feat: promote oauth proxy config to a nginx virtualHosts option

hosts/sentinel/oauth2.nix

@@ -17,7 +17,6 @@
   };
 
   services.oauth2_proxy = {
-    # TODO cookie refresh
     provider = "oidc";
     scope = "openid";
     loginURL = "https://${config.proxiedDomains.kanidm}/ui/oauth2";
@@ -25,9 +24,16 @@
     validateURL = "https://${config.proxiedDomains.kanidm}/oauth2/openid/web-sentinel/userinfo";
     clientID = "web-sentinel";
     keyFile = config.age.secrets.oauth2-proxy-secret.path;
-
     email.domains = ["*"];
 
-    extraConfig.skip-provider-button = true;
+    extraConfig = {
+      # TODO good idea? would fail when offline
+      # TODO autorestart after 30 minutes, infinite times.
+      oidc-issuer-url = "https://${config.proxiedDomains.kanidm}/oauth2/openid/web-sentinel";
+      skip-provider-button = true;
+
+      # TODO away
+      show-debug-on-error = true;
+    };
   };
 }

hosts/ward/microvms/adguardhome/default.nix

@@ -24,7 +24,6 @@ in {
   nodes.sentinel = {
     proxiedDomains.adguard = adguardhomeDomain;
 
-    extra.oauth2_proxy.nginx.virtualHosts."${adguardhomeDomain}".allowedGroups = ["adguardhome"];
     services.nginx = {
       upstreams.adguardhome = {
         servers."${config.services.adguardhome.settings.bind_host}:${toString config.services.adguardhome.settings.bind_port}" = {};
@@ -36,8 +35,10 @@ in {
       virtualHosts.${adguardhomeDomain} = {
         forceSSL = true;
         useACMEHost = sentinelCfg.lib.extra.matchingWildcardCert adguardhomeDomain;
+        oauth2.enable = true;
+        oauth2.allowedGroups = ["adguardhome"];
         locations."/" = {
-          proxyPass = "https://adguardhome";
+          proxyPass = "http://adguardhome";
           proxyWebsockets = true;
         };
       };

hosts/ward/microvms/grafana/default.nix

@@ -54,7 +54,7 @@ in {
         forceSSL = true;
         useACMEHost = sentinelCfg.lib.extra.matchingWildcardCert grafanaDomain;
         locations."/" = {
-          proxyPass = "https://grafana";
+          proxyPass = "http://grafana";
           proxyWebsockets = true;
         };
       };

hosts/ward/microvms/loki/default.nix

@@ -45,7 +45,7 @@ in {
         forceSSL = true;
         useACMEHost = sentinelCfg.lib.extra.matchingWildcardCert lokiDomain;
         locations."/" = {
-          proxyPass = "https://loki";
+          proxyPass = "http://loki";
           proxyWebsockets = true;
           extraConfig = ''
             auth_basic "Authentication required";
@@ -58,7 +58,7 @@ in {
           '';
         };
         locations."= /ready" = {
-          proxyPass = "https://loki";
+          proxyPass = "http://loki";
           extraConfig = ''
             auth_basic off;
             access_log off;