Updated authelia : still not in prod

modules/authelia/authelia-config.nix

@@ -1,16 +1,21 @@
+# Taken from 'config.template.yml' for Authelia v4.32.2.
+# Update along with 'pkgs/authelia.nix'.
+
+{ cfg }:
+''
+server:
   host: 0.0.0.0
   port: 9091
-server:
   read_buffer_size: 4096
   write_buffer_size: 4096
   path: "authelia"
-log_level: debug
+log.level: debug
 jwt_secret: somethingsomethingrandomrecret
-default_redirection_url: https://auth.julienmalka.me
+default_redirection_url: https://autheliafailed.julienmalka.me
 authentication_backend:
   disable_reset_password: false
   file:
-    path: /config/users_database.yml
+    path: ${./config/users.yml}
     password:
       algorithm: argon2id
       iterations: 1
@@ -18,19 +23,24 @@ authentication_backend:
       salt_length: 16
       memory: 512
       parallelism: 8
+      
 access_control:
   default_policy: deny
   rules:
     - domain:
-      - series.julienmalka.me
+        - "auth.julienmalka.me"
+      policy: bypass
+    - domain:
+        - "series.julienmalka.me"
       policy: one_factor
+ 
 session:
   name: authelia_session
   secret: somerandomsecret
   expiration: 1h
   inactivity: 5m
   remember_me_duration: 1M
-  domain: series.julienmalka.me
+  domain: julienmalka.me
 regulation:
   max_retries: 3
   find_time: 2m
@@ -38,8 +48,10 @@ regulation:
 storage:
   encryption_key: a_very_important_secret
   local:
-    path: /config/db.sqlite3
+    path: /var/lib/authelia/storage.db
 notifier:
   disable_startup_check: false
   filesystem:
-    filename: /config/notification.txt
+    filename: /var/lib/authelia/notification.txt
+''
+

modules/authelia/default.nix

@@ -1,6 +1,8 @@
 { pkgs, lib, config, ... }:
 with lib; let
   cfg = config.luj.authelia;
+  autheliaConfig = pkgs.writeText "authelia-config.yml"
+    (import ./authelia-config.nix { inherit cfg; });
 in
 {
   options.luj.authelia = {
@@ -8,32 +10,46 @@ in
   };
   config = mkIf cfg.enable {
 
-    virtualisation.docker.enable = true;
-    virtualisation.oci-containers.containers."authelia" = {
-      image = "authelia/authelia";
-      environment = {
-        "TZ" = "Europe/Paris";
-      };
-      volumes = [
-        "/srv/authelia:/config/"
-      ];
+    systemd = {
+      services.authelia = {
 
-      ports = [ "9091:9091" ];
+
+        serviceConfig = {
+          User = "authelia";
+
+          StateDirectory = "authelia";
+          RuntimeDirectory = "authelia";
+          StateDirectoryMode = "0700";
+          RuntimeDirectoryMode = "0700";
 
         };
 
-    services.nginx.appendHttpConfig = ''
-        server {
-            server_name auth.julienmalka.me;
-            listen 80;
-            return 301 https://$server_name$request_uri;
-        }
+        script = ''
+          exec ${pkgs.authelia}/bin/authelia --config ${autheliaConfig}  
+        '';
+      };
 
-        server {
-            server_name auth.julienmalka.me;
-            listen 443 ssl http2;
+    };
 
-            location / {
+    users = {
+      users.authelia = {
+        group = "authelia";
+        isSystemUser = true;
+      };
+
+      groups.authelia = {
+        members = [ "nginx" ];
+      };
+    };
+
+
+
+
+    services.nginx.virtualHosts."auth.julienmalka.me" = {
+      enableACME = true;
+      forceSSL = true;
+      locations."/" = {
+        extraConfig = ''
           set $upstream_authelia http://127.0.0.1:9091;
           proxy_pass $upstream_authelia;
 
@@ -70,10 +86,10 @@ in
           set_real_ip_from fc00::/7;
           real_ip_header X-Forwarded-For;
           real_ip_recursive on;
-            }
-        }
-      '';
 
+        '';
+      };
+    };
 
   };
 }