This repository has no description
2.0 kB
56 lines
1{ config, ... }:
2{
3 imports = [ ./module.nix ];
4 clan.hedgedoc.domain = "pad.lassul.us";
5
6 # GitHub login (https://github.com/settings/applications/2352617)
7 clan.core.vars.generators.hedgedoc-github-auth = {
8 files."hedgedoc.env" = { };
9 prompts."hedgedoc.env" = {
10 description = ''
11 goto https://github.com/settings/applications/2352617 and paste the data in the following format:
12 GITHUB_CLIENT_ID=...
13 GITHUB_CLIENT_SECRET=...
14 '';
15 type = "multiline";
16 };
17 };
18
19 # Zitadel (id.lassul.us) OIDC login, offered alongside GitHub, open to every
20 # registered user. zitadel-reconcile creates the app and writes its client
21 # id/secret into the env file below.
22 lass.zitadel.projects.pad = {
23 access = "public";
24 apps.hedgedoc = {
25 redirectUris = [ "https://pad.lassul.us/auth/oauth2/callback" ];
26 # HedgeDoc sends the secret in the token request body.
27 authMethod = "post";
28 envFile = {
29 owner = "hedgedoc";
30 clientIdVariable = "CMD_OAUTH2_CLIENT_ID";
31 clientSecretVariable = "CMD_OAUTH2_CLIENT_SECRET";
32 };
33 };
34 };
35 services.hedgedoc.settings.oauth2 = {
36 providerName = "lassul.us ID";
37 authorizationURL = "https://id.lassul.us/oauth/v2/authorize";
38 tokenURL = "https://id.lassul.us/oauth/v2/token";
39 userProfileURL = "https://id.lassul.us/oidc/v1/userinfo";
40 scope = "openid email profile";
41 userProfileUsernameAttr = "preferred_username";
42 userProfileDisplayNameAttr = "name";
43 userProfileEmailAttr = "email";
44 };
45
46 # GitHub session-secret env comes from module.nix; append both external-auth
47 # env files here (systemd merges the EnvironmentFile lists).
48 systemd.services.hedgedoc = {
49 wants = [ "zitadel-reconcile.service" ];
50 after = [ "zitadel-reconcile.service" ];
51 serviceConfig.EnvironmentFile = [
52 config.clan.core.vars.generators.hedgedoc-github-auth.files."hedgedoc.env".path
53 config.lass.zitadel.projects.pad.apps.hedgedoc.envFile.path
54 ];
55 };
56}