mirror of
https://github.com/oddlama/nix-config.git
synced 2025-10-10 23:00:39 +02:00
feat: add oauth2 proxy module and simple nginx reverse proxy module
This commit is contained in:
oddlama
parent
e32d5575b4
commit
609e562bec
4 changed files with 249 additions and 38 deletions
|
|
@ -1,23 +1,30 @@
|
|||
{
|
||||
config,
|
||||
lib,
|
||||
nodePath,
|
||||
...
|
||||
}: let
|
||||
inherit
|
||||
(lib)
|
||||
assertMsg
|
||||
filter
|
||||
flip
|
||||
genAttrs
|
||||
hasInfix
|
||||
head
|
||||
mapAttrs
|
||||
mapAttrs'
|
||||
mdDoc
|
||||
mkIf
|
||||
mkOption
|
||||
nameValuePair
|
||||
optionals
|
||||
removeSuffix
|
||||
types
|
||||
;
|
||||
in {
|
||||
options.extra.acme.wildcardDomains = mkOption {
|
||||
options.extra = {
|
||||
acme.wildcardDomains = mkOption {
|
||||
default = [];
|
||||
example = ["example.org"];
|
||||
type = types.listOf types.str;
|
||||
|
|
@ -29,6 +36,37 @@ in {
|
|||
'';
|
||||
};
|
||||
|
||||
nginx.proxiedDomains = mkOption {
|
||||
default = {};
|
||||
description = mdDoc "Simplified reverse proxy setup.";
|
||||
type = types.attrsOf (types.submodule (submod: {
|
||||
options = {
|
||||
domain = mkOption {
|
||||
type = types.str;
|
||||
description = mdDoc "The public domain for the virtual host.";
|
||||
};
|
||||
|
||||
upstream = mkOption {
|
||||
type = types.str;
|
||||
description = mdDoc "The upstream server to which requests are forwarded.";
|
||||
};
|
||||
|
||||
scheme = mkOption {
|
||||
type = types.str;
|
||||
default = "http";
|
||||
description = mdDoc "The scheme to use when connecting to upstream.";
|
||||
};
|
||||
|
||||
useACMEHost = mkOption {
|
||||
type = types.str;
|
||||
default = config.lib.extra.matchingWildcardCert submod.config.domain;
|
||||
description = mdDoc "The acme host certificate to use for the virtual host.";
|
||||
};
|
||||
};
|
||||
}));
|
||||
};
|
||||
};
|
||||
|
||||
config = {
|
||||
lib.extra = {
|
||||
# For a given domain, this searches for a matching wildcard acme domain that
|
||||
|
|
@ -44,31 +82,17 @@ in {
|
|||
head matchingCerts;
|
||||
};
|
||||
|
||||
security.acme.certs = lib.genAttrs config.extra.acme.wildcardDomains (domain: {
|
||||
security.acme.certs = genAttrs config.extra.acme.wildcardDomains (domain: {
|
||||
extraDomainNames = ["*.${domain}"];
|
||||
});
|
||||
|
||||
# Sensible defaults for caddy
|
||||
services.caddy = mkIf config.services.caddy.enable {
|
||||
extraConfig = ''
|
||||
(common) {
|
||||
encode zstd gzip
|
||||
|
||||
header {
|
||||
# Enable HTTP Strict Transport Security (HSTS)
|
||||
Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
|
||||
|
||||
X-XSS-Protection "1; mode=block"
|
||||
X-Frame-Options "DENY"
|
||||
X-Content-Type-Options "nosniff"
|
||||
|
||||
# Remove unnecessary information and remove Last-Modified in favor of ETag
|
||||
-Server
|
||||
-X-Powered-By
|
||||
-Last-Modified
|
||||
}
|
||||
}
|
||||
'';
|
||||
age.secrets = mkIf config.services.nginx.enable {
|
||||
"dhparams.pem" = {
|
||||
rekeyFile = nodePath + "/secrets/dhparams.pem.age";
|
||||
generator = "dhparams";
|
||||
mode = "440";
|
||||
group = "nginx";
|
||||
};
|
||||
};
|
||||
|
||||
# Sensible defaults for nginx
|
||||
|
|
@ -86,12 +110,38 @@ in {
