Merge branch 'authelia'
This commit is contained in:
commit
3c858c8229
GPG Key ID:
6C4D545385D4925A
339
hosts/rpi4/authelia.nix
Normal file
339
hosts/rpi4/authelia.nix
Normal file
@ -0,0 +1,339 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (lib) types mkIf optionalString;
|
||||
inherit (builtins)
|
||||
isNull
|
||||
any
|
||||
all
|
||||
attrValues
|
||||
toString
|
||||
;
|
||||
|
||||
inherit (config.services) nginx;
|
||||
|
||||
validAuthMethods = [
|
||||
"regular"
|
||||
"basic"
|
||||
];
|
||||
getUpstreamFromInstance =
|
||||
instance:
|
||||
let
|
||||
inherit (config.services.authelia.instances.${instance}.settings) server;
|
||||
inherit (server) port;
|
||||
host =
|
||||
if server.host == "0.0.0.0" then
|
||||
"127.0.0.1"
|
||||
else if lib.hasInfix ":" server.host then
|
||||
throw "TODO IPv6 not supported in Authelia server address (hard to parse, can't tell if it is [::])."
|
||||
else
|
||||
server.host;
|
||||
in
|
||||
"http://${host}:${toString port}";
|
||||
|
||||
# use this when reverse proxying to authelia (and only authelia because i
|
||||
# like the nixos recommended proxy settings better)
|
||||
autheliaProxyConfig = pkgs.writeText "authelia-proxy-config.conf" ''
|
||||
## Headers
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header X-Forwarded-Host $http_host;
|
||||
proxy_set_header X-Forwarded-URI $request_uri;
|
||||
proxy_set_header X-Forwarded-Ssl on;
|
||||
proxy_set_header X-Forwarded-For $remote_addr;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
|
||||
## Basic Proxy Configuration
|
||||
client_body_buffer_size 128k;
|
||||
# Timeout if the real server is dead.
|
||||
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
|
||||
proxy_redirect http:// $scheme://;
|
||||
proxy_http_version 1.1;
|
||||
proxy_cache_bypass $cookie_session;
|
||||
proxy_no_cache $cookie_session;
|
||||
proxy_buffers 64 256k;
|
||||
|
||||
## Trusted Proxies Configuration
|
||||
## Please read the following documentation before configuring this:
|
||||
## https://www.authelia.com/integration/proxies/nginx/#trusted-proxies
|
||||
# set_real_ip_from 10.0.0.0/8;
|
||||
# set_real_ip_from 172.16.0.0/12;
|
||||
# set_real_ip_from 192.168.0.0/16;
|
||||
# set_real_ip_from fc00::/7;
|
||||
real_ip_header X-Forwarded-For;
|
||||
real_ip_recursive on;
|
||||
|
||||
## Advanced Proxy Configuration
|
||||
send_timeout 5m;
|
||||
proxy_read_timeout 360;
|
||||
proxy_send_timeout 360;
|
||||
proxy_connect_timeout 360;
|
||||
'';
|
||||
|
||||
autheliaLocation = ''
|
||||
internal;
|
||||
|
||||
## Headers
|
||||
## The headers starting with X-* are required.
|
||||
proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
|
||||
proxy_set_header X-Original-Method $request_method;
|
||||
proxy_set_header X-Forwarded-Method $request_method;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header X-Forwarded-Host $http_host;
|
||||
proxy_set_header X-Forwarded-Uri $request_uri;
|
||||
proxy_set_header X-Forwarded-For $remote_addr;
|
||||
proxy_set_header Content-Length "";
|
||||
proxy_set_header Connection "";
|
||||
|
||||
## Basic Proxy Configuration
|
||||
proxy_pass_request_body off;
|
||||
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503; # Timeout if the real server is dead
|
||||
proxy_redirect http:// $scheme://;
|
||||
proxy_http_version 1.1;
|
||||
proxy_cache_bypass $cookie_session;
|
||||
proxy_no_cache $cookie_session;
|
||||
proxy_buffers 4 32k;
|
||||
client_body_buffer_size 128k;
|
||||
|
||||
## Advanced Proxy Configuration
|
||||
send_timeout 5m;
|
||||
proxy_read_timeout 240;
|
||||
proxy_send_timeout 240;
|
||||
proxy_connect_timeout 240;
|
||||
'';
|
||||
autheliaLocationConfig = pkgs.writeText "authelia-location.conf" autheliaLocation;
|
||||
autheliaBasicLocationConfig = autheliaLocationConfig;
|
||||
genAuthConfig = method: endpoint: let
|
||||
redirect = ''
