draft: partially getting authelia to work

its started at auth.tuxcord.test

lib/default.nix

@@ -1,4 +1,19 @@
 rec {
+  toList = x: if builtins.isList x then x else [ x ];
+
+  nameValuePair = name: value: { inherit name value; };
+
+  mapAttrsToList = f: attrs: builtins.attrValues (builtins.mapAttrs f attrs);
+
+  attrsToList = mapAttrsToList nameValuePair;
+
+  getSSHKeys =
+    username:
+    if (builtins.hasAttr "ssh" users.${username}) then
+      toList users.${username}.ssh
+    else
+      builtins.warn "user ${username} declared without ssh keys" [ ];
+
   users = import ./users.nix;
 
   adminSSHKeys = builtins.concatLists (
@@ -6,16 +21,4 @@ rec {
       builtins.filter (user: user.value.admin or false) (attrsToList users)
     )
   );
-
-  attrsToList = mapAttrsToList nameValuePair;
-  mapAttrsToList = f: attrs: builtins.attrValues (builtins.mapAttrs f attrs);
-  nameValuePair = name: value: { inherit name value; };
-  toList = x: if builtins.isList x then x else [ x ];
-
-  getSSHKeys =
-    username:
-    if (builtins.hasAttr "ssh" users.${username}) then
-      toList users.${username}.ssh
-    else
-      builtins.warn "user ${username} declared without ssh key" [ ];
 }

nixos/common.nix

@@ -100,21 +100,17 @@ in
     extraHosts =
       let
         subdomains = [
-          ""
+          "git"
-          ".git"
+          "auth"
         ];
+
+        inherit (config.networking) fqdn;
+        hosts = [ fqdn ] ++ map (sub: "${sub}.${fqdn}") subdomains;
       in
-      builtins.foldl' (
+      lib.concatMapStrings (host: ''
-        hosts-acc: domain-prefix:
+        127.0.0.1 ${host}
-        let
+        ::1 ${host}
-          host = "${domain-prefix}${config.networking.fqdn}";
+      '') hosts;
-        in
-        hosts-acc
-        + ''
-          127.0.0.1 ${host}
-          ::1 ${host}
-        ''
-      ) "" subdomains;
   };
 
   virtualisation.podman.enable = true;

nixos/hardware.nix

@@ -15,7 +15,10 @@
       "xhci_pci"
     ];
 
-    kernelModules = [ "kvm-intel" ];
+    kernelModules = [
+      "kvm-amd"
+      "kvm-intel"
+    ];
   };
 
   hardware = {

nixos/modules/authelia.nix

@@ -0,0 +1,136 @@
+{ config, ... }:
+let
+  inherit (config.networking) fqdn;
+
+  acmeEnabled = config.acme.enable;
+in
+{
+  services.authelia.instances.main = {
+    enable = true;
+
+    secrets = {
+      jwtSecretFile = builtins.toFile "authelia-jwtSecret" "QWERTYUIOPASDFGHJKLZXCVBNM1234567890abcdefABCDEFGH";
+      storageEncryptionKeyFile = builtins.toFile "authelia-storageEncryptionKeyFile" "supersecretkeyaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
+      sessionSecretFile = builtins.toFile "aauthelia-sessionSecretFile" "supersecretkey";
+    };
+
+    settings = {
+      theme = "dark";
+      default_redirection_url = "https://${fqdn}"; # HAS to be httpS
+
+      server.address = "127.0.0.1:3001";
+
+      log = {
+        level = "debug";
+        format = "text";
+      };
+
+      authentication_backend = {
+        file = {
+          path = "/var/lib/authelia-main/users_database.yml";
+        };
+      };
+
+      access_control = {
+        default_policy = "deny";
+        rules = [
+          {
+            domain = [ "auth.${fqdn}" ];
+            policy = "bypass";
+          }
+          {
+            domain = [ "*.${fqdn}" ];
+            policy = "one_factor";
+          }
+        ];
+      };
+
+      session = {
+        name = "authelia_session";
+        expiration = "12h";
+        inactivity = "45m";
+        remember_me = "1M";
+        domain = "${fqdn}";
+        redis.host = "/run/redis-authelia-main/redis.sock";
+      };
+
+      regulation = {
+        max_retries = 3;
+        find_time = "5m";
+        ban_time = "15m";
+      };
+
+      storage = {
+        local = {
+          path = "/var/lib/authelia-main/db.sqlite3";
+        };
+      };
+
+      notifier = {
+        disable_startup_check = false;
+        filesystem = {
+          filename = "/var/lib/authelia-main/notification.txt";
+        };
+      };
+    };
+  };
+
+  services.redis.servers.authelia-main = {
+    enable = true;
+    user = "authelia-main";
+    port = 0;
+    unixSocket = "/run/redis-authelia-main/redis.sock";
+    unixSocketPerm = 600;
+  };
+
+  # services.openldap = {
+  #   enable = true;
+
+  #   # enable plain connections only
+  #   urlList = [ "ldap:///" ];
+
+  #   settings = {
+  #     attrs = {
+  #       olcLogLevel = "conns config";
+  #     };
+
+  #     children = {
+  #       # "cn=schema".includes = [
+  #       #   "${pkgs.openldap}/etc/schema/core.ldif"
+  #       #   "${pkgs.openldap}/etc/schema/cosine.ldif"
+  #       #   "${pkgs.openldap}/etc/schema/inetorgperson.ldif"
+  #       # ];
+
+  #       "olcDatabase={1}mdb".attrs = {
+  #         objectClass = [
+  #           "olcDatabaseConfig"
+  #           "olcMdbConfig"
+  #         ];
+
+  #         olcDatabase = "{1}mdb";
+  #         olcDbDirectory = "/var/lib/openldap/data";
+
+  #         olcSuffix = "dc=example,dc=com";
+
+  #         # your admin account, do not use writeText on a production system
+  #         olcRootDN = "cn=admin,dc=example,dc=com";
+  #         olcRootPW.path = builtins.roFile "olcRootPW" "pass";
+
+  #         olcAccess = [
+  #           # custom access rules for userPassword attributes
+  #           ''
+  #             {0}to attrs=userPassword
+  #                           by self write
+  #                           by anonymous auth
+  #                           by * none''
+
+  #           # allow read on anything else
+  #           ''
+  #             {1}to *
+  #                           by * read''
+  #         ];
+  #       };
+  #     };
+  #   };
+  # };
+}

