nullbite/nixfiles
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

authelia: fixes

Browse Source
This commit is contained in:
NullBite 2024-07-14 22:31:51 -04:00
parent f69cec5ba8
commit efefce538d
Signed by: nullbite
GPG Key ID: 6C4D545385D4925A
1 changed files with 55 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

79
hosts/rpi4/authelia.nix
View File

@ -6,10 +6,18 @@
}: }:
let let
inherit (lib) types mkIf optionalString; inherit (lib) types mkIf optionalString;
inherit (builtins) isNull any attrValues; inherit (builtins)
isNull
any
all
attrValues
toString
;
inherit (config.services) nginx;
validAuthMethods = [ validAuthMethods = [
"normal" "regular"
"basic" "basic"
]; ];
getUpstreamFromInstance = getUpstreamFromInstance =
@ -25,7 +33,7 @@ let
else else
server.host; server.host;
in in
"http://${host}:${port}"; "http://${host}:${toString port}";
# use this when reverse proxying to authelia (and only authelia because i # use this when reverse proxying to authelia (and only authelia because i
# like the nixos recommended proxy settings better) # like the nixos recommended proxy settings better)
@ -129,7 +137,7 @@ let
## Send a subrequest to Authelia to verify if the user is authenticated and ## Send a subrequest to Authelia to verify if the user is authenticated and
# has permission to access the resource. # has permission to access the resource.
auth_request /internal/authelia/authz${optionalString method == "basic" "/basic"}; auth_request /internal/authelia/authz${optionalString (method == "basic") "/basic"};
## Save the upstream metadata response headers from Authelia to variables. ## Save the upstream metadata response headers from Authelia to variables.
auth_request_set $user $upstream_http_remote_user; auth_request_set $user $upstream_http_remote_user;
@ -144,7 +152,7 @@ let
proxy_set_header Remote-Name $name; proxy_set_header Remote-Name $name;
proxy_set_header Remote-Email $email; proxy_set_header Remote-Email $email;
${optionalString method == "regular" snippet_regular} ${optionalString (method == "regular") snippet_regular}
''; '';
genAuthConfigPkg = genAuthConfigPkg =
method: pkgs.writeText "authelia-authrequest-${method}.conf" (genAuthConfig method); method: pkgs.writeText "authelia-authrequest-${method}.conf" (genAuthConfig method);
@ -163,7 +171,7 @@ in
{ name, config, ... }@attrs: { name, config, ... }@attrs:
{ {
options = { options = {
locations = mkAttrsOfSubmoduleOpt (locationModule' attrs); locations = mkAttrsOfSubmoduleOpt (genLocationModule attrs);
authelia = { authelia = {
endpoint = { endpoint = {
instance = lib.mkOption { instance = lib.mkOption {
@ -199,6 +207,8 @@ in
requests to. This should not be the public-facing authentication requests to. This should not be the public-facing authentication
endpoint URL. endpoint URL.
''; '';
type = with types; nullOr str;
default = null;
}; };
method = lib.mkOption { method = lib.mkOption {
description = '' description = ''
@ -206,7 +216,7 @@ in
in this virtualHost. Authentication is disabled by default for in this virtualHost. Authentication is disabled by default for
all locations if this is set to `null`. all locations if this is set to `null`.
''; '';
type = with types; nullOr oneOf validAuthMethods; type = with types; nullOr (enum validAuthMethods);
default = "regular"; default = "regular";
example = "basic"; example = "basic";
}; };
@ -229,14 +239,14 @@ in
# just setup both, they can't be accessed externally anyways. # just setup both, they can't be accessed externally anyways.
"/internal/authelia/authz" = { "/internal/authelia/authz" = {
proxyPass = api; proxyPass = api;
recommendedProxyConfig = false; recommendedProxySettings = false;
extraConfig = '' extraConfig = ''
include ${autheliaLocationConfig}; include ${autheliaLocationConfig};
''; '';
}; };
"/internal/authelia/authz/basic" = { "/internal/authelia/authz/basic" = {
proxyPass = "${api}/basic"; proxyPass = "${api}/basic";
recommendedProxyConfig = false; recommendedProxySettings = false;
extraConfig = '' extraConfig = ''
include ${autheliaBasicLocationConfig}; include ${autheliaBasicLocationConfig};
''; '';
@ -245,7 +255,7 @@ in
}; };
}; };
locationModule' = genLocationModule =
vhostAttrs: vhostAttrs:
{ name, config, ... }: { name, config, ... }:
let let
@ -258,18 +268,22 @@ in
Authentication is disabled for this location if this is set to Authentication is disabled for this location if this is set to
`null`. `null`.
''; '';
type = with types; nullOr oneOf validAuthMethods; type = with types; nullOr (enum validAuthMethods);
default = vhostConfig.authelia.method; default = vhostConfig.authelia.method;
example = "basic"; example = "basic";
}; };
config = config =
lib.mkIf (!(lib.strings.hasPrefix "/internal/authelia/" name)) lib.mkIf
&& (!(isNull vhostConfig.authelia.upstream)) (
&& (!(isNull config.authelia.method)) { (!(lib.strings.hasPrefix "/internal/authelia/" name))
extraConfig = '' && (!(isNull vhostConfig.authelia.upstream))
include ${genAuthConfigPkg config.authelia.method}; && (!(isNull config.authelia.method))
''; )
}; {
extraConfig = ''
include ${genAuthConfigPkg config.authelia.method};
'';
};
}; };
in in
@ -278,10 +292,27 @@ in
}; };
# TODO check if any vhosts have authelia configured # TODO check if any vhosts have authelia configured
config = mkIf false { config =
let
assertions = [ # TODO later, there are only assertions here
# TODO vhost cannot be both auth endpoint proxy and regular reverse proxy configured = any (
]; vhost: (!(isNull vhost.authelia.upstream)) || (!(isNull vhost.authelia.endpoint.upstream))
}; ) (attrValues nginx.virtualHosts);
in
mkIf true {
assertions = [
{
assertion = all (
vhost: (!(isNull vhost.authelia.upstream)) -> (isNull vhost.authelia.endpoint.upstream)
) (attrValues nginx.virtualHosts);
message = "`services.nginx.virtualHosts.<name>.authelia.upstream` and `services.nginx.virtualHosts.<name>.authelia.endpoint.upstream` cannot be set at the same time.";
}
# {
# assertion = all (
# vhost: vhost.authelia.instance -> config.services.authelia.instances ? "${vhost.authelia.instance}"
# ) (attrValues nginx.virtualHosts);
# message = "`services.authelia.instances.<name>` must be configured if `services.nginx.virtualHosts.<name>.authelia.instance` is set.";
# }
];
};
} }