1 files changed, 0 insertions, 179 deletions
diff --git a/os/srv/authelia.nix b/os/srv/authelia.nix
deleted file mode 100644
index 2c42b0a..0000000
--- a/os/srv/authelia.nix
+++ /dev/null
@@ -1,179 +0,0 @@
-{
-  config,
-  lib,
-  masterDomain,
-  securityTemplates,
-  ...
-}:
-let
-  cfg = config.os.srv.authelia;
-  computedBaseDN = lib.concatStringsSep "," (
-    map (domainPart: "dc=${domainPart}") (lib.splitString "." masterDomain)
-  );
-in
-{
-  options.os.srv.authelia.enable =
-    lib.mkEnableOption "enables authelia authentication gateway instance";
-
-  config = lib.mkIf cfg.enable {
-    assertions = [
-      {
-        assertion = config.os.srv.sops.enable;
-        message = "sops must be enabled for secure cryptographic token storage";
-      }
-      {
-        assertion = config.os.core.network.enableFirewall;
-        message = "Requires firewall";
-      }
-    ];
-
-    sops.secrets = {
-      "authelia/jwt_secret" = {
-        owner = "authelia-main";
-        group = "authelia-main";
-        restartUnits = [ "authelia-main.service" ];
-      };
-      "authelia/session_secret" = {
-        owner = "authelia-main";
-        group = "authelia-main";
-        restartUnits = [ "authelia-main.service" ];
-      };
-      "authelia/encryption_key" = {
-        owner = "authelia-main";
-        group = "authelia-main";
-        restartUnits = [ "authelia-main.service" ];
-      };
-
-      "authelia/oidc_hmac" = {
-        owner = "authelia-main";
-        group = "authelia-main";
-        restartUnits = [ "authelia-main.service" ];
-      };
-      "authelia/oidc_private_key" = {
-        owner = "authelia-main";
-        group = "authelia-main";
-        restartUnits = [ "authelia-main.service" ];
-      };
-
-      "postgres/authelia_password" = {
-        owner = "authelia-main";
-        group = "authelia-main";
-        restartUnits = [ "authelia-main.service" ];
-      };
-      "redis/password" = {
-        owner = "authelia-main";
-        group = "authelia-main";
-        restartUnits = [ "authelia-main.service" ];
-      };
-    };
-
-    services.authelia.instances.main = {
-      enable = true;
-
-      secrets = {
-        jwtSecretFile = config.sops.secrets."authelia/jwt_secret".path;
-        sessionSecretFile = config.sops.secrets."authelia/session_secret".path;
-        storageEncryptionKeyFile = config.sops.secrets."authelia/encryption_key".path;
-
-        oidcHmacSecretFile = config.sops.secrets."authelia/oidc_hmac".path;
-        oidcIssuerPrivateKeyFile = config.sops.secrets."authelia/oidc_private_key".path;
-      };
-
-      settings = {
-        theme = "dark";
-        default_2fa_method = "totp";
-
-        log = {
-          level = "info";
-          format = "json";
-          path = "/var/log/authelia/authelia.log";
-          keep_stdout = true;
-        };
-
-        server.address = "tcp://127.0.0.1:9091";
-
-        telemetry.metrics = {
-          enabled = true;
-          address = "tcp://127.0.0.1:9959";
-        };
-
-        storage = {
-          postgres = {
-            host = config.os.core.network.ips.database-vm;
-            port = 5432;
-            database = "authelia";
-            username = "authelia";
-            timeout = "5s";
-            schema = "public";
-          };
-        };
-
-        session = {
-          name = "authelia_session";
-          expiration = "1h";
-          inactivity = "15m";
-          remember_me = "1M";
-          provider = {
-            redis = {
-              host = config.os.core.network.ips.database-vm;
-              port = 6379;
-              database = 0;
-              timeout = "5s";
-            };
-          };
-        };
-
-        authentication_backend = {
-          ldap = {
-            address = "ldap://${config.os.core.network.ips.gateway-vm}:3890";
-            implementation = "lldap";
-            base_dn = computedBaseDN;
-            user = "uid=authelia,ou=people,${computedBaseDN}";
-          };
-        };
-
-        identity_providers = {
-          oidc = {
-            cors.allowed_origins = map (domain: "https://${domain}") (
-              builtins.attrNames config.os.cluster.nginxProxies
-            );
-
-            clients = config.os.cluster.oidcClients;
-          };
-        };
-
-        access_control = {
-          default_policy = "deny";
-          rules = [
-            {
-              domain = "auth.${masterDomain}";
-              policy = "bypass";
-            }
-          ]
-          ++ config.os.cluster.autheliaRules;
-        };
-
-        session.domain = masterDomain;
-      };
-
-      environmentVariables = {
-        AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PASSWORD_FILE = config.sops.secrets."lldap/password".path;
-        AUTHELIA_SESSION_REDIS_PASSWORD_FILE = config.sops.secrets."redis/password".path;
-        AUTHELIA_STORAGE_POSTGRES_PASSWORD_FILE = config.sops.secrets."postreg/authelia_password".path;
-      };
-    };
-
-    os.cluster.nginxProxies."auth.${masterDomain}" = {
-      enableACME = true;
-      forceSSL = true;
-      locations."/" = {
-        proxyPass = "http://${config.os.core.network.ips.gateway-vm}:9091";
-        extraConfig = securityTemplates.restrictToInternal;
-      };
-    };
-
-    networking.firewall.extraInputRules = ''
-      ip saddr ${config.os.core.network.ips.monitor-vm} tcp dport 9959 accept
-    '';
-  };
-}