|
|
@ -1,108 +0,0 @@
|
|||
{ config, options, lib, pkgs, ... }:
|
||||
let
|
||||
cfg = config.shb.hardcodedsecret;
|
||||
opt = options.shb.hardcodedsecret;
|
||||
|
||||
inherit (lib) mapAttrs' mkOption nameValuePair;
|
||||
inherit (lib.types) attrsOf listOf path nullOr str submodule;
|
||||
inherit (pkgs) writeText;
|
||||
in
|
||||
{
|
||||
options.shb.hardcodedsecret = mkOption {
|
||||
default = {};
|
||||
description = ''
|
||||
Hardcoded secrets. These should only be used in tests.
|
||||
'';
|
||||
example = lib.literalExpression ''
|
||||
{
|
||||
mySecret = {
|
||||
user = "me";
|
||||
mode = "0400";
|
||||
restartUnits = [ "myservice.service" ];
|
||||
content = "My Secrets";
|
||||
};
|
||||
}
|
||||
'';
|
||||
type = attrsOf (submodule ({ name, ... }: {
|
||||
options = {
|
||||
mode = mkOption {
|
||||
description = ''
|
||||
Mode of the secret file.
|
||||
'';
|
||||
type = str;
|
||||
default = "0400";
|
||||
};
|
||||
|
||||
owner = mkOption {
|
||||
description = ''
|
||||
Linux user owning the secret file.
|
||||
'';
|
||||
type = str;
|
||||
default = "root";
|
||||
};
|
||||
|
||||
group = mkOption {
|
||||
description = ''
|
||||
Linux group owning the secret file.
|
||||
'';
|
||||
type = str;
|
||||
default = "root";
|
||||
};
|
||||
|
||||
restartUnits = mkOption {
|
||||
description = ''
|
||||
Systemd units to restart after the secret is updated.
|
||||
'';
|
||||
type = listOf str;
|
||||
default = [];
|
||||
};
|
||||
|
||||
path = mkOption {
|
||||
type = path;
|
||||
description = ''
|
||||
Path to the file containing the secret generated out of band.
|
||||
|
||||
This path will exist after deploying to a target host,
|
||||
it is not available through the nix store.
|
||||
'';
|
||||
default = "/run/hardcodedsecrets/hardcodedsecret_${name}";
|
||||
};
|
||||
|
||||
content = mkOption {
|
||||
type = nullOr str;
|
||||
description = ''
|
||||
Content of the secret.
|
||||
|
||||
This will be stored in the nix store and should only be used for testing or maybe in dev.
|
||||
'';
|
||||
default = null;
|
||||
};
|
||||
|
||||
source = mkOption {
|
||||
type = nullOr str;
|
||||
description = ''
|
||||
Source of the content of the secret.
|
||||
'';
|
||||
default = null;
|
||||
};
|
||||
};
|
||||
}));
|
||||
};
|
||||
|
||||
config = {
|
||||
system.activationScripts = mapAttrs' (n: cfg':
|
||||
let
|
||||
source = if cfg'.source != null
|
||||
then cfg'.source
|
||||
else writeText "hardcodedsecret_${n}_content" cfg'.content;
|
||||
in
|
||||
nameValuePair "hardcodedsecret_${n}" ''
|
||||
mkdir -p "$(dirname "${cfg'.path}")"
|
||||
touch "${cfg'.path}"
|
||||
chmod ${cfg'.mode} "${cfg'.path}"
|
||||
chown ${cfg'.owner}:${cfg'.group} "${cfg'.path}"
|
||||
cp ${source} "${cfg'.path}"
|
||||
''
|
||||
) cfg;
|
||||
};
|
||||
}
|
||||
|
|
@ -112,12 +112,9 @@ in
|
|||
'';
|
||||
readOnly = true;
|
||||
default = {
|
||||
# TODO: is there a workaround that avoid needing to use root?
|
||||
# root because otherwise we cannot access the private StateDiretory
|
||||
user = "root";
|
||||
# /private because the systemd service uses DynamicUser=true
|
||||
user = "lldap";
|
||||
sourceDirectories = [
|
||||
"/var/lib/private/lldap"
|
||||
"/var/lib/lldap"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
|
|
|||
|
|
@ -1,10 +1,7 @@
|
|||
{ pkgs, lib }:
|
||||
{ lib }:
|
||||
{
|
||||
backup = import ./backup.nix { inherit lib; };
|
||||
mount = import ./mount.nix { inherit lib; };
|
||||
secret = import ./secret.nix { inherit lib; };
|
||||
ssl = import ./ssl.nix { inherit lib; };
|
||||
test = {
|
||||
secret = import ./secret/test.nix { inherit pkgs lib; };
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,64 +0,0 @@
|
|||
{ pkgs, lib, ... }:
|
||||
let
|
||||
pkgs' = pkgs;
|
||||
|
||||
testLib = pkgs.callPackage ../../../test/common.nix {};
|
||||
|
||||
inherit (lib) getAttrFromPath setAttrByPath;
|
||||
inherit (lib) mkIf;
|
||||
in
|
||||
{ name,
|
||||
configRoot,
|
||||
createContent, # config to create a secret with value "secretA".