nixos/modules/default.nix

@@ -1,6 +1,7 @@
 {
   imports = [
     ./acme.nix
+    ./authelia.nix
     ./dns.nix
     ./fail2ban.nix
     ./gitea.nix

nixos/modules/nginx.nix

@@ -3,13 +3,20 @@ let
   inherit (config.networking) fqdn;
 
   mkVhost =
-    attrs:
+    attrs: locations:
     let
       acmeEnabled = config.acme.enable;
     in
     {
       forceSSL = acmeEnabled;
       useACMEHost = if acmeEnabled then fqdn else null;
+
+      locations = {
+        "= /robots.txt" = {
+          alias = disallowedRobotsTxt;
+        };
+      }
+      // locations;
     }
     // attrs;
 
@@ -21,6 +28,19 @@ let
       proxy_request_buffering off;
     '';
   };
+
+  mkSsi = webRoot: {
+    root = webRoot;
+
+    extraConfig = ''
+      ssi on;
+    '';
+  };
+
+  disallowedRobotsTxt = builtins.toFile "robots.txt" ''
+    User-agent: *
+    Disallow: /
+  '';
 in
 {
   services.nginx = {
@@ -32,20 +52,18 @@ in
     recommendedGzipSettings = true;
     recommendedOptimisation = true;
 
-    virtualHosts."${fqdn}" = mkVhost {
+    virtualHosts = {
-      default = true;
+      "${fqdn}" = mkVhost { default = true; } {
-
+        "/" = mkSsi "${self.pins.website}/web-root";
-      locations."/" = {
-        root = "${self.pins.website}/web-root";
-
-        extraConfig = ''
-          ssi on;
-        '';
       };
-    };
 
-    virtualHosts."git.${fqdn}" = mkVhost {
+      "git.${fqdn}" = mkVhost { } {
-      locations."/" = mkProxy config.services.gitea.settings.server.HTTP_PORT;
+        "/" = mkProxy config.services.gitea.settings.server.HTTP_PORT;
+      };
+
+      "auth.${fqdn}" = mkVhost { } {
+        "/" = mkProxy 3001;
+      };
     };
   };
 

nixos/users.nix

@@ -45,8 +45,21 @@ lib.recursiveUpdate
     (lib.attrsToList users)
   ).options
   {
-    users.users.root = {
+    users = {
-      initialPassword = "tuxcord";
+      motd = ''
-      openssh.authorizedKeys.keys = self.lib.adminSSHKeys;
+                  __                                          __                      __
+        ---------/\ \__                                      /\ \                    /\ \__
+        ---------\ \ ,_\  __  __  __  _   ___    ___   _ __  \_\ \        ___      __\ \ ,_\
+        ----------\ \ \/ /\ \/\ \/\ \/'\ /'___\ / __`\/\`'__\/'_` \      /'_ `\  /'__`\ \ \/
+        -----------\ \ \_\ \ \_\ \/>  <//\ \__//\ \L\ \ \ \//\ \L\ \  __/\ \/\ \/\  __/\ \ \_
+        ------------\ \__\\ \____//\_/\_\ \____\ \____/\ \_\\ \___,_\/\_\ \_\ \_\ \____\\ \__\
+        -------------\/__/ \/___/ \//\/_/\/____/\/___/  \/_/ \/__,_ /\/_/\/_/\/_/\/____/ \/__/
+                                                    A friendly Linux community - est. July 2023
+      '';
+
+      users.root = {
+        initialPassword = "tuxcord";
+        openssh.authorizedKeys.keys = self.lib.adminSSHKeys;
+      };
     };
   }