-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #11 from entropia/leona/host-abrechnung-add-berech…
…enbarkei feat(host/abrechung): add berechenbarkeit service
- Loading branch information
Showing
6 changed files
with
222 additions
and
4 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,54 @@ | ||
| { config, pkgs, ... }: { | ||
| x.sops.secrets."hosts/abrechnung/berechenbarkeit_vouch_proxy_env" = {}; | ||
|
|
||
| systemd.services.berechenbarkeit = { | ||
| description = "berechenbarkeit"; | ||
| after = [ "network.target" "postgresql.service" ]; | ||
| wantedBy = [ "multi-user.target" ]; | ||
|
|
||
| environment = { | ||
| BERECHENBARKEIT_STORAGE_BASE_PATH = "/var/lib/berechenbarkeit/storage"; | ||
| }; | ||
| preStart = '' | ||
| mkdir -p /var/lib/berechenbarkeit/storage | ||
| ''; | ||
|
|
||
| serviceConfig = { | ||
| Type = "simple"; | ||
| DynamicUser = true; | ||
| User = "berechenbarkeit"; | ||
| StateDirectory = "berechenbarkeit"; | ||
| ExecStart = "${pkgs.berechenbarkeit}/bin/berechenbarkeit --database-url 'postgres:///berechenbarkeit?host=/run/postgresql'"; | ||
| Restart = "always"; | ||
| }; | ||
| }; | ||
|
|
||
| services.postgresql = { | ||
| enable = true; | ||
| ensureDatabases = [ "berechenbarkeit" ]; | ||
| ensureUsers = [ | ||
| { name = "berechenbarkeit"; | ||
| ensureDBOwnership = true; | ||
| } | ||
| ]; | ||
| }; | ||
|
|
||
| services.nginx.enable = true; | ||
| services.nginx.virtualHosts."abrechnung.entropia.de" = { | ||
| enableACME = true; | ||
| forceSSL = true; | ||
| kTLS = true; | ||
| locations."/" = { | ||
| proxyPass = "http://127.0.0.1:3000"; | ||
| }; | ||
| }; | ||
|
|
||
| services.vouch-proxy = { | ||
| enable = true; | ||
| servers."abrechnung.entropia.de" = { | ||
| clientId = "abrechnung.entropia.de"; | ||
| port = 12300; | ||
| environmentFiles = [ config.sops.secrets."hosts/abrechnung/berechenbarkeit_vouch_proxy_env".path ]; | ||
| }; | ||
| }; | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,129 @@ | ||
| { pkgs, lib, config, ... }: | ||
|
|
||
| with lib; | ||
|
|
||
| let | ||
| cfg = config.services.vouch-proxy; | ||
| format = pkgs.formats.yaml {}; | ||
| serverOptions = | ||
| { ... }: { | ||
|
|
||
| options = { | ||
| clientId = mkOption { | ||
| type = types.str; | ||
| description = "OIDC Client ID for server."; | ||
| }; | ||
| port = mkOption { | ||
| type = types.int; | ||
| description = "Port of the vouch-proxy server."; | ||
| }; | ||
| environmentFiles = mkOption { | ||
| type = with types; nullOr (listOf path); | ||
| default = [ ]; | ||
| description = '' | ||
| List of environment files set in the vouch-proxy-<literal>name</literal> systemd service. | ||
| For example the jwt secret and oidc secrets should be set in one of these files. | ||
| ''; | ||
| }; | ||
| addAuthRequestToMainLocation = mkOption { | ||
| type = types.bool; | ||
| default = false; | ||
| description = "Add auth_request to / location."; | ||
| }; | ||
| }; | ||
| }; | ||
| mkService = domain: serviceConfig: | ||
| let | ||
| settings = recursiveUpdate cfg.globalSettings { | ||
| vouch.port = serviceConfig.port; | ||
| vouch.cookie.domain = domain; | ||
| oauth.client_id = serviceConfig.clientId; | ||
| oauth.callback_url = "https://${domain}/_vouch/auth"; | ||
| }; | ||
| configFile = format.generate "vouch-proxy-config.yaml" settings; | ||
| in nameValuePair "vouch-proxy-${domain}" { | ||
| description = "vouch-proxy"; | ||
| after = [ "network.target" ]; | ||
| wantedBy = [ "multi-user.target" ]; | ||
| path = [ cfg.package ]; | ||
|
|
||
| serviceConfig = { | ||
| Type = "simple"; | ||
| DynamicUser = true; | ||
