sokai/mynixos-config
1
1
Fork 0
forked from mirrors_public/oddlama_nix-config
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: add client secret to mealie

Browse source
This commit is contained in:
oddlama 2025-05-18 21:36:14 +02:00
parent c983b43fda
commit 6ed22d37af
No known key found for this signature in database
GPG key ID: 14EFE510775FE39A
5 changed files with 47 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

34
hosts/ward/guests/mealie.nix
View file

@ -13,9 +13,23 @@ in
firewallRuleForNode.ward-web-proxy.allowedTCPPorts = [ config.services.mealie.port ];
};
# Mirror the original oauth2 secret
age.secrets.mealie-oauth2-client-secret = {
inherit (nodes.ward-kanidm.config.age.secrets.kanidm-oauth2-mealie) rekeyFile;
# Mirror the original oauth2 secret, but prepend OIDC_CLIENT_SECRET=
# so it can be used as an EnvironmentFile
age.secrets.oauth2-client-secret = {
generator.dependencies = [
nodes.ward-kanidm.config.age.secrets.kanidm-oauth2-mealie
];
generator.script =
{
lib,
decrypt,
deps,
...
}:
''
echo -n "OIDC_CLIENT_SECRET="
${decrypt} ${lib.escapeShellArg (lib.head deps).file}
'';
mode = "440";
};
@ -41,16 +55,22 @@ in
ALLOW_SIGNUP = "false";
BASE_URL = "https://${mealieDomain}";
TZ = config.time.timeZone;
TOKEN_TIME = 87600; # 10 years session time - this is only internal so who cares
OIDC_AUTH_ENABLED = "true";
OIDC_AUTO_REDIRECT = "true";
OIDC_CLIENT_ID = "mealie";
OIDC_CONFIGURATION_URL = "https://${globals.services.kanidm.domain}/oauth2/openid/${OIDC_CLIENT_ID}/.well-known/openid-configuration";
OIDC_SIGNUP_ENABLED = "true";
OIDC_AUTO_REDIRECT = "true";
OIDC_REMEMBER_ME = "true";
OIDC_CLIENT_ID = "mealie";
OIDC_SIGNING_ALGORITHM = "ES256";
OIDC_USER_CLAIM = "preferred_username";
OIDC_PROVIDER_NAME = "Kanidm";
OIDC_CONFIGURATION_URL = "https://${globals.services.kanidm.domain}/oauth2/openid/${OIDC_CLIENT_ID}/.well-known/openid-configuration";
OIDC_USER_GROUP = "user";
OIDC_ADMIN_GROUP = "admin";
};
credentialsFile = config.age.secrets.oauth2-client-secret.path;
};
nodes.ward-web-proxy = {