|
||||
modules ? [],
|
||||
owner ? "root",
|
||||
group ? "root",
|
||||
mode ? "0400",
|
||||
restartUnits ? [ "myunit.service" ],
|
||||
}: pkgs.testers.runNixOSTest {
|
||||
name = "secret_${name}_${owner}_${group}_${mode}";
|
||||
|
||||
nodes.machine = { config, ... }: {
|
||||
imports = ( testLib.baseImports pkgs' ) ++ modules;
|
||||
config = lib.mkMerge [
|
||||
(setAttrByPath configRoot {
|
||||
A = {
|
||||
inherit owner group mode restartUnits;
|
||||
} // createContent;
|
||||
})
|
||||
(mkIf (owner != "root") {
|
||||
users.users.${owner}.isNormalUser = true;
|
||||
})
|
||||
(mkIf (group != "root") {
|
||||
users.groups.${group} = {};
|
||||
})
|
||||
];
|
||||
};
|
||||
|
||||
testScript = { nodes, ... }:
|
||||
let
|
||||
cfg = (getAttrFromPath configRoot nodes.machine)."A";
|
||||
in
|
||||
''
|
||||
owner = machine.succeed("stat -c '%U' ${cfg.path}").strip()
|
||||
print(f"Got owner {owner}")
|
||||
if owner != "${owner}":
|
||||
raise Exception(f"Owner should be '${owner}' but got '{owner}'")
|
||||
|
||||
group = machine.succeed("stat -c '%G' ${cfg.path}").strip()
|
||||
print(f"Got group {group}")
|
||||
if group != "${group}":
|
||||
raise Exception(f"Group should be '${group}' but got '{group}'")
|
||||
|
||||
mode = str(int(machine.succeed("stat -c '%a' ${cfg.path}").strip()))
|
||||
print(f"Got mode {mode}")
|
||||
wantedMode = str(int("${mode}"))
|
||||
if mode != wantedMode:
|
||||
raise Exception(f"Mode should be '{wantedMode}' but got '{mode}'")
|
||||
|
||||
content = machine.succeed("cat ${cfg.path}").strip()
|
||||
print(f"Got content {content}")
|
||||
if content != "secretA":
|
||||
raise Exception(f"Content should be 'secretA' but got '{content}'")
|
||||
'';
|
||||
}
|
||||
|
|
@ -82,12 +82,14 @@ in
|
|||
default = "admin";
|
||||
};
|
||||
|
||||
adminPassword = contracts.secret.mkOption {
|
||||
description = "LDAP admin password.";
|
||||
mode = "0440";
|
||||
owner = "forgejo";
|
||||
group = "forgejo";
|
||||
restartUnits = [ "forgejo.service" ];
|
||||
adminPasswordFile = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
description = ''
|
||||
File containing the admin password of the LDAP server.
|
||||
|
||||
Must be readable by the forgejo system user.
|
||||
'';
|
||||
default = "";
|
||||
};
|
||||
|
||||
userGroup = lib.mkOption {
|
||||
|
|
@ -138,37 +140,37 @@ in
|
|||
default = "one_factor";
|
||||
};
|
||||
|
||||
sharedSecret = contracts.secret.mkOption {
|
||||
description = "OIDC shared secret for Forgejo.";
|
||||
mode = "0440";
|
||||
owner = "forgejo";
|
||||
group = "forgejo";
|
||||
restartUnits = [ "forgejo.service" ];
|
||||
secretFile = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
description = ''
|
||||
File containing the secret for the OIDC endpoint.
|
||||
|
||||
Must be readable by the forgejo system user.
|
||||
'';
|
||||
};
|
||||
|
||||
sharedSecretForAuthelia = contracts.secret.mkOption {
|
||||
description = "OIDC shared secret for Authelia.";
|
||||
mode = "0400";
|
||||
owner = "authelia";
|
||||
secretFileForAuthelia = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
description = ''
|
||||
File containing the secret for the OIDC endpoint, must be readable by the Authelia user.
|
||||
|
||||
Must be readable by the authelia system user.
