forked from
lass.pds.lassul.us/superconfig
This repository has no description
1.8 kB
37 lines
1# Login via id.lassul.us (Zitadel project hass, configs/hass/proxy.nix) with
2# the auth_oidc custom component, the only login (auth_providers below).
3{ config, pkgs, ... }:
4{
5 # Loaded from /config/packages like configs/hass/monitoring.nix.
6 # automatic_user_linking: the first login reuses the HA user whose username
7 # equals the preferred_username claim; only users granted the project can
8 # log in at all.
9 virtualisation.oci-containers.containers.homeassistant = {
10 volumes = [
11 "${pkgs.home-assistant-custom-components.auth_oidc}/custom_components/auth_oidc:/config/custom_components/auth_oidc:ro"
12 "${pkgs.writeText "auth_oidc.yaml" ''
13 auth_oidc:
14 client_id: !env_var HASS_OIDC_CLIENT_ID
15 discovery_url: https://id.lassul.us/.well-known/openid-configuration
16 display_name: lassul.us ID
17 features:
18 automatic_user_linking: true
19 include_groups_scope: false
20 ''}:/config/packages/auth_oidc.yaml:ro"
21 # No HA auth provider, so no username/password login. Packages can't set
22 # it, configuration.yaml in the volume has once under homeassistant:
23 # auth_providers: !include auth_providers.yaml
24 # Long-lived access tokens are not tied to a provider and keep working.
25 "${pkgs.writeText "auth_providers.yaml" (builtins.toJSON [ ])}:/config/auth_providers.yaml:ro"
26 ];
27 environmentFiles = [ config.clan.core.vars.generators.hass-oidc.files.env.path ];
28 };
29
30 clan.core.vars.generators.hass-oidc = {
31 files.env = { };
32 prompts.client-id.description = "Client id of the Zitadel app hass/web (CLIENT_ID in /var/lib/zitadel-apps/hass-web.env on neoprism)";
33 script = ''
34 printf 'HASS_OIDC_CLIENT_ID=%s\n' "$(cat "$prompts"/client-id)" > "$out/env"
35 '';
36 };
37}