|
|||
error_log syslog:server=unix:/dev/log;
|
||||
access_log syslog:server=unix:/dev/log;
|
||||
ssl_ecdh_curve secp384r1;
|
||||
|
||||
# Enable HTTP Strict Transport Security (HSTS)
|
||||
add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
|
||||
|
||||
# Minimize information leaked to other domains
|
||||
add_header Referrer-Policy "origin-when-cross-origin";
|
||||
|
||||
add_header X-XSS-Protection "1; mode=block";
|
||||
add_header X-Frame-Options "DENY";
|
||||
add_header X-Content-Type-Options "nosniff";
|
||||
'';
|
||||
|
||||
upstreams =
|
||||
flip mapAttrs config.extra.nginx.proxiedDomains
|
||||
(name: cfg: {
|
||||
servers."${cfg.upstream}" = {};
|
||||
extraConfig = ''
|
||||
zone ${name} 64k;
|
||||
keepalive 2;
|
||||
'';
|
||||
});
|
||||
|
||||
virtualHosts =
|
||||
flip mapAttrs' config.extra.nginx.proxiedDomains
|
||||
(name: cfg:
|
||||
nameValuePair cfg.domain {
|
||||
forceSSL = true;
|
||||
inherit (cfg) useACMEHost;
|
||||
locations."/".proxyPass = "${cfg.scheme}://${name}";
|
||||
});
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts =
|
||||
optionals
|
||||
(config.services.caddy.enable || config.services.nginx.enable)
|
||||
[80 443];
|
||||
networking.firewall.allowedTCPPorts = optionals config.services.nginx.enable [80 443];
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -318,7 +318,7 @@ in {
|
|||
};
|
||||
|
||||
zfs = {
|
||||
enable = mkEnableOption (mdDoc "Enable persistent data on separate zfs dataset");
|
||||
enable = mkEnableOption (mdDoc "persistent data on separate zfs dataset");
|
||||
|
||||
pool = mkOption {
|
||||
type = types.str;
|
||||
|
|
|
|||
161
modules/oauth2-proxy.nix
Normal file
161
modules/oauth2-proxy.nix
Normal file
|
|
@ -0,0 +1,161 @@
|
|||
{
|
||||
lib,
|
||||
config,
|
||||
pkgs,
|
||||
...
|
||||
}: let
|
||||
inherit
|
||||
(lib)
|
||||
concatStringsSep
|
||||
flip
|
||||
mapAttrs
|
||||
mdDoc
|
||||
mkEnableOption
|
||||
mkIf
|
||||
mkOption
|
||||
optionalString
|
||||
types
|
||||
;
|
||||
|
||||
cfg = config.extra.oauth2_proxy;
|
||||
in {
|
||||
options.extra.oauth2_proxy = {
|
||||
enable = mkEnableOption (mdDoc "oauth2 proxy");
|
||||
|
||||
cookieDomain = mkOption {
|
||||
type = types.str;
|
||||
description = mdDoc "The domain under which to store the credetial cookie.";
|
||||
};
|
||||
|
||||
authProxyDomain = mkOption {
|
||||
type = types.str;
|
||||
description = mdDoc ''
|
||||
The domain under which to expose the oauth2 proxy.
|
||||
This must be a subdomain at or below the level of `cookieDomain`.
|
||||
'';
|
||||
};
|
||||
|
||||
nginx.virtualHosts = mkOption {
|
||||
default = {};
|
||||
description = mdDoc ''
|
||||
Access to all virtualHostst that have an entry here will be put behind
|
||||
the oauth2 proxy, requiring authentication before users can access the resource.
|
||||
Also set `allowedGroups` for granuar access control.
|
||||
'';
|
||||
type = types.attrsOf (types.submodule {
|
||||
options.allowedGroups = mkOption {
|
||||
type = types.listOf types.str;
|
||||
default = [];
|
||||
description = mdDoc ''
|
||||
A list of groups that are allowed to access this resource, or the
|
||||
empty list to allow any authenticated client.