|
||||
## If the subreqest returns 200 pass to the backend, if the subrequest returns 401 redirect to the portal.
|
||||
error_page 401 =302 ${endpoint}/?rd=$target_url;
|
||||
'';
|
||||
in ''
|
||||
auth_request /internal/authelia/authz${optionalString (method == "basic") "/basic"};
|
||||
|
||||
## Set the $target_url variable based on the original request.
|
||||
|
||||
## Comment this line if you're using nginx without the http_set_misc module.
|
||||
# set_escape_uri $target_url $scheme://$http_host$request_uri;
|
||||
|
||||
## Uncomment this line if you're using NGINX without the http_set_misc module.
|
||||
set $target_url $scheme://$http_host$request_uri;
|
||||
|
||||
## Save the upstream response headers from Authelia to variables.
|
||||
auth_request_set $user $upstream_http_remote_user;
|
||||
auth_request_set $groups $upstream_http_remote_groups;
|
||||
auth_request_set $name $upstream_http_remote_name;
|
||||
auth_request_set $email $upstream_http_remote_email;
|
||||
|
||||
## Inject the response headers from the variables into the request made to the backend.
|
||||
proxy_set_header Remote-User $user;
|
||||
proxy_set_header Remote-Groups $groups;
|
||||
proxy_set_header Remote-Name $name;
|
||||
proxy_set_header Remote-Email $email;
|
||||
|
||||
${optionalString (method == "regular") redirect}
|
||||
'';
|
||||
genAuthConfigPkg =
|
||||
method: endpoint: pkgs.writeText "authelia-authrequest-${method}.conf" (genAuthConfig method endpoint);
|
||||
in
|
||||
{
|
||||
# authelia
|
||||
options.services.nginx =
|
||||
let
|
||||
mkAttrsOfSubmoduleOpt = module: lib.mkOption { type = with types; attrsOf (submodule module); };
|
||||
|
||||
# make system config accessible from submodules
|
||||
systemConfig = config;
|
||||
|
||||
# submodule definitions
|
||||
vhostModule =
|
||||
{ name, config, ... }@attrs:
|
||||
{
|
||||
options = {
|
||||
locations = mkAttrsOfSubmoduleOpt (genLocationModule attrs);
|
||||
authelia = {
|
||||
endpoint = {
|
||||
# endpoint settings
|
||||
instance = lib.mkOption {
|
||||
description = ''
|
||||
Local Authelia instance to act as the authentication endpoint.
|
||||
This virtualHost will be configured to provide the
|
||||
public-facing authentication service.
|
||||
'';
|
||||
type = with types; nullOr str;
|
||||
default = null;
|
||||
};
|
||||
upstream = lib.mkOption {
|
||||
description = ''
|
||||
Internal URL of the Authelia endpoint to forward authentication
|
||||
requests to.
|
||||
'';
|
||||
type = with types; nullOr str;
|
||||
default = null;
|
||||
};
|
||||
};
|
||||
# client settings
|
||||
endpointURL = lib.mkOption {
|
||||
description = ''
|
||||
(temporary) authelia endpoint redirect URL.
|
||||
'';
|
||||
type = with types; str;
|
||||
};
|
||||
instance = lib.mkOption {
|
||||
description = ''
|
||||
Local Authelia instance to use. Setting this option will
|
||||
automatically configure Authelia on the specified virtualHost
|
||||
with the given instance of Authelia.
|
||||
'';
|
||||
type = with types; nullOr str;
|
||||
default = null;
|
||||
};
|
||||
upstream = lib.mkOption {
|
||||
description = ''
|
||||
Internal URL of the Authelia endpoint to forward authorization
|
||||
requests to. This should not be the public-facing authentication
|
||||
endpoint URL.
|
||||
'';
|
||||
type = with types; nullOr str;
|
||||
default = null;
|
||||
};
|
||||
method = lib.mkOption {
|
||||
description = ''
|
||||
Default Authelia authentication method to use for all locations
|
||||
in this virtualHost. Authentication is disabled by default for
|
||||
all locations if this is set to `null`.
|
||||
'';
|
||||
type = with types; nullOr (enum validAuthMethods);
|
||||
default = "regular";
|
||||
example = "basic";
|
||||
};
|
||||
};
|
||||
};
|
||||
config = {
|
||||
authelia.upstream = mkIf (!(isNull config.authelia.instance)) (
|
||||
getUpstreamFromInstance config.authelia.instance
|
||||
);
|
||||
authelia.endpoint.upstream = mkIf (!(isNull config.authelia.endpoint.instance)) (
|
||||
getUpstreamFromInstance config.authelia.endpoint.instance
|
||||
);
|
||||
|
||||
forceSSL = lib.mkIf (!(isNull config.authelia.endpoint.upstream)) true;
|
||||
|
||||
# authelia nginx internal endpoints
|
||||
locations =
|
||||
let
|
||||
api = "${config.authelia.upstream}/api/verify";
