nullbite/nixfiles
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Compare commits

base: nullbite:da27cbc9a007420b5a8bb212ac68cafa722c7e32
Branches Tags
nullbite:main
nullbite:feature/refactor-module-args
nullbite:flake-parts-hosts
nullbite:feature/tmpfiles-workaround
nullbite:wip/unified-lts-kernel
nullbite:wip/lanzaboote
nullbite:authelia
nullbite:btrfs
nullbite:wip/theme-helper
nullbite:wip/unstable
nullbite:archive/authelia
..
compare: nullbite:f69cec5ba8804544a89f7c1e24b82b8de467a249
Branches Tags
nullbite:main
nullbite:feature/refactor-module-args
nullbite:flake-parts-hosts
nullbite:feature/tmpfiles-workaround
nullbite:wip/unified-lts-kernel
nullbite:wip/lanzaboote
nullbite:authelia
nullbite:btrfs
nullbite:wip/theme-helper
nullbite:wip/unstable
nullbite:archive/authelia

No commits in common. "da27cbc9a007420b5a8bb212ac68cafa722c7e32" and "f69cec5ba8804544a89f7c1e24b82b8de467a249" have entirely different histories.
da27cbc9a0 ... f69cec5ba8

1 changed files with 77 additions and 129 deletions
Show Stats Expand all files Collapse all files

162
hosts/rpi4/authelia.nix
View File

@ -6,18 +6,10 @@
}: }:
let let
inherit (lib) types mkIf optionalString; inherit (lib) types mkIf optionalString;
inherit (builtins) inherit (builtins) isNull any attrValues;
isNull
any
all
attrValues
toString
;
inherit (config.services) nginx;
validAuthMethods = [ validAuthMethods = [
"regular" "normal"
"basic" "basic"
]; ];
getUpstreamFromInstance = getUpstreamFromInstance =
@ -33,7 +25,7 @@ let
else else
server.host; server.host;
in in
"http://${host}:${toString port}"; "http://${host}:${port}";
# use this when reverse proxying to authelia (and only authelia because i # use this when reverse proxying to authelia (and only authelia because i
# like the nixos recommended proxy settings better) # like the nixos recommended proxy settings better)
@ -80,12 +72,8 @@ let
## Headers ## Headers
## The headers starting with X-* are required. ## The headers starting with X-* are required.
proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
proxy_set_header X-Original-Method $request_method; proxy_set_header X-Original-Method $request_method;
proxy_set_header X-Forwarded-Method $request_method; proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $http_host;
proxy_set_header X-Forwarded-Uri $request_uri;
proxy_set_header X-Forwarded-For $remote_addr; proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header Content-Length ""; proxy_set_header Content-Length "";
proxy_set_header Connection ""; proxy_set_header Connection "";
@ -107,39 +95,59 @@ let
proxy_connect_timeout 240; proxy_connect_timeout 240;
''; '';
autheliaLocationConfig = pkgs.writeText "authelia-location.conf" autheliaLocation; autheliaLocationConfig = pkgs.writeText "authelia-location.conf" autheliaLocation;
autheliaBasicLocationConfig = autheliaLocationConfig; autheliaBasicLocationConfig = pkgs.writeText "authelia-location-basic.conf" ''
genAuthConfig = method: endpoint: let ${autheliaLocation}
redirect = ''
## If the subreqest returns 200 pass to the backend, if the subrequest returns 401 redirect to the portal. # Auth Basic Headers
error_page 401 =302 ${endpoint}/?rd=$target_url; proxy_set_header X-Original-Method $request_method;
proxy_set_header X-Forwarded-Method $request_method;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $http_host;
proxy_set_header X-Forwarded-URI $request_uri;
''; '';
in ''
auth_request /internal/authelia/authz${optionalString (method == "basic") "/basic"};
## Set the $target_url variable based on the original request. genAuthConfig =
method:
let
snippet_regular = ''
## Configure the redirection when the authz failure occurs. Lines starting
## with 'Modern Method' and 'Legacy Method' should be commented /
## uncommented as pairs. The modern method uses the session cookies
## configuration's authelia_url value to determine the redirection URL here.
## It's much simpler and compatible with the mutli-cookie domain easily.
## Comment this line if you're using nginx without the http_set_misc module. ## Modern Method: Set the $redirection_url to the Location header of the
# set_escape_uri $target_url $scheme://$http_host$request_uri; ## response to the Authz endpoint.
auth_request_set $redirection_url $upstream_http_location;
## Uncomment this line if you're using NGINX without the http_set_misc module. ## Modern Method: When there is a 401 response code from the authz endpoint
set $target_url $scheme://$http_host$request_uri; ## redirect to the $redirection_url.
error_page 401 =302 $redirection_url;
'';
in
''
## Send a subrequest to Authelia to verify if the user is authenticated and
# has permission to access the resource.
## Save the upstream response headers from Authelia to variables. auth_request /internal/authelia/authz${optionalString method == "basic" "/basic"};
## Save the upstream metadata response headers from Authelia to variables.
auth_request_set $user $upstream_http_remote_user; auth_request_set $user $upstream_http_remote_user;
auth_request_set $groups $upstream_http_remote_groups; auth_request_set $groups $upstream_http_remote_groups;
auth_request_set $name $upstream_http_remote_name; auth_request_set $name $upstream_http_remote_name;
auth_request_set $email $upstream_http_remote_email; auth_request_set $email $upstream_http_remote_email;
## Inject the response headers from the variables into the request made to the backend. ## Inject the metadata response headers from the variables into the request
## made to the backend.
proxy_set_header Remote-User $user; proxy_set_header Remote-User $user;
proxy_set_header Remote-Groups $groups; proxy_set_header Remote-Groups $groups;
proxy_set_header Remote-Name $name; proxy_set_header Remote-Name $name;
proxy_set_header Remote-Email $email; proxy_set_header Remote-Email $email;
${optionalString (method == "regular") redirect} ${optionalString method == "regular" snippet_regular}
''; '';
genAuthConfigPkg = genAuthConfigPkg =
method: endpoint: pkgs.writeText "authelia-authrequest-${method}.conf" (genAuthConfig method endpoint); method: pkgs.writeText "authelia-authrequest-${method}.conf" (genAuthConfig method);
in in
{ {
# authelia # authelia
@ -155,10 +163,9 @@ in
{ name, config, ... }@attrs: { name, config, ... }@attrs:
{ {
options = { options = {
locations = mkAttrsOfSubmoduleOpt (genLocationModule attrs); locations = mkAttrsOfSubmoduleOpt (locationModule' attrs);
authelia = { authelia = {
endpoint = { endpoint = {