|
||||
'';
|
||||
};
|
||||
});
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
services.oauth2_proxy = {
|
||||
enable = true;
|
||||
cookie.secure = true;
|
||||
cookie.httpOnly = false;
|
||||
reverseProxy = true;
|
||||
httpAddress = "unix:///run/oauth2_proxy/oauth2_proxy.sock";
|
||||
|
||||
# Share the cookie with all subpages
|
||||
extraConfig.whitelist-domain = ".${cfg.cookieDomain}";
|
||||
setXauthrequest = true;
|
||||
};
|
||||
|
||||
systemd.services.oauth2_proxy.serviceConfig = {
|
||||
RuntimeDirectory = "oauth2_proxy";
|
||||
RuntimeDirectoryMode = "0750";
|
||||
};
|
||||
|
||||
users.groups.oauth2_proxy.members = ["nginx"];
|
||||
|
||||
services.nginx = {
|
||||
upstreams.oauth2_proxy = {
|
||||
servers."unix:/run/oauth2_proxy/oauth2_proxy.sock" = {};
|
||||
extraConfig = ''
|
||||
zone oauth2_proxy 64k;
|
||||
keepalive 2;
|
||||
'';
|
||||
};
|
||||
|
||||
virtualHosts =
|
||||
{
|
||||
${cfg.authProxyDomain} = {
|
||||
forceSSL = true;
|
||||
useACMEHost = config.lib.extra.matchingWildcardCert cfg.authProxyDomain;
|
||||
|
||||
locations."/".extraConfig = ''
|
||||
deny all;
|
||||
return 404;
|
||||
'';
|
||||
|
||||
locations."/oauth2/" = {
|
||||
proxyPass = "http://oauth2_proxy";
|
||||
extraConfig = ''
|
||||
proxy_set_header X-Scheme $scheme;
|
||||
proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;
|
||||
'';
|
||||
};
|
||||
|
||||
locations."= /oauth2/auth" = {
|
||||
proxyPass = "http://oauth2_proxy";
|
||||
extraConfig = ''
|
||||
proxy_set_header X-Scheme $scheme;
|
||||
# nginx auth_request includes headers but not body
|
||||
proxy_set_header Content-Length "";
|
||||
proxy_pass_request_body off;
|
||||
'';
|
||||
};
|
||||
};
|
||||
}
|
||||
// flip mapAttrs cfg.nginx.virtualHosts
|
||||
(vhost: vhostCfg: let
|
||||
authQuery =
|
||||
optionalString (vhostCfg.allowedGroups != [])
|
||||
"?allowed_groups=${concatStringsSep "," vhostCfg.allowedGroups}";
|
||||
in {
|
||||
locations."/".extraConfig = ''
|
||||
auth_request /oauth2/auth;
|
||||
error_page 401 = /oauth2/sign_in;
|
||||
|
||||
# pass information via X-User and X-Email headers to backend,
|
||||
# requires running with --set-xauthrequest flag
|
||||
auth_request_set $user $upstream_http_x_auth_request_user;
|
||||
auth_request_set $email $upstream_http_x_auth_request_email;
|
||||
proxy_set_header X-User $user;
|
||||
proxy_set_header X-Email $email;
|
||||
|
||||
# if you enabled --cookie-refresh, this is needed for it to work with auth_request
|
||||
auth_request_set $auth_cookie $upstream_http_set_cookie;
|
||||
add_header Set-Cookie $auth_cookie;
|
||||
'';
|
||||
|
||||
locations."/oauth2/" = {
|
||||
proxyPass = "https://${cfg.authProxyDomain}";
|
||||
extraConfig = ''
|
||||
proxy_set_header X-Scheme $scheme;
|
||||
proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;
|
||||
'';
|
||||
};
|
||||
|
||||
locations."= /oauth2/auth" = {
|
||||
proxyPass = "https://${cfg.authProxyDomain}${authQuery}";
|
||||
extraConfig = ''
|
||||
internal;
|
||||
|
||||
proxy_set_header X-Scheme $scheme;
|
||||
# nginx auth_request includes headers but not body
|
||||
proxy_set_header Content-Length "";
|
||||
proxy_pass_request_body off;
|
||||
'';
|
||||
};
|
||||
});
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -18,7 +18,7 @@
|
|||
cfg = config.extra.promtail;
|
||||
in {
|
||||
options.extra.promtail = {
|
||||
enable = mkEnableOption (mdDoc "Enable promtail to push logs to a loki instance.");
|
||||
enable = mkEnableOption (mdDoc "promtail to push logs to a loki instance.");
|
||||
proxy = mkOption {
|
||||
type = types.str;
|
||||
description = mdDoc "The node name of the proxy server which provides the https loki api endpoint.";
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue