From df3aa7c10e1f42c8f23ff51ae0269c4732badef7 Mon Sep 17 00:00:00 2001 From: h7x4 Date: Fri, 17 Mar 2023 00:54:36 +0100 Subject: [PATCH] tsuki: setup oauth2 for pgadmin This commit also changes the pgadmin package from `22.11` to `unstable` --- flake.nix | 7 +++-- hosts/tsuki/services/postgres.nix | 45 ++++++++++++++++++++++++++++--- secrets/default.yaml | 9 ++++--- 3 files changed, 53 insertions(+), 8 deletions(-) diff --git a/flake.nix b/flake.nix index 2d1b389..d13108f 100644 --- a/flake.nix +++ b/flake.nix @@ -99,8 +99,11 @@ android_sdk.accept_license = true; }; - overlays = [ - (self: super: { kanidm = unstable-pkgs.callPackage ./package-overrides/kanidm.nix {}; }) + overlays = let + nonrecursive-unstable-pkgs = nixpkgs-unstable.legacyPackages.${system}; + in [ + (self: super: { kanidm = super.callPackage ./package-overrides/kanidm.nix {}; }) + (self: super: { pgadmin4 = nonrecursive-unstable-pkgs.pgadmin4; }) osuchan.overlays.default ]; }; diff --git a/hosts/tsuki/services/postgres.nix b/hosts/tsuki/services/postgres.nix index 2cd151f..3ea7fe1 100644 --- a/hosts/tsuki/services/postgres.nix +++ b/hosts/tsuki/services/postgres.nix @@ -14,17 +14,56 @@ # settings = {}; }; + sops.secrets = { + "pgadmin/oauth2_secret" = rec { + restartUnits = [ "pgadmin.service" ]; + owner = config.systemd.services.pgadmin.serviceConfig.User; + group = config.users.users.${owner}.group; + }; + "pgadmin/initialPassword" = rec { + restartUnits = [ "pgadmin.service" ]; + owner = config.systemd.services.pgadmin.serviceConfig.User; + group = config.users.users.${owner}.group; + }; + }; + services.pgadmin = { enable = true; openFirewall = true; initialEmail = "h7x4@nani.wtf"; - initialPasswordFile = "${config.machineVars.dataDrives.default}/keys/pgadmin_pass"; + initialPasswordFile = config.sops.secrets."pgadmin/initialPassword".path; port = secrets.ports.pgadmin; - settings = { - DATA_DIR = "${config.machineVars.dataDrives.default}/var/pgadmin"; + settings = let + authServerUrl = config.services.kanidm.serverSettings.origin; + in { + # FIXME: pgadmin does not work with NFS by default, because it uses + # some kind of metafiles in its data directory. + # DATA_DIR = "${config.machineVars.dataDrives.default}/var/pgadmin"; + DATA_DIR = "/var/lib/pgadmin"; + AUTHENTICATION_SOURCES = [ "oauth2" ]; + OAUTH2_AUTO_CREATE_USER = true; + OAUTH2_CONFIG = [ rec { + OAUTH2_NAME = "KaniDM"; + OAUTH2_DISPLAY_NAME = "KaniDM"; + OAUTH2_CLIENT_ID = "pgadmin"; + OAUTH2_API_BASE_URL = "${authServerUrl}/oauth2"; + OAUTH2_TOKEN_URL = "${authServerUrl}/oauth2/token"; + OAUTH2_AUTHORIZATION_URL = "${authServerUrl}/ui/oauth2"; + OAUTH2_USERINFO_ENDPOINT = "${authServerUrl}/oauth2/openid/${OAUTH2_CLIENT_ID}/userinfo"; + OAUTH2_SERVER_METADATA_URL = "${authServerUrl}/oauth2/openid/${OAUTH2_CLIENT_ID}/.well-known/openid-configuration"; + OAUTH2_SCOPE = "openid email profile"; + OAUTH2_ICON = "fa-lock"; + OAUTH2_BUTTON_COLOR = "#ff6600"; + }]; }; }; + environment.etc."pgadmin/config_system.py".text = let + in '' + with open("${config.sops.secrets."pgadmin/oauth2_secret".path}") as f: + OAUTH2_CONFIG[0]['OAUTH2_CLIENT_SECRET'] = f.read() + ''; + services.postgresqlBackup = { enable = true; location = "${config.machineVars.dataDrives.drives.backup}/postgres"; diff --git a/secrets/default.yaml b/secrets/default.yaml index 49922db..aa01243 100644 --- a/secrets/default.yaml +++ b/secrets/default.yaml @@ -1,5 +1,5 @@ headscale: - oauth_secret: "" + oauth2_secret: ENC[AES256_GCM,data:Ois+s0O9wgL3zWpgk6E35o5HczIW/4wnSq2KU+F59u4FBFPAtbl/WD0N4AKgWMrm,iv:UX8vhNvHvA5BmNmx5eW8ugce+yZCE1lt2ux8sJajZ8Q=,tag:xOpdLLryt8MptiVsKibNew==,type:str] hedgedoc: env: ENC[AES256_GCM,data:4i2I7S5hKp3mjROMwa3WQinbgmxXhKzSaWspzF12TIDm9g3Bgie0jfSxbDuPjJYq1mZ8oQ2Jzdi2N+Q4blOk9fZO3VREoU0qFrfqm8RqBw3a7hpisXzu9okYnzrW2JiVxNGWwZbuiCG1SzdMOMHq/ZqLEJdu7Pxm9cY9xBSZthap1DCFyr7dmjHt3AnEQemsDpxSaWKD2Dfs1gyA23rLAFBd,iv:lfB6uaXULUNme7cGyN+bKuXPsbgpjMrxrRy2L96HltY=,tag:uu37bZ4g/PA2mgzs3ioLCQ==,type:str] cloudflare: @@ -9,6 +9,9 @@ drives: credentials: ENC[AES256_GCM,data:ypMZhs7dQw/IlcLwHwFcIZw0N+kCzvFGLe3gEqZVe1hj0lzK8MCfxAR8GpA=,iv:by5ljMzOuuY4b6BDUQNLhp8/gcXDNe+rHkqhFzjNA6c=,tag:3C5iYsxEWwAKs9Blgr5o6g==,type:str] postgres: gitea: ENC[AES256_GCM,data:HyYgEgOzeOnaEvPDEXoL+fRhrnqCeGbb/wOYf2kHulxrU9PKIAcRzmNljsc=,iv:1N/N2RUQ++rAWw4VNQzhee2aV9LzOJym6cyM6CAnZUU=,tag:o7dblJrIAPd4/S8X2LKdcQ==,type:str] +pgadmin: + oauth2_secret: ENC[AES256_GCM,data:A1Upe1Ja76++ZdOx5YhuKjpaont4m5ChRzn/YVpJbnFzWy1tFlBkOr6UgBj7Wopg,iv:hY+b7AVSrSgHu/10reIjUjJ8+yR4FrZe2JgGiAowfGs=,tag:thy6O1Y3FGTWaQXqlU9aYg==,type:str] + initialPassword: ENC[AES256_GCM,data:674lqcGTDCOYBNocf0LQuQB1cbMus0iZOcvwbadpAXrF4DPQSetqrg==,iv:y8hfzLh6i7LxR11fmM9T0z2t7202JMAiZzi/1iCWPvM=,tag:lHwCBWaWsArrAJ0rZ8Xk/w==,type:str] sops: kms: [] gcp_kms: [] @@ -24,8 +27,8 @@ sops: UE1YWkplaFBhV01CU0FDYTQ3NlkwVkUKMJyCfyh/vcj/VU7shtFF4YRRVaWdcMNh rp9lZmRZpc9mARXYAj9RlkI/uuSzxshtqb5AGXKmSV0hncazxu75kg== -----END AGE ENCRYPTED FILE----- - lastmodified: "2023-03-08T14:35:20Z" - mac: ENC[AES256_GCM,data:V3LhoWRReZkj16s7/90zvS4GaAXDf7gY3qKGAoYRKPKrbBVDHS3Z6Vd+HZVTNcGZ0gfsJUeI8PXP2CnevN06/NKSIgyGP/8fDYSXCr2Qs3ccOnsWArAT6v83+xFxESIhlC9ww5plbAqCXPfUEHTg3SX7wa3vOQagOBjphKtPYD8=,iv:fYbmMGwbaMpyV7i8/rSTyOdK2TS0u4/0MUAPFZBV4E8=,tag:OIimZjzn6rvuweZVEmsnvw==,type:str] + lastmodified: "2023-03-16T22:23:30Z" + mac: ENC[AES256_GCM,data:WhmY8htyrpTsAHuA8Q6RquBSafTZR/ocyB/OvLRhIV4gksSbzCWeMR+5Jwvvr8XYkwzD3rpCgCiqpA6R8ibxfdhHYZwHKMJNrAlpBdXSom67q9RUvDJjiCEQyJpcsvjJmT1mM9J3E6iVymoI0h2WW+rGzN3vgONBIr86p0nknKI=,iv:JdHn/qSzPCwkaBL81Wax0ThXFtSGrb26shA1tfXy/aI=,tag:dZLtLJM5mNCO6OOWLtQwXg==,type:str] pgp: - created_at: "2023-03-07T12:32:53Z" enc: |