forked from lukas/nixos-config
50 lines
1.5 KiB
Nix
50 lines
1.5 KiB
Nix
{ config, pkgs, ... }:
|
|
let
|
|
clientSecretFile = "/run/oauth2-proxy-secret/client-secret";
|
|
in
|
|
{
|
|
services.oauth2-proxy = {
|
|
enable = true;
|
|
oidcIssuerUrl = "https://dex.${config.domain}/dex";
|
|
httpAddress = "127.0.0.1:4180";
|
|
clientID = "oauth2-proxy";
|
|
clientSecretFile = clientSecretFile;
|
|
reverseProxy = true;
|
|
trustedProxyIP = [ "127.0.0.1/32" ];
|
|
cookie.secretFile = config.age.secrets.oauth2Cookie.path;
|
|
cookie.secure = true;
|
|
email.domains = [ "*" ];
|
|
provider = "oidc";
|
|
upstream = [ "http://${config.tailnetIPs.pinix}:8001/" ];
|
|
redirectURL = "https://${config.domain}/oauth2/callback";
|
|
};
|
|
|
|
systemd.services.oauth2-proxy-secret = {
|
|
description = "Prepare oauth2-proxy client secret";
|
|
before = [ "oauth2-proxy.service" ];
|
|
restartTriggers = [ config.age.secrets.oidcOauth2.file ];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
RemainAfterExit = true;
|
|
RuntimeDirectory = "oauth2-proxy-secret";
|
|
RuntimeDirectoryMode = "0700";
|
|
};
|
|
script = ''
|
|
umask 077
|
|
${pkgs.coreutils}/bin/tr -d '\r\n' \
|
|
< ${config.age.secrets.oidcOauth2.path} \
|
|
> ${clientSecretFile}
|
|
'';
|
|
};
|
|
|
|
systemd.services.oauth2-proxy = {
|
|
after = [ "dex.service" "traefik.service" ];
|
|
requires = [ "oauth2-proxy-secret.service" ];
|
|
wants = [ "dex.service" "traefik.service" ];
|
|
restartTriggers = [
|
|
config.age.secrets.oauth2Cookie.file
|
|
config.age.secrets.oidcOauth2.file
|
|
];
|
|
serviceConfig.RestartSec = "5s";
|
|
};
|
|
}
|