72 lines
1.8 KiB
Nix
72 lines
1.8 KiB
Nix
{
|
|
pkgs,
|
|
config,
|
|
lib,
|
|
...
|
|
}:
|
|
with lib;
|
|
let
|
|
cfg = config.eboskma.keycloak;
|
|
in
|
|
{
|
|
options.eboskma.keycloak = {
|
|
enable = mkEnableOption "keycloak";
|
|
};
|
|
|
|
config = mkIf cfg.enable {
|
|
services.keycloak = {
|
|
enable = true;
|
|
database.passwordFile = config.sops.secrets.keycloak-db-password.path;
|
|
|
|
settings = {
|
|
hostname = "id.datarift.nl";
|
|
http-host = "127.0.0.1";
|
|
http-port = 8081;
|
|
proxy = "edge";
|
|
features = "docker";
|
|
};
|
|
|
|
plugins = [
|
|
(pkgs.callPackage ./keycloak-orgs.nix {
|
|
inherit (pkgs) fetchFromGitHub;
|
|
inherit (pkgs.maven) buildMavenPackage;
|
|
})
|
|
(pkgs.callPackage ./keycloak-admin-ui.nix {
|
|
inherit (pkgs) fetchFromGitHub;
|
|
inherit (pkgs.maven) buildMavenPackage;
|
|
keycloak = config.services.keycloak.package;
|
|
})
|
|
(pkgs.callPackage ./phasetwo-admin-ui.nix { inherit (pkgs) stdenv fetchFromGitHub; })
|
|
];
|
|
};
|
|
|
|
services.caddy = {
|
|
enable = true;
|
|
|
|
email = "erwin@datarift.nl";
|
|
|
|
virtualHosts = {
|
|
"${config.services.keycloak.settings.hostname}" = {
|
|
extraConfig = ''
|
|
@public_or_allowed_remote {
|
|
expression path('/realms/*', '/resources/*', '/js/*', '/robots.txt') || remote_ip('86.85.243.40/32', '2a02:a441:c959:1::/64', '100.64.0.0/10', 'fd7a:115c:a1e0:ab12:4843:cd96:6240:0000/106')
|
|
}
|
|
|
|
route {
|
|
reverse_proxy @public_or_allowed_remote ${config.services.keycloak.settings.http-host}:${toString config.services.keycloak.settings.http-port}
|
|
|
|
error "Nope." 403
|
|
}
|
|
'';
|
|
};
|
|
};
|
|
};
|
|
|
|
security.acme.acceptTerms = true;
|
|
|
|
networking.firewall.allowedTCPPorts = [
|
|
80
|
|
443
|
|
];
|
|
};
|
|
}
|