Updated authelia : still not in prod

modules/authelia/authelia-config.nix

@@ -1,16 +1,21 @@
-host: 0.0.0.0
+# Taken from 'config.template.yml' for Authelia v4.32.2.
-port: 9091
+# Update along with 'pkgs/authelia.nix'.
+
+{ cfg }:
+''
 server:
+  host: 0.0.0.0
+  port: 9091
   read_buffer_size: 4096
   write_buffer_size: 4096
   path: "authelia"
-log_level: debug
+log.level: debug
 jwt_secret: somethingsomethingrandomrecret
-default_redirection_url: https://auth.julienmalka.me
+default_redirection_url: https://autheliafailed.julienmalka.me
 authentication_backend:
   disable_reset_password: false
   file:
-    path: /config/users_database.yml
+    path: ${./config/users.yml}
     password:
       algorithm: argon2id
       iterations: 1
@@ -18,19 +23,24 @@ authentication_backend:
       salt_length: 16
       memory: 512
       parallelism: 8
+      
 access_control:
   default_policy: deny
   rules:
     - domain:
-      - series.julienmalka.me
+        - "auth.julienmalka.me"
+      policy: bypass
+    - domain:
+        - "series.julienmalka.me"
       policy: one_factor
+ 
 session:
   name: authelia_session
   secret: somerandomsecret
   expiration: 1h
   inactivity: 5m
   remember_me_duration: 1M
-  domain: series.julienmalka.me
+  domain: julienmalka.me
 regulation:
   max_retries: 3
   find_time: 2m
@@ -38,8 +48,10 @@ regulation:
 storage:
   encryption_key: a_very_important_secret
   local:
-    path: /config/db.sqlite3
+    path: /var/lib/authelia/storage.db
 notifier:
   disable_startup_check: false
   filesystem:
-    filename: /config/notification.txt
+    filename: /var/lib/authelia/notification.txt
+''
+

modules/authelia/default.nix

@@ -1,6 +1,8 @@
 { pkgs, lib, config, ... }:
 with lib; let
   cfg = config.luj.authelia;
+  autheliaConfig = pkgs.writeText "authelia-config.yml"
+    (import ./authelia-config.nix { inherit cfg; });
 in
 {
   options.luj.authelia = {
@@ -8,72 +10,86 @@ in
   };
   config = mkIf cfg.enable {
 
-    virtualisation.docker.enable = true;
+    systemd = {
-    virtualisation.oci-containers.containers."authelia" = {
+      services.authelia = {
-      image = "authelia/authelia";
-      environment = {
-        "TZ" = "Europe/Paris";
-      };
-      volumes = [
-        "/srv/authelia:/config/"
-      ];
 
-      ports = [ "9091:9091" ];
+
+        serviceConfig = {
+          User = "authelia";
+
+          StateDirectory = "authelia";
+          RuntimeDirectory = "authelia";
+          StateDirectoryMode = "0700";
+          RuntimeDirectoryMode = "0700";
+
+        };
+
+        script = ''
+          exec ${pkgs.authelia}/bin/authelia --config ${autheliaConfig}  
+        '';
+      };
 
     };
 
-    services.nginx.appendHttpConfig = ''
+    users = {
-        server {
+      users.authelia = {
-            server_name auth.julienmalka.me;
+        group = "authelia";
-            listen 80;
+        isSystemUser = true;
-            return 301 https://$server_name$request_uri;
+      };
-        }
 
-        server {
+      groups.authelia = {
-            server_name auth.julienmalka.me;
+        members = [ "nginx" ];
-            listen 443 ssl http2;
+      };
+    };
 
-            location / {
-                set $upstream_authelia http://127.0.0.1:9091;
-                proxy_pass $upstream_authelia;
 
-                client_body_buffer_size 128k;
 
-                #Timeout if the real server is dead
-                proxy_next_upstream error timeout invalid_header http_500 http_502     http_503;
 
-                # Advanced Proxy Config
+    services.nginx.virtualHosts."auth.julienmalka.me" = {
-                send_timeout 5m;
+      enableACME = true;
-                proxy_read_timeout 360;
+      forceSSL = true;
-                proxy_send_timeout 360;
+      locations."/" = {
-                proxy_connect_timeout 360;
+        extraConfig = ''
+          set $upstream_authelia http://127.0.0.1:9091;
+          proxy_pass $upstream_authelia;
 
-                # Basic Proxy Config
+          client_body_buffer_size 128k;
-                proxy_set_header Host $host;
-                proxy_set_header X-Real-IP $remote_addr;
-                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-                proxy_set_header X-Forwarded-Proto $scheme;
-                proxy_set_header X-Forwarded-Host $http_host;
-                proxy_set_header X-Forwarded-Uri $request_uri;
-                proxy_set_header X-Forwarded-Ssl on;
-                proxy_redirect  http://  $scheme://;
-                proxy_http_version 1.1;
-                proxy_set_header Connection "";
-                proxy_cache_bypass $cookie_session;
-                proxy_no_cache $cookie_session;
-                proxy_buffers 64 256k;
 
-                # If behind reverse proxy, forwards the correct IP
+          #Timeout if the real server is dead
-                set_real_ip_from 10.0.0.0/8;
+          proxy_next_upstream error timeout invalid_header http_500 http_502     http_503;
-                set_real_ip_from 172.0.0.0/8;
+
-                set_real_ip_from 192.168.0.0/16;
+          # Advanced Proxy Config
-                set_real_ip_from fc00::/7;
+          send_timeout 5m;
-                real_ip_header X-Forwarded-For;
+          proxy_read_timeout 360;
-                real_ip_recursive on;
+          proxy_send_timeout 360;
-            }
+          proxy_connect_timeout 360;
-        }
+
-      '';
+          # Basic Proxy Config
-    
+          proxy_set_header Host $host;
+          proxy_set_header X-Real-IP $remote_addr;
+          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+          proxy_set_header X-Forwarded-Proto $scheme;
+          proxy_set_header X-Forwarded-Host $http_host;
+          proxy_set_header X-Forwarded-Uri $request_uri;
+          proxy_set_header X-Forwarded-Ssl on;
+          proxy_redirect  http://  $scheme://;
+          proxy_http_version 1.1;
+          proxy_set_header Connection "";
+          proxy_cache_bypass $cookie_session;
+          proxy_no_cache $cookie_session;
+          proxy_buffers 64 256k;
+
+          # If behind reverse proxy, forwards the correct IP
+          set_real_ip_from 10.0.0.0/8;
+          set_real_ip_from 172.0.0.0/8;
+          set_real_ip_from 192.168.0.0/16;
+          set_real_ip_from fc00::/7;
+          real_ip_header X-Forwarded-For;
+          real_ip_recursive on;
+
+        '';
+      };
+    };
 
   };
 }