# endpoint settings
instance = lib.mkOption { instance = lib.mkOption {
description = '' description = ''
Local Authelia instance to act as the authentication endpoint. Local Authelia instance to act as the authentication endpoint.
@ -177,13 +184,6 @@ in
default = null; default = null;
}; };
}; };
# client settings
endpointURL = lib.mkOption {
description = ''
(temporary) authelia endpoint redirect URL.
'';
type = with types; str;
};
instance = lib.mkOption { instance = lib.mkOption {
description = '' description = ''
Local Authelia instance to use. Setting this option will Local Authelia instance to use. Setting this option will
@ -199,8 +199,6 @@ in
requests to. This should not be the public-facing authentication requests to. This should not be the public-facing authentication
endpoint URL. endpoint URL.
''; '';
type = with types; nullOr str;
default = null;
}; };
method = lib.mkOption { method = lib.mkOption {
description = '' description = ''
@ -208,7 +206,7 @@ in
in this virtualHost. Authentication is disabled by default for in this virtualHost. Authentication is disabled by default for
all locations if this is set to `null`. all locations if this is set to `null`.
''; '';
type = with types; nullOr (enum validAuthMethods); type = with types; nullOr oneOf validAuthMethods;
default = "regular"; default = "regular";
example = "basic"; example = "basic";
}; };
@ -222,53 +220,32 @@ in
getUpstreamFromInstance config.authelia.endpoint.instance getUpstreamFromInstance config.authelia.endpoint.instance
); );
forceSSL = lib.mkIf (!(isNull config.authelia.endpoint.upstream)) true;
# authelia nginx internal endpoints # authelia nginx internal endpoints
locations = locations =
let let
api = "${config.authelia.upstream}/api/verify"; api = "${config.authelia.upstream}/api/authz/auth-request";
in in
lib.mkMerge [ lib.mkIf (!(isNull config.authelia.upstream)) {
(lib.mkIf (!(isNull config.authelia.upstream)) {
# just setup both, they can't be accessed externally anyways. # just setup both, they can't be accessed externally anyways.
"/internal/authelia/authz" = { "/internal/authelia/authz" = {
proxyPass = api; proxyPass = api;
recommendedProxySettings = false; recommendedProxyConfig = false;
extraConfig = '' extraConfig = ''
include ${autheliaLocationConfig}; include ${autheliaLocationConfig};
''; '';
}; };
"/internal/authelia/authz/basic" = { "/internal/authelia/authz/basic" = {
proxyPass = "${api}?auth=basic"; proxyPass = "${api}/basic";
recommendedProxySettings = false; recommendedProxyConfig = false;
extraConfig = '' extraConfig = ''
include ${autheliaBasicLocationConfig}; include ${autheliaBasicLocationConfig};
''; '';
}; };
})
(lib.mkIf (!(isNull config.authelia.endpoint.upstream)) {
"/" = {
extraConfig = ''
include "${autheliaProxyConfig}";
'';
proxyPass = "${config.authelia.endpoint.upstream}";
recommendedProxySettings = false;
}; };
"= /api/verify" = {
proxyPass = "${config.authelia.endpoint.upstream}";
recommendedProxySettings = false;
};
"/api/authz" = {
proxyPass = "${config.authelia.endpoint.upstream}";
recommendedProxySettings = false;
};
})
];
}; };
}; };
genLocationModule = locationModule' =
vhostAttrs: vhostAttrs:
{ name, config, ... }: { name, config, ... }:
let let
@ -281,28 +258,16 @@ in
Authentication is disabled for this location if this is set to Authentication is disabled for this location if this is set to
`null`. `null`.
''; '';
type = with types; nullOr (enum validAuthMethods); type = with types; nullOr oneOf validAuthMethods;
default = vhostConfig.authelia.method; default = vhostConfig.authelia.method;
example = "basic"; example = "basic";
}; };
options.authelia.endpointURL = lib.mkOption {
description = ''
(temporary) authelia endpoint redirect URL.
'';
type = with types; str;
default = vhostConfig.authelia.endpointURL;
};
config = config =
lib.mkIf lib.mkIf (!(lib.strings.hasPrefix "/internal/authelia/" name))
(
(!(lib.strings.hasPrefix "/internal/authelia/" name))
&& (!(isNull vhostConfig.authelia.upstream)) && (!(isNull vhostConfig.authelia.upstream))
&& (!(isNull config.authelia.method)) && (!(isNull config.authelia.method)) {
)
{
extraConfig = '' extraConfig = ''
include ${genAuthConfigPkg config.authelia.method config.authelia.endpointURL}; include ${genAuthConfigPkg config.authelia.method};
''; '';
}; };
}; };
@ -313,27 +278,10 @@ in
}; };
# TODO check if any vhosts have authelia configured # TODO check if any vhosts have authelia configured
config = config = mkIf false {
let
# TODO later, there are only assertions here
configured = any (
vhost: (!(isNull vhost.authelia.upstream)) || (!(isNull vhost.authelia.endpoint.upstream))
) (attrValues nginx.virtualHosts);
in
mkIf true {
assertions = [ assertions = [
{ # TODO vhost cannot be both auth endpoint proxy and regular reverse proxy
assertion = all (
vhost: (!(isNull vhost.authelia.upstream)) -> (isNull vhost.authelia.endpoint.upstream)
) (attrValues nginx.virtualHosts);
message = "`services.nginx.virtualHosts.<name>.authelia.upstream` and `services.nginx.virtualHosts.<name>.authelia.endpoint.upstream` cannot be set at the same time.";
}
# {
# assertion = all (
# vhost: vhost.authelia.instance -> config.services.authelia.instances ? "${vhost.authelia.instance}"
# ) (attrValues nginx.virtualHosts);
# message = "`services.authelia.instances.<name>` must be configured if `services.nginx.virtualHosts.<name>.authelia.instance` is set.";
# }
]; ];
}; };
} }