mirrors_public/oddlama_nix-config
1
1
Fork 1
mirror of https://github.com/oddlama/nix-config.git synced 2025-10-11 07:10:39 +02:00
Code Activity

refactor: move all proxy related configuration to the nodes that define them

Browse source
This commit is contained in:
oddlama 2023-06-13 02:58:14 +02:00
parent ead3c1696f
commit 998d6d5348
No known key found for this signature in database
GPG key ID: 14EFE510775FE39A
12 changed files with 122 additions and 176 deletions
Download patch file Download diff file Expand all files Collapse all files

26
hosts/ward/microvms/kanidm/default.nix
View file

@ -5,7 +5,10 @@
pkgs,
utils,
...
}: {
}: let
sentinelCfg = nodes.sentinel.config;
kanidmDomain = "auth.${sentinelCfg.repo.secrets.local.personalDomain}";
in {
imports = [
../../../../modules/proxy-via-sentinel.nix
];
@ -26,12 +29,29 @@
group = "kanidm";
};
nodes.sentinel = {
proxiedDomains.kanidm = kanidmDomain;
services.caddy.virtualHosts.${kanidmDomain} = {
useACMEHost = sentinelCfg.lib.extra.matchingWildcardCert kanidmDomain;
extraConfig = ''
encode zstd gzip
reverse_proxy {
to https://${config.services.kanidm.serverSettings.bindaddress}
transport http {
tls_insecure_skip_verify
}
}
'';
};
};
services.kanidm = {
enableServer = true;
# enablePAM = true;
serverSettings = {
domain = nodes.sentinel.config.proxiedDomains.kanidm;
origin = "https://${nodes.sentinel.config.proxiedDomains.kanidm}";
domain = kanidmDomain;
origin = "https://${kanidmDomain}";
tls_chain = config.age.secrets."kanidm-self-signed.crt".path;
tls_key = config.age.secrets."kanidm-self-signed.key".path;
bindaddress = "${config.extra.wireguard.proxy-sentinel.ipv4}:8300";