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
adminPassword = contracts.secret.mkOption {
|
||||
adminPasswordFile = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
description = "File containing the Forgejo admin user password.";
|
||||
mode = "0440";
|
||||
owner = "forgejo";
|
||||
group = "forgejo";
|
||||
restartUnits = [ "forgejo.service" ];
|
||||
example = "/run/secrets/forgejo/adminPassword";
|
||||
};
|
||||
|
||||
databasePassword = contracts.secret.mkOption {
|
||||
databasePasswordFile = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
description = "File containing the Forgejo database password.";
|
||||
mode = "0440";
|
||||
owner = "forgejo";
|
||||
group = "forgejo";
|
||||
restartUnits = [ "forgejo.service" ];
|
||||
example = "/run/secrets/forgejo/databasePassword";
|
||||
};
|
||||
|
||||
repositoryRoot = lib.mkOption {
|
||||
|
|
@ -342,7 +344,7 @@ in
|
|||
services.forgejo.database = {
|
||||
type = "postgres";
|
||||
|
||||
passwordFile = cfg.databasePassword.result.path;
|
||||
passwordFile = cfg.databasePasswordFile;
|
||||
};
|
||||
})
|
||||
|
||||
|
|
@ -378,7 +380,7 @@ in
|
|||
--host ${cfg.ldap.host} \
|
||||
--port ${toString cfg.ldap.port} \
|
||||
--bind-dn uid=${cfg.ldap.adminName},ou=people,${cfg.ldap.dcdomain} \
|
||||
--bind-password $(tr -d '\n' < ${cfg.ldap.adminPassword.result.path}) \
|
||||
--bind-password $(tr -d '\n' < ${cfg.ldap.adminPasswordFile}) \
|
||||
--security-protocol Unencrypted \
|
||||
--user-search-base ou=people,${cfg.ldap.dcdomain} \
|
||||
--user-filter '(&(memberof=cn=${cfg.ldap.userGroup},ou=groups,${cfg.ldap.dcdomain})(|(uid=%[1]s)(mail=%[1]s)))' \
|
||||
|
|
@ -397,7 +399,7 @@ in
|
|||
--host ${cfg.ldap.host} \
|
||||
--port ${toString cfg.ldap.port} \
|
||||
--bind-dn uid=${cfg.ldap.adminName},ou=people,${cfg.ldap.dcdomain} \
|
||||
--bind-password $(tr -d '\n' < ${cfg.ldap.adminPassword.result.path}) \
|
||||
--bind-password $(tr -d '\n' < ${cfg.ldap.adminPasswordFile}) \
|
||||
--security-protocol Unencrypted \
|
||||
--user-search-base ou=people,${cfg.ldap.dcdomain} \
|
||||
--user-filter '(&(memberof=cn=${cfg.ldap.userGroup},ou=groups,${cfg.ldap.dcdomain})(|(uid=%[1]s)(mail=%[1]s)))' \
|
||||
|
|
@ -454,7 +456,7 @@ in
|
|||
--name ${provider} \
|
||||
--provider openidConnect \
|
||||
--key forgejo \
|
||||
--secret $(tr -d '\n' < ${cfg.sso.sharedSecret.result.path}) \
|
||||
--secret $(tr -d '\n' < ${cfg.sso.secretFile}) \
|
||||
--auto-discover-url ${cfg.sso.endpoint}/.well-known/openid-configuration
|
||||
else
|
||||
echo Did not find any sso configuration, creating one with name ${provider}.
|
||||
|
|
@ -462,7 +464,7 @@ in
|
|||
--name ${provider} \
|
||||
--provider openidConnect \
|
||||
--key forgejo \
|
||||
--secret $(tr -d '\n' < ${cfg.sso.sharedSecret.result.path}) \
|
||||
--secret $(tr -d '\n' < ${cfg.sso.secretFile}) \
|
||||
--auto-discover-url ${cfg.sso.endpoint}/.well-known/openid-configuration
|
||||
fi
|
||||
'';
|
||||
|
|
@ -473,7 +475,7 @@ in
|
|||
in {
|
||||
client_id = cfg.sso.clientID;
|
||||
client_name = "Forgejo";
|
||||
client_secret.source = cfg.sso.sharedSecretForAuthelia.result.path;
|
||||
client_secret.source = cfg.sso.secretFileForAuthelia;
|
||||
public = false;
|
||||
authorization_policy = cfg.sso.authorization_policy;
|
||||
redirect_uris = [ "https://${cfg.subdomain}.${cfg.domain}/user/oauth2/${provider}/callback" ];
|
||||
|
|
@ -484,8 +486,8 @@ in
|
|||
(lib.mkIf cfg.enable {
|
||||
systemd.services.forgejo.preStart = ''
|
||||
admin="${lib.getExe config.services.forgejo.package} admin user"
|
||||
