This repository has no description
2configs/oauth2-proxy: remove (no gated services left); keep pocket-id for hedgedoc
author
lassulus
date
(Jul 25, 2026, 11:28 PM CEST)
commit
7f6f51a7
7f6f51a7459fe423a2ab0c0fcbbe267750ef5b5f
parent
71ff9a3d
71ff9a3df31b9aa448634fbe421c04e590fa7926
+4
-84
-77
2configs/oauth2-proxy.nix
-77
2configs/oauth2-proxy.nix
···
1
-
{
2
-
config,
3
-
pkgs,
4
-
...
5
-
}:
6
-
let
7
-
authDomain = "auth.lassul.us";
8
-
in
9
-
{
10
-
# Shared forward-auth layer for services that lack a native OIDC client.
11
-
# A single oauth2-proxy instance authenticates against pocket-id
12
-
# (id.lassul.us). Gate any service behind pocket-id SSO with one line:
13
-
#
14
-
# services.oauth2-proxy.nginx.virtualHosts."foo.lassul.us" = { };
15
-
#
16
-
# One OIDC client + cookie domain .lassul.us yield a single shared login
17
-
# session across every *.lassul.us service (true single sign-on). Access is
18
-
# uniform (any authenticated pocket-id user); services that need per-service
19
-
# authorization should use their own pocket-id OIDC client directly instead.
20
-
#
21
-
# Register ONE OIDC client in pocket-id with redirect URL
22
-
# https://auth.lassul.us/oauth2/callback, then run `clan vars generate` to
23
-
# enter its client id/secret.
24
-
clan.core.vars.generators.oauth2-proxy-secrets = {
25
-
prompts.client_id = {
26
-
description = "pocket-id OIDC client ID for oauth2-proxy (redirect URL https://${authDomain}/oauth2/callback)";
27
-
type = "line";
28
-
persist = true;
29
-
};
30
-
prompts.client_secret = {
31
-
description = "pocket-id OIDC client secret for oauth2-proxy";
32
-
type = "hidden";
33
-
persist = true;
34
-
};
35
-
};
36
-
clan.core.vars.generators.oauth2-proxy-env = {
37
-
dependencies = [ "oauth2-proxy-secrets" ];
38
-
files."oauth2.env" = { };
39
-
runtimeInputs = [ pkgs.openssl ];
40
-
script = ''
41
-
cat > "$out/oauth2.env" << EOF
42
-
OAUTH2_PROXY_CLIENT_ID=$(cat $in/oauth2-proxy-secrets/client_id)
43
-
OAUTH2_PROXY_CLIENT_SECRET=$(cat $in/oauth2-proxy-secrets/client_secret)
44
-
OAUTH2_PROXY_COOKIE_SECRET=$(openssl rand -base64 24 | tr -d '\n')
45
-
EOF
46
-
'';
47
-
};
48
-
49
-
services.oauth2-proxy = {
50
-
enable = true;
51
-
provider = "oidc";
52
-
oidcIssuerUrl = "https://id.lassul.us";
53
-
keyFile = config.clan.core.vars.generators.oauth2-proxy-env.files."oauth2.env".path;
54
-
email.domains = [ "*" ]; # any authenticated pocket-id user
55
-
reverseProxy = true;
56
-
trustedProxyIP = [
57
-
"127.0.0.1/32"
58
-
"::1/128"
59
-
];
60
-
setXauthrequest = true;
61
-
cookie.secure = true;
62
-
cookie.domain = ".lassul.us";
63
-
redirectURL = "https://${authDomain}/oauth2/callback";
64
-
# pocket-id has no SMTP/email verification, so it emits email_verified=false;
65
-
# oauth2-proxy would otherwise reject the login.
66
-
extraConfig.whitelist-domain = ".lassul.us";
67
-
extraConfig.insecure-oidc-allow-unverified-email = true;
68
-
};
69
-
70
-
# Central vhost hosting the /oauth2/* endpoints (locations added by the
71
-
# oauth2-proxy nginx module); it only needs TLS here.
72
-
services.oauth2-proxy.nginx.domain = authDomain;
73
-
services.nginx.virtualHosts.${authDomain} = {
74
-
enableACME = true;
75
-
forceSSL = true;
76
-
};
77
-
}
+3
-3
2configs/pocket-id.nix
+3
-3
2configs/pocket-id.nix
···
9
9
}:
10
10
{
11
11
# Pocket ID: passkey-based OIDC provider. Serves as the SSO IdP for other
12
-
# services on this host (e.g. the SilverBullet editing instance via
13
-
# oauth2-proxy). First-run bootstrap (admin user + OIDC client registration)
14
-
# happens through its web UI at https://id.lassul.us.
12
+
# services on this host (e.g. HedgeDoc login at pad.lassul.us). First-run
13
+
# bootstrap (admin user + OIDC client registration) happens through its web
14
+
# UI at https://id.lassul.us.
15
15
16
16
# v2 requires ENCRYPTION_KEY (>=16 bytes) to encrypt keys at rest.
17
17
clan.core.vars.generators.pocket-id = {
+1
-2
2configs/dns/lassul.us.zone
+1
-2
2configs/dns/lassul.us.zone
···
1
-
@ 3600 IN SOA lassul.us. ns1.lassul.us. 2026060706 7200 3600 86400 3600
1
+
@ 3600 IN SOA lassul.us. ns1.lassul.us. 2026060707 7200 3600 86400 3600
2
2
3
3
;;@ 3600 IN NS ns1
4
4
@ 3600 IN NS ns1
···
56
56
kanban IN CNAME neoprism
57
57
n2n IN CNAME neoprism
58
58
id IN CNAME neoprism
59
-
auth IN CNAME neoprism
60
59
61
60
;; Mail
62
61
@ IN MX 3 mail
-2
machines/neoprism/config.nix
-2
machines/neoprism/config.nix
···
101
101
102
102
# pocket-id SSO IdP (id.lassul.us)
103
103
../../2configs/pocket-id.nix
104
-
# shared oauth2-proxy forward-auth against pocket-id (auth.lassul.us)
105
-
../../2configs/oauth2-proxy.nix
106
104
];
107
105
108
106
# lassul.us shouldn't be the default vhost here (nginx.nix already sets one)