forked from lukas/nixos-config
017fbe39c6
Vikunja's SSRF protection blocked outgoing webhook requests to the tailnet (100.64.0.0/10), so the already-configured webhook rows never delivered. Verified live with a real task change after the fix: message landed in vikunja@muc.0ff.space. Documents both this and the earlier MUC room-creation finding in CLAUDE.md/roadmap.
32 lines
1 KiB
Nix
32 lines
1 KiB
Nix
{ config, ... }:
|
|
{
|
|
services.vikunja = {
|
|
enable = true;
|
|
port = 8026;
|
|
frontendScheme = "https";
|
|
frontendHostname = "board.${config.domain}";
|
|
settings = {
|
|
service.enableregistration = false;
|
|
# Webhook targets live on the tailnet (100.64.0.0/10), which Vikunja's
|
|
# SSRF protection blocks by default ("prohibited IP address").
|
|
outgoingrequests.allownonroutableips = true;
|
|
auth = {
|
|
local.enabled = false;
|
|
openid = {
|
|
enabled = true;
|
|
redirecturl = "https://board.${config.domain}/auth/openid/";
|
|
providers.dex = {
|
|
name = "dex";
|
|
authurl = "https://dex.${config.domain}/dex";
|
|
clientid = "vikunja";
|
|
clientsecret.file = "$CREDENTIALS_DIRECTORY/oidc-client-secret";
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
# Pass the OIDC secret through a private systemd credential file.
|
|
systemd.services.vikunja.serviceConfig.LoadCredential =
|
|
"oidc-client-secret:${config.age.secrets.oidcVikunja.path}";
|
|
}
|