$admin create --admin --email "root@localhost" --username meadmin --password "$(tr -d '\n' < ${cfg.adminPassword.result.path})" || true
|
||||
$admin change-password --username meadmin --password "$(tr -d '\n' < ${cfg.adminPassword.result.path})" || true
|
||||
$admin create --admin --email "root@localhost" --username meadmin --password "$(tr -d '\n' < ${cfg.adminPasswordFile})" || true
|
||||
$admin change-password --username meadmin --password "$(tr -d '\n' < ${cfg.adminPasswordFile})" || true
|
||||
'';
|
||||
})
|
||||
|
||||
|
|
|
|||
|
|
@ -67,12 +67,9 @@ in
|
|||
default = "jellyfin_admin";
|
||||
};
|
||||
|
||||
adminPassword = contracts.secret.mkOption {
|
||||
description = "LDAP admin password.";
|
||||
mode = "0440";
|
||||
owner = "jellyfin";
|
||||
group = "jellyfin";
|
||||
restartUnits = [ "jellyfin.service" ];
|
||||
passwordFile = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
description = "File containing the LDAP admin password.";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
|
@ -121,18 +118,9 @@ in
|
|||
default = "one_factor";
|
||||
};
|
||||
|
||||
sharedSecret = contracts.secret.mkOption {
|
||||
description = "OIDC shared secret for Jellyfin.";
|
||||
mode = "0440";
|
||||
owner = "jellyfin";
|
||||
group = "jellyfin";
|
||||
restartUnits = [ "jellyfin.service" ];
|
||||
};
|
||||
|
||||
sharedSecretForAuthelia = contracts.secret.mkOption {
|
||||
description = "OIDC shared secret for Authelia.";
|
||||
mode = "0400";
|
||||
owner = config.shb.authelia.autheliaUser;
|
||||
secretFile = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
description = "File containing the OIDC shared secret.";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
|
@ -412,35 +400,30 @@ in
|
|||
lib.strings.optionalString cfg.ldap.enable (shblib.replaceSecretsScript {
|
||||
file = ldapConfig;
|
||||
resultPath = "/var/lib/jellyfin/plugins/configurations/LDAP-Auth.xml";
|
||||
replacements = [
|
||||
{
|
||||
name = [ "%LDAP_PASSWORD%" ];
|
||||
source = cfg.ldap.adminPassword.result.path;
|
||||
}
|
||||
];
|
||||
replacements = {
|
||||
"%LDAP_PASSWORD%" = "$(cat ${cfg.ldap.passwordFile})";
|
||||
};
|
||||
})
|
||||
+ lib.strings.optionalString cfg.sso.enable (shblib.replaceSecretsScript {
|
||||
file = ssoConfig;
|
||||
resultPath = "/var/lib/jellyfin/plugins/configurations/SSO-Auth.xml";
|
||||
replacements = [
|
||||
{
|
||||
name = [ "%SSO_SECRET%" ];
|
||||
source = cfg.sso.sharedSecret.result.path;
|
||||
}
|
||||
];
|
||||
replacements = {
|
||||
"%SSO_SECRET%" = "$(cat ${cfg.sso.secretFile})";
|
||||
};
|
||||
})
|
||||
+ lib.strings.optionalString cfg.sso.enable (shblib.replaceSecretsScript {
|
||||
file = brandingConfig;
|
||||
resultPath = "/var/lib/jellyfin/config/branding.xml";
|
||||
replacements = [
|
||||
];
|
||||
replacements = {
|
||||
"%a%" = "%a%";
|
||||
};
|
||||
});
|
||||
|
||||
shb.authelia.oidcClients = lib.lists.optionals (!(isNull cfg.sso)) [
|
||||
{
|
||||
client_id = cfg.sso.clientID;
|
||||
client_name = "Jellyfin";
|
||||
client_secret.source = cfg.sso.sharedSecretForAuthelia.result.path;
|
||||
client_secret.source = cfg.sso.secretFile;
|
||||
public = false;
|
||||
authorization_policy = cfg.sso.authorization_policy;
|
||||
redirect_uris = [ "https://${cfg.subdomain}.${cfg.domain}/sso/OID/r/${cfg.sso.provider}" ];
|
||||
|
|
|
|||
|
|
@ -13,7 +13,6 @@ in
|
|||
(pkgs'.path + "/nixos/modules/profiles/headless.nix")
|
||||
(pkgs'.path + "/nixos/modules/profiles/qemu-guest.nix")
|
||||
../../modules/blocks/authelia.nix
|
||||
../../modules/blocks/hardcodedsecret.nix
|
||||
