felixalb/nixos-config
felixalb
/
nixos-config
mirror of https://git.feal.no/felixalb/nixos-config.git
2
2
Fork 0
Code Issues Activity

voyager/kanidm: remove second nginx

This commit is contained in:
Felix Albrigtsen 2024-06-06 20:47:15 +02:00 committed by Felix Albrigtsen
parent 541602b594
commit ef23fded85
2 changed files with 16 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
hosts/defiant/services/nginx.nix
View File

@ -31,7 +31,7 @@
# Publicly exposed services: # Publicly exposed services:
services.nginx.virtualHosts = let services.nginx.virtualHosts = let
publicProxy = upstream: { publicProxy = upstream: overrides: {
listen = [ listen = [
{ addr = "192.168.10.175"; port = 43443; ssl = true; } { addr = "192.168.10.175"; port = 43443; ssl = true; }
{ addr = "192.168.10.175"; port = 43080; ssl = false; } { addr = "192.168.10.175"; port = 43080; ssl = false; }
@ -49,11 +49,18 @@
server_tokens off; server_tokens off;
''; '';
}; } // overrides;
in { in {
"auth.feal.no" = publicProxy "https://voyager.home.feal.no"; "auth.feal.no" = publicProxy "" {
"cloud.feal.no" = publicProxy "http://voyager.home.feal.no"; locations."/" = {
"git.feal.no" = publicProxy "http://unix:${config.services.gitea.settings.server.HTTP_ADDR}"; proxyPass = "https://voyager.home.feal.no:8300";
"jf.feal.no" = publicProxy "http://jellyfin.home.feal.no/"; extraConfig = ''
proxy_ssl_verify off;
'';
};
};
"cloud.feal.no" = publicProxy "http://voyager.home.feal.no" {};
"git.feal.no" = publicProxy "http://unix:${config.services.gitea.settings.server.HTTP_ADDR}" {};
"jf.feal.no" = publicProxy "http://jellyfin.home.feal.no/" {};
}; };
} }

17
hosts/voyager/services/kanidm.nix
View File

@ -10,7 +10,7 @@ in {
serverSettings = { serverSettings = {
origin = "https://${cfg.serverSettings.domain}"; origin = "https://${cfg.serverSettings.domain}";
domain = "auth.feal.no"; domain = "auth.feal.no";
bindaddress = "127.0.1.2:8300"; bindaddress = "0.0.0.0:8300";
inherit ldapbindaddress; inherit ldapbindaddress;
tls_chain = "/run/credentials/kanidm.service/cert.crt"; tls_chain = "/run/credentials/kanidm.service/cert.crt";
@ -25,23 +25,12 @@ in {
]; ];
}; };
services.nginx.virtualHosts."${cfg.serverSettings.domain}" = {
forceSSL = true;
sslCertificate = "${certPath}.crt";
sslCertificateKey = "${certPath}.key";
locations."/" = {
proxyPass = "https://${cfg.serverSettings.bindaddress}";
extraConfig = ''
proxy_ssl_verify off;
'';
};
};
environment = { environment = {
systemPackages = [ pkgs.kanidm ]; systemPackages = [ pkgs.kanidm ];
etc."kanidm/config".text = '' etc."kanidm/config".text = ''
uri="${cfg.serverSettings.origin}" uri="${cfg.serverSettings.origin}"
''; '';
}; };
networking.firewall.allowedTCPPorts = [ 8300 ];
} }