1 files changed, 55 insertions, 0 deletions
diff --git a/os/srv/authelia.nix b/os/srv/authelia.nix
new file mode 100644
index 0000000..a7a8c19
--- /dev/null
+++ b/os/srv/authelia.nix
@@ -0,0 +1,55 @@
+{
+  config,
+  lib,
+  masterDomain,
+  ...
+}:
+let
+  cfg = config.os.srv.authelia;
+in
+{
+  options.os.srv.authelia.enable = lib.mkEnableOption "enables authelia scanning";
+  options.os.services.authelia.extraRules = lib.mkOption {
+    type = lib.types.listOf lib.types.attrs;
+    default = [ ];
+    description = "Additional access control rules to be appended to Authelia.";
+  };
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = config.os.srv.sops.enable;
+        message = "Required for password secure password storing";
+      }
+    ];
+    services.authelia.instances.main = {
+      enable = true;
+      secrets = {
+        jwtSecretFile = config.sops.secrets."authelia/jwt_secret".path;
+        storageEncryptionKeyFile = config.sops.secrets."authelia/encryptionKey".path;
+      };
+      settings = {
+        theme = "dark";
+        authentication_backend = {
+          ldap = {
+            address = "ldap://127.0.0.1:3890";
+            implementation = "lldap";
+            base_dn = "dc=example,dc=com";
+            user = "uid=authelia,ou=people,dc=example,dc=com";
+            password_file = config.sops.secrets."lldap/bind_password".path;
+          };
+        };
+        access_control = {
+          default_policy = "deny";
+          rules = [
+            {
+              domain = "auth.${masterDomain}";
+              policy = "bypass";
+            }
+          ]
+          ++ config.os.services.authelia.extraRules;
+        };
+        session.domain = masterDomain;
+      };
+    };
+  };
+}