blob: 52b7114956df62c4a77117e6c1e115f6254e73ca (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
|
{
config,
lib,
masterDomain,
...
}:
let
cfg = config.os.srv.authelia;
in
{
options.os.srv.authelia = {
enable = lib.mkEnableOption "enables authelia scanning";
extraRules = lib.mkOption {
type = lib.types.listOf lib.types.attrs;
default = [ ];
description = "Additional access control rules to be appended to Authelia.";
};
};
config = lib.mkIf cfg.enable {
assertions = [
{
assertion = config.os.srv.sops.enable;
message = "Required for password secure password storing";
}
{
assertion = config.os.srv.lldap.enable;
message = "required for user accounts";
}
];
services.authelia.instances.main = {
enable = true;
secrets = {
jwtSecretFile = config.sops.secrets."authelia/jwt_secret".path;
storageEncryptionKeyFile = config.sops.secrets."authelia/encryptionKey".path;
};
settings = {
theme = "dark";
authentication_backend = {
ldap = {
address = "ldap://127.0.0.1:3890";
implementation = "lldap";
base_dn = "dc=example,dc=com";
user = "uid=authelia,ou=people,dc=example,dc=com";
password_file = config.sops.secrets."lldap/bind_password".path;
};
};
access_control = {
default_policy = "deny";
rules = [
{
domain = "auth.${masterDomain}";
policy = "bypass";
}
]
++ cfg.extraRules;
};
session.domain = masterDomain;
};
};
};
}
|