../../modules/blocks/ldap.nix
|
||||
../../modules/blocks/postgresql.nix
|
||||
];
|
||||
|
|
@ -45,12 +44,14 @@ in
|
|||
ldapPort = config.shb.ldap.ldapPort;
|
||||
dcdomain = config.shb.ldap.dcdomain;
|
||||
secrets = {
|
||||
jwtSecret.result.path = config.shb.hardcodedsecret.autheliaJwtSecret.path;
|
||||
ldapAdminPassword.result.path = config.shb.hardcodedsecret.ldapAdminPassword.path;
|
||||
sessionSecret.result.path = config.shb.hardcodedsecret.sessionSecret.path;
|
||||
storageEncryptionKey.result.path = config.shb.hardcodedsecret.storageEncryptionKey.path;
|
||||
identityProvidersOIDCHMACSecret.result.path = config.shb.hardcodedsecret.identityProvidersOIDCHMACSecret.path;
|
||||
identityProvidersOIDCIssuerPrivateKey.result.path = config.shb.hardcodedsecret.identityProvidersOIDCIssuerPrivateKey.path;
|
||||
jwtSecretFile = pkgs.writeText "jwtSecretFile" "jwtSecretFile";
|
||||
ldapAdminPasswordFile = pkgs.writeText "ldapAdminPasswordFile" ldapAdminPassword;
|
||||
sessionSecretFile = pkgs.writeText "sessionSecretFile" "sessionSecretFile";
|
||||
storageEncryptionKeyFile = pkgs.writeText "storageEncryptionKeyFile" "storageEncryptionKeyFile";
|
||||
identityProvidersOIDCHMACSecretFile = pkgs.writeText "identityProvidersOIDCHMACSecretFile" "identityProvidersOIDCHMACSecretFile";
|
||||
# This needs to be of the correct shape and at least 2048 bits. Generated with:
|
||||
# nix run nixpkgs#openssl -- genrsa -out keypair.pem 2048
|
||||
identityProvidersOIDCIssuerPrivateKeyFile = pkgs.writeText "identityProvidersOIDCIssuerPrivateKeyFile" (builtins.readFile ./keypair.pem);
|
||||
};
|
||||
|
||||
oidcClients = [
|
||||
|
|
@ -72,28 +73,6 @@ in
|
|||
}
|
||||
];
|
||||
};
|
||||
|
||||
shb.hardcodedsecret.autheliaJwtSecret = config.shb.authelia.secrets.jwtSecret.request // {
|
||||
content = "jwtSecret";
|
||||
};
|
||||
shb.hardcodedsecret.ldapAdminPassword = config.shb.authelia.secrets.ldapAdminPassword.request // {
|
||||
content = ldapAdminPassword;
|
||||
};
|
||||
shb.hardcodedsecret.sessionSecret = config.shb.authelia.secrets.sessionSecret.request // {
|
||||
content = "sessionSecret";
|
||||
};
|
||||
shb.hardcodedsecret.storageEncryptionKey = config.shb.authelia.secrets.storageEncryptionKey.request // {
|
||||
content = "storageEncryptionKey";
|
||||
};
|
||||
shb.hardcodedsecret.identityProvidersOIDCHMACSecret = config.shb.authelia.secrets.identityProvidersOIDCHMACSecret.request // {
|
||||
content = "identityProvidersOIDCHMACSecret";
|
||||
};
|
||||
shb.hardcodedsecret.identityProvidersOIDCIssuerPrivateKey = config.shb.authelia.secrets.identityProvidersOIDCIssuerPrivateKey.request // {
|
||||
source = (pkgs.runCommand "gen-private-key" {} ''
|
||||
mkdir $out
|
||||
${pkgs.openssl}/bin/openssl genrsa -out $out/private.pem 4096
|
||||
'') + "/private.pem";
|
||||
};
|
||||
};
|
||||
|
||||
testScript = { nodes, ... }: ''
|
||||
|
|
|
|||
|
|
@ -12,25 +12,11 @@ let
|
|||
commonTest = user: pkgs.testers.runNixOSTest {
|
||||
name = "restic_backupAndRestore_${user}";
|
||||
|
||||
nodes.machine = { config, ... }: {
|
||||
nodes.machine = {
|
||||
imports = ( testLib.baseImports pkgs' ) ++ [
|
||||
../../modules/blocks/hardcodedsecret.nix
|
||||
../../modules/blocks/restic.nix
|
||||
];
|
||||
|
||||
shb.hardcodedsecret.A = {
|
||||
owner = "root";
|
||||
group = "keys";
|
||||
mode = "0440";
|
||||
content = "secretA";
|
||||
};
|
||||
shb.hardcodedsecret.B = {
|
||||
owner = "root";
|
||||
group = "keys";
|
||||
mode = "0440";
|
||||
content = "secretB";
|
||||
};
|
||||
|
||||
shb.restic.instances."testinstance" = {
|
||||
enable = true;
|
||||
|
||||
|
|
@ -53,8 +39,8 @@ let
|
|||
# Those are not needed by the repository but are still included
|
||||
# so we can test them in the hooks section.
|
||||
secrets = {
|
||||
A.source = config.shb.hardcodedsecret.A.path;
|
||||
B.source = config.shb.hardcodedsecret.B.path;
|
||||
A.source = "/run/secrets/A";
|
||||
B.source = "/run/secrets/B";
|
||||
};
|
||||
}
|
||||
{
|
||||
|
|
@ -111,6 +97,19 @@ let
|
|||
if len(result) > 0:
|
||||
raise Exception("Unexpected files:", result)
|
||||
|
||||
with subtest("Create secrets"):
|
||||
print(machine.succeed("""
|
||||
mkdir -p /run/secrets/
|
||||
|
||||
echo secretA > /run/secrets/A
|
||||
echo secretB > /run/secrets/B
|
||||
|
||||
chown root:keys -R /run/secrets
|
||||
find /run/secrets -type d -exec chmod u=rwx,g=rx,o=x '{}' ';'
|
||||
find /run/secrets -type f -exec chmod u=r,g=r,o= '{}' ';'
|
||||
ls -l /run/secrets
|
||||
"""))
|
||||
|
||||
with subtest("Create initial content"):
|
||||
machine.succeed("""
|
||||
mkdir -p /opt/files/A
|
||||
|
|
|
|||
|
|
@ -1,4 +1,6 @@
|
|||
{ lib }:
|
||||
{
|
||||
lib,
|
||||
}:
|
||||
let
|
||||
baseImports = pkgs: [
|
||||
(pkgs.path + "/nixos/modules/profiles/headless.nix")
|
||||
|
|
@ -107,7 +109,6 @@ in
|
|||
../modules/blocks/postgresql.nix
|
||||
../modules/blocks/authelia.nix
|
||||
../modules/blocks/nginx.nix
|
||||
../modules/blocks/hardcodedsecret.nix
|
||||
]
|
||||
++ additionalModules;
|
||||
|
||||
|
|
@ -137,7 +138,7 @@ in
|
|||
systemd.services.nginx.requires = [ config.shb.certs.certs.selfsigned.n.systemdService ];
|
||||
};
|
||||
|
||||
ldap = domain: pkgs: { config, ... }: {
|
||||
ldap = domain: pkgs: {
|
||||
imports = [
|
||||
../modules/blocks/ldap.nix
|
||||
];
|
||||
|
|
@ -146,13 +147,6 @@ in
|
|||
"127.0.0.1" = [ "ldap.${domain}" ];
|
||||
};
|
||||
|
||||
shb.hardcodedsecret.ldapUserPassword = config.shb.ldap.ldapUserPassword.request // {
|
||||
content = "ldapUserPassword";
|
||||
};
|
||||
shb.hardcodedsecret.jwtSecret = config.shb.ldap.ldapUserPassword.request // {
|
||||
content = "jwtSecrets";
|
||||
};
|
||||
|
||||
shb.ldap = {
|
||||
enable = true;
|
||||
inherit domain;
|
||||
|
|
@ -160,8 +154,8 @@ in
|
|||
ldapPort = 3890;
|
||||
webUIListenPort = 17170;
|
||||
dcdomain = "dc=example,dc=com";
|
||||
ldapUserPassword.result.path = config.shb.hardcodedsecret.ldapUserPassword.path;
|
||||
jwtSecret.result.path = config.shb.hardcodedsecret.jwtSecret.path;
|
||||
ldapUserPassword.result.path = pkgs.writeText "ldapUserPassword" "ldapUserPassword";
|
||||
jwtSecret.result.path = pkgs.writeText "jwtSecret" "jwtSecret";
|
||||
};
|
||||
};
|
||||
|
||||
|
|
@ -185,36 +179,17 @@ in
|
|||
dcdomain = config.shb.ldap.dcdomain;
|
||||
|
||||
secrets = {
|
||||
jwtSecret.result.path = config.shb.hardcodedsecret.autheliaJwtSecret.path;
|
||||
ldapAdminPassword.result.path = config.shb.hardcodedsecret.ldapAdminPassword.path;
|
||||
sessionSecret.result.path = config.shb.hardcodedsecret.sessionSecret.path;
|
||||
storageEncryptionKey.result.path = config.shb.hardcodedsecret.storageEncryptionKey.path;
|
||||
identityProvidersOIDCHMACSecret.result.path = config.shb.hardcodedsecret.identityProvidersOIDCHMACSecret.path;
|
||||
identityProvidersOIDCIssuerPrivateKey.result.path = config.shb.hardcodedsecret.identityProvidersOIDCIssuerPrivateKey.path;
|
||||
};
|
||||
};
|
||||
|
||||
shb.hardcodedsecret.autheliaJwtSecret = config.shb.authelia.secrets.jwtSecret.request // {
|
||||
content = "jwtSecret";
|
||||
};
|
||||
shb.hardcodedsecret.ldapAdminPassword = config.shb.authelia.secrets.ldapAdminPassword.request // {
|
||||
content = "ldapUserPassword";
|
||||
};
|
||||
shb.hardcodedsecret.sessionSecret = config.shb.authelia.secrets.sessionSecret.request // {
|
||||
content = "sessionSecret";
|
||||
};
|
||||
shb.hardcodedsecret.storageEncryptionKey = config.shb.authelia.secrets.storageEncryptionKey.request // {
|
||||
content = "storageEncryptionKey";
|
||||
};
|
||||
