nix-dotfiles/hosts/tsuki/services/kanidm.nix

45 lines
1.2 KiB
Nix
Raw Normal View History

2023-03-06 21:12:14 +01:00
{ pkgs, config, ... }: let
cfg = config.services.kanidm;
in {
systemd.services.kanidm = let
certName = config.services.nginx.virtualHosts.${cfg.serverSettings.domain}.useACMEHost;
in {
requires = [ "acme-finished-${certName}.target" ];
2023-03-06 21:12:14 +01:00
serviceConfig.LoadCredential = let
certDir = config.security.acme.certs.${certName}.directory;
2023-03-06 21:12:14 +01:00
in [
"fullchain.pem:${certDir}/fullchain.pem"
"key.pem:${certDir}/key.pem"
];
2024-01-23 05:27:43 +01:00
serviceConfig.BindPaths = [
cfg.serverSettings.online_backup.path
];
2023-03-06 21:12:14 +01:00
};
services.kanidm = {
enableServer = true;
# enablePAM = true;
serverSettings = let
credsDir = "/run/credentials/kanidm.service";
in {
origin = "https://${cfg.serverSettings.domain}";
domain = "auth.nani.wtf";
tls_chain = "${credsDir}/fullchain.pem";
tls_key = "${credsDir}/key.pem";
2024-01-23 05:32:34 +01:00
bindaddress = "127.0.0.1:8300";
2024-01-23 05:27:43 +01:00
online_backup = {
path = "/data/backup/kanidm";
schedule = "00 22 * * *";
versions = 10;
};
2023-03-06 21:12:14 +01:00
};
};
environment = {
systemPackages = [ pkgs.kanidm ];
etc."kanidm/config".text = ''
uri="https://auth.nani.wtf"
'';
};
}