nixos-config/hosts/blunix/localServices/dex.nix

{ config, ... }:
{
disabledModules = [ "services/web-apps/dex.nix" ];

  services.dex = {
    enable = true;
    settings = {
      logger = {
        level = "debug";
      };
      issuer = "https://dex.${config.domain}/dex";
#       
      storage = {
        type = "sqlite3";
        config = {
          file = "/run/dex/dex.db";
        };
      };
#		        
      web = {
        http = "127.0.0.1:5556";
      };

      frontend = {
	theme = "dark";
      };

      staticClients = [
        {
          id = "gotosocial";
	  name = "gotosocial";
          redirectURIs = [ "https://social.${config.domain}/auth/callback" ];
	  secretFile = config.age.secrets.oidcGTS.path;
	}
        {
          id = "forgejo";
	  name = "forgejo";
          redirectURIs = [ "https://git.${config.domain}/user/oauth2/dex/callback" ];
	  secretFile = config.age.secrets.oidcForgejo.path;
	}
        {
          id = "oauth2-proxy";
          name = config.domain;
          redirectURIs = [ "https://${config.domain}/oauth2/callback" ];
          secretFile = config.age.secrets.oidcOauth2.path;
        }
        {
          id = "vikunja";
	  name = "vikunja";
          redirectURIs = [ "https://board.${config.domain}/auth/openid/dex" ];
	  secretFile = config.age.secrets.oidcVikunja.path;
	}
        {
          id = "headscale";
	  name = "headscale";
          redirectURIs = [ "https://tail.${config.domain}/admin/oidc/callback" "https://head.${config.domain}/oidc/callback"];
	  secretFile = config.age.secrets.oidcHeadscale.path;
	}
          {
          id = "audiobookshelf";
	  name = "audiobookshelf";
          redirectURIs = ["https://abs.${config.domain}/auth/openid/callback"  "https://abs.${config.domain}/auth/openid/mobile-redirect"];
	  secretFile = config.age.secrets.oidcAudiobookshelf.path;
	}
	  {
          id = "quantum";
	  name = "quantum";
          redirectURIs = ["https://quantum.${config.domain}/auth/openid/callback" "https://quantum.${config.domain}/api/auth/oidc/callback"];
	  secretFile = config.age.secrets.oidcQuantum.path;
	}
      ];

      connectors = [
        {
	  type = "ldap";
	  id = "ldap";
	  name = "ldap";
	  config = {
	    host = "127.0.0.1:3890";
	    insecureNoSSL = true;
	    startTLS = false;
	    #insecureSkipVerify= true;
	    bindDN = "uid=admin,ou=people,${config.ldapBaseDN}";
	    bindPW = config.age.secrets.lldapAdmin.path;
	    userSearch = {
	      baseDN = "ou=people,${config.ldapBaseDN}";
	      #filter = "(objectClass=inetOrgPerson)";
	      username = "uid";
	      idAttr = "uid";
	      emailAttr = "mail";
	      nameAttr = "displayName";
	      preferredUsernameAttr = "uid";
	    };
	    groupSearch = {
              baseDN = "ou=groups,${config.ldapBaseDN}";
              filter = "(objectClass=groupOfUniqueNames)";
              userMatchers = [{
                userAttr = "DN";
                groupAttr = "member";
		}];
              nameAttr = "cn";
	    };
	  };
	}
      ];


      expiry = {
        deviceRequests = "5m";
        signingKeys = "6h";
        idTokens = "24h";
        refreshTokens = {
          disableRotation = false;
          reuseInterval = "3s";
          validIfNotUsedFor = "2160h";
          absoluteLifetime = "3960h" ;
        };
      };

    };
  };

  # Restart Dex when agenix source files change because their runtime paths stay stable.
  systemd.services.dex.restartTriggers = [
    config.age.secrets.lldapAdmin.file
    config.age.secrets.oidcAudiobookshelf.file
    config.age.secrets.oidcForgejo.file
    config.age.secrets.oidcGTS.file
    config.age.secrets.oidcHeadscale.file
    config.age.secrets.oidcOauth2.file
    config.age.secrets.oidcQuantum.file
    config.age.secrets.oidcVikunja.file
  ];
}