This repository has no description
2configs/oauth2-proxy: add shared pocket-id forward-auth (auth.lassul.us)
author
lassulus
date
(Jul 25, 2026, 11:28 PM CEST)
commit
f9631600
f9631600bc185b5ac1e4d6a365fe4638ff40c6a5
parent
32a31d84
32a31d84eb292c44047a7ba6b71d5d4fd893e820
+80
+77
2configs/oauth2-proxy.nix
+77
2configs/oauth2-proxy.nix
···
1
+
{
2
+
config,
3
+
pkgs,
4
+
...
5
+
}:
6
+
let
7
+
authDomain = "auth.lassul.us";
8
+
in
9
+
{
10
+
# Shared forward-auth layer for services that lack a native OIDC client.
11
+
# A single oauth2-proxy instance authenticates against pocket-id
12
+
# (id.lassul.us). Gate any service behind pocket-id SSO with one line:
13
+
#
14
+
# services.oauth2-proxy.nginx.virtualHosts."foo.lassul.us" = { };
15
+
#
16
+
# One OIDC client + cookie domain .lassul.us yield a single shared login
17
+
# session across every *.lassul.us service (true single sign-on). Access is
18
+
# uniform (any authenticated pocket-id user); services that need per-service
19
+
# authorization should use their own pocket-id OIDC client directly instead.
20
+
#
21
+
# Register ONE OIDC client in pocket-id with redirect URL
22
+
# https://auth.lassul.us/oauth2/callback, then run `clan vars generate` to
23
+
# enter its client id/secret.
24
+
clan.core.vars.generators.oauth2-proxy-secrets = {
25
+
prompts.client_id = {
26
+
description = "pocket-id OIDC client ID for oauth2-proxy (redirect URL https://${authDomain}/oauth2/callback)";
27
+
type = "line";
28
+
persist = true;
29
+
};
30
+
prompts.client_secret = {
31
+
description = "pocket-id OIDC client secret for oauth2-proxy";
32
+
type = "hidden";
33
+
persist = true;
34
+
};
35
+
};
36
+
clan.core.vars.generators.oauth2-proxy-env = {
37
+
dependencies = [ "oauth2-proxy-secrets" ];
38
+
files."oauth2.env" = { };
39
+
runtimeInputs = [ pkgs.openssl ];
40
+
script = ''
41
+
cat > "$out/oauth2.env" << EOF
42
+
OAUTH2_PROXY_CLIENT_ID=$(cat $in/oauth2-proxy-secrets/client_id)
43
+
OAUTH2_PROXY_CLIENT_SECRET=$(cat $in/oauth2-proxy-secrets/client_secret)
44
+
OAUTH2_PROXY_COOKIE_SECRET=$(openssl rand -base64 24 | tr -d '\n')
45
+
EOF
46
+
'';
47
+
};
48
+
49
+
services.oauth2-proxy = {
50
+
enable = true;
51
+
provider = "oidc";
52
+
oidcIssuerUrl = "https://id.lassul.us";
53
+
keyFile = config.clan.core.vars.generators.oauth2-proxy-env.files."oauth2.env".path;
54
+
email.domains = [ "*" ]; # any authenticated pocket-id user
55
+
reverseProxy = true;
56
+
trustedProxyIP = [
57
+
"127.0.0.1/32"
58
+
"::1/128"
59
+
];
60
+
setXauthrequest = true;
61
+
cookie.secure = true;
62
+
cookie.domain = ".lassul.us";
63
+
redirectURL = "https://${authDomain}/oauth2/callback";
64
+
# pocket-id has no SMTP/email verification, so it emits email_verified=false;
65
+
# oauth2-proxy would otherwise reject the login.
66
+
extraConfig.whitelist-domain = ".lassul.us";
67
+
extraConfig.insecure-oidc-allow-unverified-email = true;
68
+
};
69
+
70
+
# Central vhost hosting the /oauth2/* endpoints (locations added by the
71
+
# oauth2-proxy nginx module); it only needs TLS here.
72
+
services.oauth2-proxy.nginx.domain = authDomain;
73
+
services.nginx.virtualHosts.${authDomain} = {
74
+
enableACME = true;
75
+
forceSSL = true;
76
+
};
77
+
}
+1
2configs/dns/lassul.us.zone
+1
2configs/dns/lassul.us.zone
+2
machines/neoprism/config.nix
+2
machines/neoprism/config.nix
···
101
101
102
102
# pocket-id SSO IdP (id.lassul.us)
103
103
../../2configs/pocket-id.nix
104
+
# shared oauth2-proxy forward-auth against pocket-id (auth.lassul.us)
105
+
../../2configs/oauth2-proxy.nix
104
106
];
105
107
106
108
# lassul.us shouldn't be the default vhost here (nginx.nix already sets one)