felixalb/nixos-config
felixalb
/
nixos-config
mirror of https://git.feal.no/felixalb/nixos-config.git
2
2
Fork 0
Code Issues Activity

voyager/nexctcloud: authenticate with keycloak

This commit is contained in:
Felix Albrigtsen 2024-06-13 08:34:13 +02:00
parent 6653de02e5
commit 70959b5092
2 changed files with 34 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
hosts/voyager/services/nextcloud.nix
View File

@ -21,11 +21,34 @@ in {
};
settings = {
trusted_proxies = [ "192.168.10.175" ]; # defiant
default_phone_region = "NO";
log_type = "file";
overwriteprotocol = "https";
trusted_proxies = [ "192.168.10.175" ]; # defiant
# Docs: https://github.com/pulsejet/nextcloud-oidc-login
oidc_login_auto_redirect = true;
oidc_login_button_text = "Log in with KeyCloak";
oidc_login_client_id = "nextcloud";
oidc_login_client_secret = "dont_put_secrets_here_use_secretFile";
oidc_login_code_challenge_method = "S256";
oidc_login_end_session_redirect' = true;
oidc_login_logout_url = "https://cloud.feal.no/apps/oidc_login/oidc";
oidc_login_provider_url = "https://iam.feal.no/realms/feal.no";
oidc_login_redir_fallback = true;
oidc_login_attributes = {
id = "preferred_username";
mail = "email";
name = "name";
login_filter = "nextcloud-roles";
};
oidc_login_filter_allowed_values = [ "nextcloud-user" ];
oidc_login_disable_registration = false;
};
secretFile = config.sops.secrets."nextcloud/secretsjson".path;
phpOptions = {
"opcache.interned_strings_buffer" = "16";
"upload_max_filesize" = lib.mkForce "8G";
@ -49,6 +72,12 @@ in {
group = "nextcloud";
restartUnits = [ "phpfpm-nextcloud.service" ];
};
sops.secrets."nextcloud/secretsjson" = {
mode = "0440";
owner = "nextcloud";
group = "nextcloud";
restartUnits = [ "phpfpm-nextcloud.service" ];
};
services.postgresql = {
ensureDatabases = [ "nextcloud" ];
@ -79,7 +108,7 @@ in {
ProtectKernelTunables = true;
ProtectProc = "invisible";
ReadWritePaths = [ "/tank/nextcloud" "/run/phpfpm" "/run/systemd" ];
ReadPaths = [ "/run/secrets" "/nix/store" ];
ReadOnlyPaths = [ "/run/secrets" "/nix/store" ];
RemoveIPC = true;
RestrictSUIDSGID = true;
UMask = "0007";

5
secrets/voyager/voyager.yaml
View File

@ -12,6 +12,7 @@ transmission:
vpncreds: ENC[AES256_GCM,data:KWm6AGlJze0Of9Nkz0moaQCAXMwylsZ+BIZR4BnbuDRbjKRMJSWCOFBSbG3esGprLhoCnYwc9mghSeoP2AQRAT++sERpxX3JTHF9QuauNmhRWb1xLsOfQAu6vsA/0dTshQr8ivhJSnEz57rasdOraovYjVsRXd7cuclajPoS4nl3+1/IrSkAlxNzx8F0PMmyOrvoPVMmqQ4PcKFfkXc1f59O2iJ19Bmt/x5yIxU=,iv:VAYlqL8Pb5J4g+W3QClrgRftYw5UofXmG9cfEsZdLr4=,tag:zJIxYaGEedFjM8IsBfnQog==,type:str]
nextcloud:
adminpass: ENC[AES256_GCM,data:r2Z6KsQ1hP90/Bf8J804a5D7BTS7,iv:f3TkiPVxw8lAPcyStWqOZuhF4p/5nUPkzL2j/yjsnyg=,tag:c2JWdxZUjkHQWNWDILBrRQ==,type:str]
secretsjson: ENC[AES256_GCM,data:xvUdDoTaTum/gkDBujSfHeunAmwmYhZMY7zY72Ct9wly9gpcbNrJNiwuWSgBP3uYtwArce+n6co33OYZvV8rs/Q=,iv:6nLq9ZxgBHKbjD8I1PbjWf/9XthTSrm3lOwx/YX+Tc4=,tag:UN+c2fjUHK1lpyRsTBpOUw==,type:str]
borg:
transmission: ENC[AES256_GCM,data:VGP23BjX6rjMbcEMA6O7UEX6,iv:C0ehtDSO0eMkIYbwi9wYAKncOBrNCiJB4S5tJ1rxctI=,tag:RNcGwihAxOwCt3XOSoCvfw==,type:str]
postgres: ENC[AES256_GCM,data:nA+Ga56rG8XippMmHsOLEik=,iv:41llHBWEU7ESiUetJC/SkcjHG+beXs/ur8QTmxDGFE8=,tag:92n88ZtrDQWz0gYZmuWD8g==,type:str]
@ -50,8 +51,8 @@ sops:
NENEM2VLRDBzTWM0ckdPVThaeE0xL2MKTAvsDKgaoj0Fz9CoNbP6s1kROlDbbXtB
4rFRGN+WZJrBioz5nN4kR7mVFKa4w6z6Pu3D5WLyK7UQQkZJ64avdw==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2024-04-29T10:10:29Z"
mac: ENC[AES256_GCM,data:hfiomMGmIvm2HFxrvRXB4lIjOpaMlP//35PT2AG9PKqR4MIuBR9jZDHoGUnddjfESNH7++YUvND7Qafxax8AMiCYEhUUfgn2rkO/ycVvI8y9cIQQv8OMzmPZF82Uu9loWoq4dnR/kHkQKWv7XhoGzqI4Z/ObfxESwPqSr6mAlsI=,iv:VnY/WLmVwrSt0jHs0uDzr8iP4BYOSlwLGn0g4QYnxIo=,tag:r+8hvmFS7aIdEvepKQV33Q==,type:str]
lastmodified: "2024-06-12T18:57:43Z"
mac: ENC[AES256_GCM,data:46xA8exSUbaEJBufvzt5TbUXQa4956sGQUh9hS8a1nhXasDkdwTtGgSfZq/ENcL/VoEz0ORVJ43OwVE+TV1j9aOzwck96c/KDKTp4iEVbRfcsK/PMccf2FJke3TUmSV6f1hFBpGHpdujghHQTiGct+XQNuuI3RPXYLEYPJrqyeY=,iv:fzQL+ymHTP6XET9YlaCaW1ZGUJaZzCM0neGzMveoSt4=,tag:rsDV5tkU5pTlq4YTel6V1g==,type:str]
pgp: []
unencrypted_suffix: _unencrypted
version: 3.8.1