This repository has no description
1.5 kB
53 lines
1let
2 domain = "byoidc.lassul.us";
3 port = 8773;
4in
5{
6 config,
7 pkgs,
8 self,
9 ...
10}:
11{
12 # byoidc: OIDC provider that signs users in with their own OpenID provider.
13 # Zitadel offers it as the IdP "Your own provider" (configs/zitadel.nix),
14 # which uses the client "zitadel" below with the same client secret.
15 imports = [ self.inputs.byoidc.nixosModules.byoidc ];
16
17 services.byoidc = {
18 enable = true;
19 listen = "127.0.0.1:${toString port}";
20 publicUrl = "https://${domain}";
21 clientName = "byoidc (lassul.us)";
22 clientUri = "https://lassul.us";
23 trustForwardedFor = true;
24 client = {
25 id = "zitadel";
26 secretFile = config.clan.core.vars.generators.byoidc.files."client-secret".path;
27 redirectUris = [ "https://id.lassul.us/ui/login/login/externalidp/callback" ];
28 };
29 };
30
31 clan.core.vars.generators.byoidc = {
32 files."client-secret" = { };
33 runtimeInputs = [ pkgs.openssl ];
34 script = ''
35 openssl rand -hex 32 | tr -d '\n' > "$out/client-secret"
36 '';
37 };
38
39 services.nginx.virtualHosts.${domain} = {
40 enableACME = true;
41 forceSSL = true;
42 locations."/" = {
43 proxyPass = "http://127.0.0.1:${toString port}";
44 # byoidc rate-limits on the last X-Forwarded-For entry; set it from the
45 # socket, never from a client-supplied header.
46 extraConfig = ''
47 proxy_set_header Host $host;
48 proxy_set_header X-Forwarded-For $remote_addr;
49 proxy_set_header X-Forwarded-Proto $scheme;
50 '';
51 };
52 };
53}