archive/server_config
Archived
1
0
Fork 0
Code Issues 1 Pull requests Packages Projects Releases Wiki Activity

add secrets generation

Browse source
This commit is contained in:
Fabian Montero 2024-08-24 03:51:56 -06:00
parent 495d54def8
commit 12cb13952a
Signed by untrusted user: fabian
GPG key ID: 1FFAC35E1798174F
1 changed files with 36 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

42
sys/srv/authelia.nix
View file

@ -4,7 +4,36 @@
...
}:
with lib; {
systemd.services.authelia.serviceConfig.LoadCredential = ["storageEncryptionKeyFile.txt:/var/trust/authelia/storageEncryptionKeyFile.csv" "jwtSecretFile.txt:/var/trust/authelia/jwtSecretFile.csv"];
#TODO: no poner authelia-main en todo lado, usar config (o let o no sé)
systemd.services.authelia-main = {
preStart = ''
mkdir -p /var/trust/authelia-main/
chown authelia-main:authelia-main /var/trust/authelia-main/
chmod 700 /var/trust/authelia-main/
[ -f /var/trust/authelia-main/jwt-secret ] || {
"${pkgs.openssl}/bin/openssl" rand -base64 32 > /var/trust/authelia-main/jwt-secret
chown authelia-main:authelia-main /var/trust/authelia-main/jwt-secret
chmod 600 /var/trust/authelia-main/jwt-secret
}
[ -f /var/trust/authelia-main/storage-encryption-file ] || {
"${pkgs.openssl}/bin/openssl" rand -base64 32 > /var/trust/authelia-main/storage-encryption-file
chown authelia-main:authelia-main /var/trust/authelia-main/storage-encryption-file
chmod 600 /var/trust/authelia-main/storage-encryption-file
}
[ -f /var/trust/authelia-main/session-secret-file ] || {
"${pkgs.openssl}/bin/openssl" rand -base64 32 > /var/trust/authelia-main/session-secret-file
chown authelia-main:authelia-main /var/trust/authelia-main/session-secret-file
chmod 600 /var/trust/authelia-main/session-secret-file
}
'';
serviceConfig.LoadCredential = [
"jwt-secret:/var/trust/authelia-main/jwt-secret"
"storage-encryption-file:/var/trust/authelia-main/storage-encryption-file"
"session-secret-file:/var/trust/authelia-main/session-secret-file"
];
};
services = {
nginx = {
@ -19,8 +48,9 @@ with lib; {
# config based on https://github.com/authelia/authelia/blob/master/config.template.yml
settings = {
secrets = {
jwtSecretFile = "TODO:";
storageEncryptionKeyFile = "TODO:";
jwtSecretFile = "/var/trust/authelia-main/jwt-secret";
storageEncryptionKeyFile = "/var/trust/authelia-main/storage-encryption-file";
sessionSecretFile = "/var/trust/authelia-main/session-secret-file";
};
theme = "dark";
@ -49,7 +79,7 @@ with lib; {
duo_api.disable = true;
# identity_validation default values assumed: https://github.com/authelia/authelia/blob/master/config.template.yml#L266
authentication_backend.file = {
path = "/var/trust/authelia/users_database.yml"; #TODO:
path = "/var/trust/authelia-main/users_database.yml"; #TODO:
password.algorithm = "argon2";
password_policy.zxcvbn = {
enable = true;
@ -92,11 +122,11 @@ with lib; {
ban_time = "5 minutes";
};
storage.local.path = "/var/trust/authelia/db.sqlite3"; #TODO:
storage.local.path = "/var/trust/authelia-main/db.sqlite3"; #TODO:
# TODO:
#notifier.smtp = {
#
#
#};
# TODO: voy por acá: https://github.com/authelia/authelia/blob/master/config.template.yml#L714