luj/snowfield
1
0
Fork 0
mirror of https://github.com/JulienMalka/snowfield.git synced 2025-06-08 18:09:06 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Updated authelia : still not in prod

Browse source
This commit is contained in:
Julien Malka 2022-03-10 15:22:54 +01:00
parent 2879423999
commit 90e2e3e9bb
No known key found for this signature in database
GPG key ID: 3C68E13964FEA07F
3 changed files with 92 additions and 64 deletions
Download patch file Download diff file Expand all files Collapse all files

126
modules/authelia/default.nix
View file

@ -1,6 +1,8 @@
{ pkgs, lib, config, ... }:
with lib; let
cfg = config.luj.authelia;
autheliaConfig = pkgs.writeText "authelia-config.yml"
(import ./authelia-config.nix { inherit cfg; });
in
{
options.luj.authelia = {
@ -8,72 +10,86 @@ in
};
config = mkIf cfg.enable {
virtualisation.docker.enable = true;
virtualisation.oci-containers.containers."authelia" = {
image = "authelia/authelia";
environment = {
"TZ" = "Europe/Paris";
};
volumes = [
"/srv/authelia:/config/"
];
systemd = {
services.authelia = {
ports = [ "9091:9091" ];
serviceConfig = {
User = "authelia";
StateDirectory = "authelia";
RuntimeDirectory = "authelia";
StateDirectoryMode = "0700";
RuntimeDirectoryMode = "0700";
};
script = ''
exec ${pkgs.authelia}/bin/authelia --config ${autheliaConfig}
'';
};
};
services.nginx.appendHttpConfig = ''
server {
server_name auth.julienmalka.me;
listen 80;
return 301 https://$server_name$request_uri;
}
users = {
users.authelia = {
group = "authelia";
isSystemUser = true;
};
server {
server_name auth.julienmalka.me;
listen 443 ssl http2;
groups.authelia = {
members = [ "nginx" ];
};
};
location / {
set $upstream_authelia http://127.0.0.1:9091;
proxy_pass $upstream_authelia;
client_body_buffer_size 128k;
#Timeout if the real server is dead
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
# Advanced Proxy Config
send_timeout 5m;
proxy_read_timeout 360;
proxy_send_timeout 360;
proxy_connect_timeout 360;
services.nginx.virtualHosts."auth.julienmalka.me" = {
enableACME = true;
forceSSL = true;
locations."/" = {
extraConfig = ''
set $upstream_authelia http://127.0.0.1:9091;
proxy_pass $upstream_authelia;
# Basic Proxy Config
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $http_host;
proxy_set_header X-Forwarded-Uri $request_uri;
proxy_set_header X-Forwarded-Ssl on;
proxy_redirect http:// $scheme://;
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_cache_bypass $cookie_session;
proxy_no_cache $cookie_session;
proxy_buffers 64 256k;
client_body_buffer_size 128k;
# If behind reverse proxy, forwards the correct IP
set_real_ip_from 10.0.0.0/8;
set_real_ip_from 172.0.0.0/8;
set_real_ip_from 192.168.0.0/16;
set_real_ip_from fc00::/7;
real_ip_header X-Forwarded-For;
real_ip_recursive on;
}
}
'';
#Timeout if the real server is dead
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
# Advanced Proxy Config
send_timeout 5m;
proxy_read_timeout 360;
proxy_send_timeout 360;
proxy_connect_timeout 360;
# Basic Proxy Config
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $http_host;
proxy_set_header X-Forwarded-Uri $request_uri;
proxy_set_header X-Forwarded-Ssl on;
proxy_redirect http:// $scheme://;
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_cache_bypass $cookie_session;
proxy_no_cache $cookie_session;
proxy_buffers 64 256k;
# If behind reverse proxy, forwards the correct IP
set_real_ip_from 10.0.0.0/8;
set_real_ip_from 172.0.0.0/8;
set_real_ip_from 192.168.0.0/16;
set_real_ip_from fc00::/7;
real_ip_header X-Forwarded-For;
real_ip_recursive on;
'';
};
};
};
}