|
||||
in
|
||||
lib.mkMerge [
|
||||
(lib.mkIf (!(isNull config.authelia.upstream)) {
|
||||
# just setup both, they can't be accessed externally anyways.
|
||||
"/internal/authelia/authz" = {
|
||||
proxyPass = api;
|
||||
recommendedProxySettings = false;
|
||||
extraConfig = ''
|
||||
include ${autheliaLocationConfig};
|
||||
'';
|
||||
};
|
||||
"/internal/authelia/authz/basic" = {
|
||||
proxyPass = "${api}?auth=basic";
|
||||
recommendedProxySettings = false;
|
||||
extraConfig = ''
|
||||
include ${autheliaBasicLocationConfig};
|
||||
'';
|
||||
};
|
||||
})
|
||||
(lib.mkIf (!(isNull config.authelia.endpoint.upstream)) {
|
||||
"/" = {
|
||||
extraConfig = ''
|
||||
include "${autheliaProxyConfig}";
|
||||
'';
|
||||
proxyPass = "${config.authelia.endpoint.upstream}";
|
||||
recommendedProxySettings = false;
|
||||
};
|
||||
"= /api/verify" = {
|
||||
proxyPass = "${config.authelia.endpoint.upstream}";
|
||||
recommendedProxySettings = false;
|
||||
};
|
||||
"/api/authz" = {
|
||||
proxyPass = "${config.authelia.endpoint.upstream}";
|
||||
recommendedProxySettings = false;
|
||||
};
|
||||
})
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
genLocationModule =
|
||||
vhostAttrs:
|
||||
{ name, config, ... }:
|
||||
let
|
||||
vhostConfig = vhostAttrs.config;
|
||||
in
|
||||
{
|
||||
options.authelia.method = lib.mkOption {
|
||||
description = ''
|
||||
Authelia authentication method to use for this location.
|
||||
Authentication is disabled for this location if this is set to
|
||||
`null`.
|
||||
'';
|
||||
type = with types; nullOr (enum validAuthMethods);
|
||||
default = vhostConfig.authelia.method;
|
||||
example = "basic";
|
||||
};
|
||||
options.authelia.endpointURL = lib.mkOption {
|
||||
description = ''
|
||||
(temporary) authelia endpoint redirect URL.
|
||||
'';
|
||||
type = with types; str;
|
||||
default = vhostConfig.authelia.endpointURL;
|
||||
};
|
||||
|
||||
config =
|
||||
lib.mkIf
|
||||
(
|
||||
(!(lib.strings.hasPrefix "/internal/authelia/" name))
|
||||
&& (!(isNull vhostConfig.authelia.upstream))
|
||||
&& (!(isNull config.authelia.method))
|
||||
)
|
||||
{
|
||||
extraConfig = ''
|
||||
include ${genAuthConfigPkg config.authelia.method config.authelia.endpointURL};
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
in
|
||||
{
|
||||
virtualHosts = mkAttrsOfSubmoduleOpt vhostModule;
|
||||
};
|
||||
|
||||
# TODO check if any vhosts have authelia configured
|
||||
config =
|
||||
let
|
||||
# TODO later, there are only assertions here
|
||||
configured = any (
|
||||
vhost: (!(isNull vhost.authelia.upstream)) || (!(isNull vhost.authelia.endpoint.upstream))
|
||||
) (attrValues nginx.virtualHosts);
|
||||
in
|
||||
mkIf true {
|
||||
assertions = [
|
||||
{
|
||||
assertion = all (
|
||||
vhost: (!(isNull vhost.authelia.upstream)) -> (isNull vhost.authelia.endpoint.upstream)
|
||||
) (attrValues nginx.virtualHosts);
|
||||
message = "`services.nginx.virtualHosts.<name>.authelia.upstream` and `services.nginx.virtualHosts.<name>.authelia.endpoint.upstream` cannot be set at the same time.";
|
||||
}
|
||||
# {
|
||||
# assertion = all (
|
||||
# vhost: vhost.authelia.instance -> config.services.authelia.instances ? "${vhost.authelia.instance}"
|
||||
# ) (attrValues nginx.virtualHosts);
|
||||
# message = "`services.authelia.instances.<name>` must be configured if `services.nginx.virtualHosts.<name>.authelia.instance` is set.";
|
||||
# }
|
||||
];
|
||||
};
|
||||
}
|
||||
@ -2,6 +2,7 @@
|
||||
{
|
||||
imports = [
|
||||
./gitea.nix
|
||||
./authelia.nix
|
||||
];
|
||||
config = {
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user