shb.hardcodedsecret.identityProvidersOIDCHMACSecret = config.shb.authelia.secrets.identityProvidersOIDCHMACSecret.request // {
|
||||
content = "identityProvidersOIDCHMACSecret";
|
||||
};
|
||||
shb.hardcodedsecret.identityProvidersOIDCIssuerPrivateKey = config.shb.authelia.secrets.identityProvidersOIDCIssuerPrivateKey.request // {
|
||||
source = (pkgs.runCommand "gen-private-key" {} ''
|
||||
jwtSecretFile = pkgs.writeText "jwtSecret" "jwtSecret";
|
||||
ldapAdminPasswordFile = pkgs.writeText "ldapUserPassword" "ldapUserPassword";
|
||||
sessionSecretFile = pkgs.writeText "sessionSecret" "sessionSecret";
|
||||
storageEncryptionKeyFile = pkgs.writeText "storageEncryptionKey" "storageEncryptionKey";
|
||||
identityProvidersOIDCHMACSecretFile = pkgs.writeText "identityProvidersOIDCHMACSecret" "identityProvidersOIDCHMACSecret";
|
||||
identityProvidersOIDCIssuerPrivateKeyFile = (pkgs.runCommand "gen-private-key" {} ''
|
||||
mkdir $out
|
||||
${pkgs.openssl}/bin/openssl genrsa -out $out/private.pem 4096
|
||||
'') + "/private.pem";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,35 +0,0 @@
|
|||
{ pkgs, ... }:
|
||||
let
|
||||
contracts = pkgs.callPackage ../../modules/contracts {};
|
||||
in
|
||||
{
|
||||
hardcoded_root_root = contracts.test.secret {
|
||||
name = "hardcoded";
|
||||
modules = [ ../../modules/blocks/hardcodedsecret.nix ];
|
||||
configRoot = [ "shb" "hardcodedsecret" ];
|
||||
createContent = {
|
||||
content = "secretA";
|
||||
};
|
||||
};
|
||||
|
||||
hardcoded_user_group = contracts.test.secret {
|
||||
name = "hardcoded";
|
||||
modules = [ ../../modules/blocks/hardcodedsecret.nix ];
|
||||
configRoot = [ "shb" "hardcodedsecret" ];
|
||||
createContent = {
|
||||
content = "secretA";
|
||||
};
|
||||
owner = "user";
|
||||
group = "group";
|
||||
mode = "640";
|
||||
};
|
||||
|
||||
# TODO: how to do this?
|
||||
# sops = contracts.test.secret {
|
||||
# name = "sops";
|
||||
# configRoot = cfg: name: cfg.sops.secrets.${name};
|
||||
# createContent = content: {
|
||||
# sopsFile = ./secret/sops.yaml;
|
||||
# };
|
||||
# };
|
||||
}
|
||||
|
|
@ -1,8 +1,6 @@
|
|||
{ pkgs, lib, ... }:
|
||||
let
|
||||
shblib = pkgs.callPackage ../../lib {};
|
||||
|
||||
inherit (lib) nameValuePair;
|
||||
in
|
||||
{
|
||||
# Tests that withReplacements can:
|
||||
|
|
@ -81,15 +79,15 @@ in
|
|||
testLibGetReplacements = {
|
||||
expected =
|
||||
let
|
||||
secrets = root: [
|
||||
(nameValuePair "%SECRET_${root}B%" "$(cat /path/B)")
|
||||
(nameValuePair "%SECRET_${root}C%" "prefix-$(cat /path/C)-suffix")
|
||||
];
|
||||
secrets = root: {
|
||||
"%SECRET_${root}B%" = "$(cat /path/B)";
|
||||
"%SECRET_${root}C%" = "prefix-$(cat /path/C)-suffix";
|
||||
};
|
||||
in
|
||||
(secrets "") ++
|
||||
(secrets "DOUBLENESTEDLIST_0_N_") ++
|
||||
(secrets "NESTEDATTR_") ++
|
||||
(secrets "NESTEDLIST_0_");
|
||||
(secrets "") //
|
||||
(secrets "NESTEDATTR_") //
|
||||
(secrets "NESTEDLIST_0_") //
|
||||
(secrets "DOUBLENESTEDLIST_0_N_");
|
||||
expr =
|
||||
let
|
||||
item = {
|
||||
|
|
@ -101,13 +99,13 @@ in
|
|||
c.other = "other";
|
||||
};
|
||||
in
|
||||
map shblib.genReplacement (shblib.getReplacements (
|
||||
shblib.getReplacements (
|
||||
item // {
|
||||
nestedAttr = item;
|
||||
nestedList = [ item ];
|
||||
doubleNestedList = [ { n = item; } ];
|
||||
}
|
||||
));
|
||||
);
|
||||
};
|
||||
|
||||
testParseXML = {
|
||||
|
|
|
|||
|
|
@ -29,27 +29,19 @@ let
|
|||
../../modules/services/forgejo.nix
|
||||
];
|
||||
|
||||
basic = { config, ... }: {
|
||||
basic = {
|
||||
shb.forgejo = {
|
||||
enable = true;
|
||||
inherit domain subdomain;
|
||||
|
||||
adminPassword.result.path = config.shb.hardcodedsecret.forgejoAdminPassword.path;
|
||||
databasePassword.result.path = config.shb.hardcodedsecret.forgejoDatabasePassword.path;
|
||||
adminPasswordFile = pkgs.writeText "adminPasswordFile" adminPassword;
|
||||
databasePasswordFile = pkgs.writeText "databasePassword" "databasePassword";
|
||||
};
