This repository has no description
1.4 kB
32 lines
1# Login via id.lassul.us (Zitadel project hass, configs/hass/proxy.nix) with
2# the auth_oidc custom component. The username/password login stays.
3{ config, pkgs, ... }:
4{
5 # Loaded from /config/packages like configs/hass/monitoring.nix.
6 # automatic_user_linking: the first login reuses the HA user whose username
7 # equals the preferred_username claim; only users granted the project can
8 # log in at all.
9 virtualisation.oci-containers.containers.homeassistant = {
10 volumes = [
11 "${pkgs.home-assistant-custom-components.auth_oidc}/custom_components/auth_oidc:/config/custom_components/auth_oidc:ro"
12 "${pkgs.writeText "auth_oidc.yaml" ''
13 auth_oidc:
14 client_id: !env_var HASS_OIDC_CLIENT_ID
15 discovery_url: https://id.lassul.us/.well-known/openid-configuration
16 display_name: lassul.us ID
17 features:
18 automatic_user_linking: true
19 include_groups_scope: false
20 ''}:/config/packages/auth_oidc.yaml:ro"
21 ];
22 environmentFiles = [ config.clan.core.vars.generators.hass-oidc.files.env.path ];
23 };
24
25 clan.core.vars.generators.hass-oidc = {
26 files.env = { };
27 prompts.client-id.description = "Client id of the Zitadel app hass/web (CLIENT_ID in /var/lib/zitadel-apps/hass-web.env on neoprism)";
28 script = ''
29 printf 'HASS_OIDC_CLIENT_ID=%s\n' "$(cat "$prompts"/client-id)" > "$out/env"
30 '';
31 };
32}