This repository has no description
2.0 kB
54 lines
1{ config, ... }:
2{
3 imports = [ ./module.nix ];
4 clan.hedgedoc.domain = "pad.lassul.us";
5
6 # GitHub login (https://github.com/settings/applications/2352617)
7 clan.core.vars.generators.hedgedoc-github-auth = {
8 files."hedgedoc.env" = { };
9 prompts."hedgedoc.env" = {
10 description = ''
11 goto https://github.com/settings/applications/2352617 and paste the data in the following format:
12 GITHUB_CLIENT_ID=...
13 GITHUB_CLIENT_SECRET=...
14 '';
15 type = "multiline";
16 };
17 };
18
19 # pocket-id (id.lassul.us) OIDC login, offered alongside GitHub. The endpoints
20 # are public config; only the client id/secret are secret (clan vars below).
21 # Register the client in pocket-id with callback URL:
22 # https://pad.lassul.us/auth/oauth2/callback
23 services.hedgedoc.settings.oauth2 = {
24 providerName = "pocket-id";
25 authorizationURL = "https://id.lassul.us/authorize";
26 tokenURL = "https://id.lassul.us/api/oidc/token";
27 userProfileURL = "https://id.lassul.us/api/oidc/userinfo";
28 scope = "openid email profile";
29 userProfileUsernameAttr = "preferred_username";
30 userProfileDisplayNameAttr = "name";
31 userProfileEmailAttr = "email";
32 };
33 clan.core.vars.generators.hedgedoc-pocket-id = {
34 files."pocket-id.env" = { };
35 prompts."pocket-id.env" = {
36 description = ''
37 Register an OIDC client in pocket-id (https://id.lassul.us):
38 name: HedgeDoc
39 callback URL: https://pad.lassul.us/auth/oauth2/callback
40 Generate a client secret, then paste:
41 CMD_OAUTH2_CLIENT_ID=...
42 CMD_OAUTH2_CLIENT_SECRET=...
43 '';
44 type = "multiline";
45 };
46 };
47
48 # GitHub session-secret env comes from module.nix; append both external-auth
49 # env files here (systemd merges the EnvironmentFile lists).
50 systemd.services.hedgedoc.serviceConfig.EnvironmentFile = [
51 config.clan.core.vars.generators.hedgedoc-github-auth.files."hedgedoc.env".path
52 config.clan.core.vars.generators.hedgedoc-pocket-id.files."pocket-id.env".path
53 ];
54}