|
||||
|
||||
# Needed for gitea-runner-local to be able to ping forgejo.
|
||||
networking.hosts = {
|
||||
"127.0.0.1" = [ "${subdomain}.${domain}" ];
|
||||
};
|
||||
|
||||
shb.hardcodedsecret.forgejoAdminPassword = config.shb.forgejo.adminPassword.request // {
|
||||
content = adminPassword;
|
||||
};
|
||||
|
||||
shb.hardcodedsecret.forgejoDatabasePassword = config.shb.forgejo.databasePassword.request // {
|
||||
content = "databasePassword";
|
||||
};
|
||||
};
|
||||
|
||||
https = { config, ... }: {
|
||||
|
|
@ -65,13 +57,9 @@ let
|
|||
host = "127.0.0.1";
|
||||
port = config.shb.ldap.ldapPort;
|
||||
dcdomain = config.shb.ldap.dcdomain;
|
||||
adminPassword.result.path = config.shb.hardcodedsecret.forgejoLdapUserPassword.path;
|
||||
adminPasswordFile = config.shb.ldap.ldapUserPassword.result.path;
|
||||
};
|
||||
};
|
||||
|
||||
shb.hardcodedsecret.forgejoLdapUserPassword = config.shb.forgejo.ldap.adminPassword.request // {
|
||||
content = "ldapUserPassword";
|
||||
};
|
||||
};
|
||||
|
||||
sso = { config, ... }: {
|
||||
|
|
@ -79,18 +67,10 @@ let
|
|||
sso = {
|
||||
enable = true;
|
||||
endpoint = "https://${config.shb.authelia.subdomain}.${config.shb.authelia.domain}";
|
||||
sharedSecret.result.path = config.shb.hardcodedsecret.forgejoSSOPassword.path;
|
||||
sharedSecretForAuthelia.result.path = config.shb.hardcodedsecret.forgejoSSOPasswordAuthelia.path;
|
||||
secretFile = pkgs.writeText "ssoSecretFile" "ssoSecretFile";
|
||||
secretFileForAuthelia = pkgs.writeText "ssoSecretFile" "ssoSecretFile";
|
||||
};
|
||||
};
|
||||
|
||||
shb.hardcodedsecret.forgejoSSOPassword = config.shb.forgejo.sso.sharedSecret.request // {
|
||||
content = "ssoPassword";
|
||||
};
|
||||
|
||||
shb.hardcodedsecret.forgejoSSOPasswordAuthelia = config.shb.forgejo.sso.sharedSecretForAuthelia.request // {
|
||||
content = "ssoPassword";
|
||||
};
|
||||
};
|
||||
in
|
||||
{
|
||||
|
|
|
|||
|
|
@ -43,13 +43,9 @@ let
|
|||
host = "127.0.0.1";
|
||||
port = config.shb.ldap.ldapPort;
|
||||
dcdomain = config.shb.ldap.dcdomain;
|
||||
adminPassword.result.path = config.shb.hardcodedsecret.jellyfinLdapUserPassword.path;
|
||||
passwordFile = config.shb.ldap.ldapUserPassword.result.path;
|
||||
};
|
||||
};
|
||||
|
||||
shb.hardcodedsecret.jellyfinLdapUserPassword = config.shb.jellyfin.ldap.adminPassword.request // {
|
||||
content = "ldapUserPassword";
|
||||
};
|
||||
};
|
||||
|
||||
sso = { config, ... }: {
|
||||
|
|
@ -57,18 +53,9 @@ let
|
|||
sso = {
|
||||
enable = true;
|
||||
endpoint = "https://${config.shb.authelia.subdomain}.${config.shb.authelia.domain}";
|
||||
sharedSecret.result.path = config.shb.hardcodedsecret.jellyfinSSOPassword.path;
|
||||
sharedSecretForAuthelia.result.path = config.shb.hardcodedsecret.jellyfinSSOPasswordAuthelia.path;
|
||||
secretFile = pkgs.writeText "ssoSecretFile" "ssoSecretFile";
|
||||
};
|
||||
};
|
||||
|
||||
shb.hardcodedsecret.jellyfinSSOPassword = config.shb.jellyfin.sso.sharedSecret.request // {
|
||||
content = "ssoPassword";
|
||||
};
|
||||
|
||||
shb.hardcodedsecret.jellyfinSSOPasswordAuthelia = config.shb.jellyfin.sso.sharedSecretForAuthelia.request // {
|
||||
content = "ssoPassword";
|
||||
};
|
||||
};
|
||||
in
|
||||
{
|
||||
|
|
|
|||
Loading…
Reference in a new issue