| ExecStart = "${cfg.package}/bin/vouch-proxy -config ${configFile}"; | ||
| Restart = "always"; | ||
| EnvironmentFile = serviceConfig.environmentFiles; | ||
| }; | ||
| }; | ||
| mkVirtualHosts = domain: serviceConfig: nameValuePair domain { | ||
| extraConfig = '' | ||
| error_page 401 = @error401; | ||
| ''; | ||
| locations."/".extraConfig = '' | ||
| auth_request /_vouch/validate; | ||
| ''; | ||
| locations."/_vouch" = { | ||
| proxyPass = "http://127.0.0.1:${toString serviceConfig.port}"; | ||
| extraConfig = '' | ||
| proxy_pass_request_body off; | ||
| proxy_set_header Content-Length ""; | ||
| # these return values are used by the @error401 call | ||
| auth_request_set $auth_resp_jwt $upstream_http_x_vouch_jwt; | ||
| auth_request_set $auth_resp_err $upstream_http_x_vouch_err; | ||
| auth_request_set $auth_resp_failcount $upstream_http_x_vouch_failcount; | ||
| ''; | ||
| }; | ||
|
|
||
| locations."@error401".return = "302 https://${domain}/_vouch/login?url=https://$host$request_uri&vouch-failcount=$auth_resp_failcount&X-Vouch-Token=$auth_resp_jwt&error=$auth_resp_err"; | ||
| }; | ||
| in { | ||
| options.services.vouch-proxy = with lib; { | ||
| enable = mkEnableOption "vouch-proxy service"; | ||
| package = mkOption { | ||
| default = pkgs.vouch-proxy; | ||
| type = types.package; | ||
| defaultText = "pkgs.vouch-proxy"; | ||
| description = "vouch-proxy derivation to use."; | ||
| }; | ||
| servers = mkOption { | ||
| type = types.attrsOf (types.submodule serverOptions); | ||
| }; | ||
| globalSettings = mkOption { | ||
| type = format.type; | ||
| default = { | ||
| vouch = { | ||
| listen = "127.0.0.1"; | ||
| jwt.issuer = "entropia vouch"; | ||
| allowAllUsers = true; | ||
| headers = { | ||
| claims = [ | ||
| "preferred_username" | ||
| ]; | ||
| }; | ||
| document_root = "/_vouch"; | ||
| }; | ||
| oauth = { | ||
| provider = "oidc"; | ||
| auth_url = "https://sso.entropia.de/realms/entropia/protocol/openid-connect/auth"; | ||
| token_url = "https://sso.entropia.de/realms/entropia/protocol/openid-connect/token"; | ||
| user_info_url = "https://sso.entropia.de/realms/entropia/protocol/openid-connect/userinfo"; | ||
| scopes = [ | ||
| "openid" | ||
| "email" | ||
| "profile" | ||
| ]; | ||
| }; | ||
| }; | ||
| description = '' | ||
| Vouch-proxy configuration. Refer to | ||
| <link xlink:href="https://github.com/vouch/vouch-proxy/blob/master/config/config.yml_example"/> | ||
| for details on supported values. | ||
| ''; | ||
| }; | ||
| }; | ||
| config = lib.mkIf cfg.enable { | ||
| systemd.services = mapAttrs' mkService cfg.servers; | ||
| services.nginx.virtualHosts = mapAttrs' mkVirtualHosts cfg.servers; | ||
| }; | ||
| } | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,32 @@ | ||
| { lib, rustPlatform, fetchFromGitHub, pkg-config, openssl, postgresql }: | ||
|
|
||
| rustPlatform.buildRustPackage { | ||
| pname = "berechenbarkeit"; | ||
| version = "0-unstable-2024-05-12"; | ||
|
|
||
| src = fetchFromGitHub { | ||
| owner = "entropia"; | ||
| repo = "berechenbarkeit"; | ||
| rev = "703ecb85d66a1798c33feebd1d906a18bf1727e4"; | ||
| hash = "sha256-DtXlaNvWIhDrBMVWOmV1eTskJmqYf8wYLdEfxdbD3oc="; | ||
| }; | ||
|
|
||
| cargoHash = "sha256-Zisj2fpebz4CRwpsg/H+8H/s1Q395lOiVKg9fcZVTtw="; | ||
|
|
||
| nativeBuildInputs = [ pkg-config ]; | ||
| buildInputs = [ | ||
| openssl.dev | ||
| postgresql.lib | ||
| ]; | ||
|
|
||
| preBuild = '' | ||
| export BERECHENBARKEIT_STATIC_BASE_PATH=$assets | ||
| ''; | ||
|
|
||
| postInstall = '' | ||
| mkdir $assets | ||
| cp -R $src/src/assets/* $assets | ||
| ''; | ||
|
|
||
| outputs = [ "out" "assets" ]; | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters