feat[work,server,client]: add opkssh

modules/home/common/gpg-agent.nix

@@ -37,9 +37,15 @@ in
     };
 
     # assure correct permissions
-    systemd.user.tmpfiles.rules = [
-      "d ${homeDir}/.gnupg 700 ${mainUser} users"
-    ];
+    systemd.user.tmpfiles.settings."30-gpgagent".rules = {
+      "${homeDir}/.gnupg" = {
+        d = {
+          group = "users";
+          user = mainUser;
+          mode = "0700";
+        };
+      };
+    };
   };
 
 }

modules/home/common/opkssh.nix

@@ -0,0 +1,30 @@
+{ lib, config, ... }:
+let
+  moduleName = "opkssh";
+in
+{
+  options.swarselmodules.${moduleName} = lib.mkEnableOption "enable ${moduleName} and settings";
+  config = lib.mkIf config.swarselmodules.${moduleName} {
+    programs.${moduleName} = {
+      enable = true;
+      settings = {
+        default_provider = "kanidm";
+
+        providers = [
+          {
+            alias = "kanidm";
+            issuer = "https://sso.swarsel.win/oauth2/openid/opkssh";
+            client_id = "opkssh";
+            scopes = "openid email profile";
+            redirect_uris = [
+              "http://localhost:3000/login-callback"
+              "http://localhost:10001/login-callback"
+              "http://localhost:11110/login-callback"
+            ];
+          }
+        ];
+      };
+    };
+  };
+
+}

modules/home/common/packages.nix

@@ -22,6 +22,9 @@
       simple-scan
       cura-appimage
 
+      # ssh login using idm
+      opkssh
+
       # dict
       (aspellWithDicts (dicts: with dicts; [ de en en-computers en-science ]))
 

modules/nixos/server/kanidm.nix

@@ -135,6 +135,7 @@ in
             "firefly.access" = { };
             "radicale.access" = { };
             "slink.access" = { };
+            "opkssh.access" = { };
           };
 
           inherit (config.repo.secrets.local) persons;
@@ -229,6 +230,23 @@ in
                   };
                 };
               };
+              opkssh = {
+                displayName = "OPKSSH";
+                originUrl = [
+                  "http://localhost:3000"
+                  "http://localhost:3000/login-callback"
+                  "http://localhost:10001/login-callback"
+                  "http://localhost:11110/login-callback"
+                ];
+                originLanding = "http://localhost:3000";
+                public = true;
+                enableLocalhostRedirects = true;
+                scopeMaps."opkssh.access" = [
+                  "openid"
+                  "email"
+                  "profile"
+                ];
+              };
               oauth2-proxy = {
                 displayName = "Oauth2-Proxy";
                 originUrl = "https://${oauth2ProxyDomain}/oauth2/callback";

modules/nixos/server/opkssh.nix

@@ -0,0 +1,38 @@
+{ lib, config, globals, ... }:
+let
+  serviceName = "opkssh";
+  serviceUser = "opksshuser";
+  serviceGroup = serviceUser;
+
+  kanidmDomain = globals.services.kanidm.domain;
+
+  inherit (config.swarselsystems) mainUser;
+  inherit (config.repo.secrets.local) persons;
+in
+{
+  options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
+  config = lib.mkIf config.swarselmodules.server.${serviceName} {
+
+    services.${serviceName} = {
+      enable = true;
+      user = serviceUser;
+      group = serviceGroup;
+      providers = {
+        kanidm = {
+          lifetime = "oidc";
+          issuer = "https://${kanidmDomain}/oauth2/openid/${serviceName}";
+          clientId = serviceName;
+        };
+      };
+      authorizations = [
+        {
+          user = mainUser;
+          principal = builtins.head persons.${mainUser}.mailAddresses;
+          inherit (config.services.opkssh.providers.kanidm) issuer;
+        }
+      ];
+    };
+
+  };
+
+}

modules/nixos/server/radicale.nix

@@ -76,9 +76,15 @@ in
       };
     };
 
-    systemd.tmpfiles.rules = [
-      "d ${cfg.settings.storage.filesystem_folder} 0750 ${serviceUser} ${serviceGroup} - -"
-    ];
+    systemd.tmpfiles.settings."10-radicale" = {
+      "${cfg.settings.storage.filesystem_folder}" = {
+        d = {
+          group = serviceGroup;
+          user = serviceUser;
+          mode = "0750";
+        };
+      };
+    };
 
     networking.firewall.allowedTCPPorts = [ servicePort ];
 

modules/nixos/server/shlink.nix

@@ -48,13 +48,25 @@ in
       ];
     };
 
-    systemd.tmpfiles.rules = [
-      "d ${serviceDir}/data 0750 1001 root - -"
-      "d ${serviceDir}/data/cache 0750 1001 root - -"
-      "d ${serviceDir}/data/locks 0750 1001 root - -"
-      "d ${serviceDir}/data/log 0750 1001 root - -"
-      "d ${serviceDir}/data/proxies 0750 1001 root - -"
-    ];
+    systemd.tmpfiles.settings."11-shlink" = builtins.listToAttrs (
+      map
+        (path: {
+          name = "${serviceDir}/${path}";
+          value = {
+            d = {
+              group = "root";
+              user = "1001";
+              mode = "0750";
+            };
+          };
+        }) [
+        "${serviceDir}/data"
+        "${serviceDir}/data/cache"
+        "${serviceDir}/data/locks"
+        "${serviceDir}/data/log"
+        "${serviceDir}/data/proxies"
+      ]
+    );
 
     networking.firewall.allowedTCPPorts = [ servicePort ];
 

modules/nixos/server/slink.nix

@@ -29,10 +29,22 @@ in
       ];
     };
 
-    systemd.tmpfiles.rules = [
-      "d ${serviceDir}/var/data 0750 root root - -"
-      "d ${serviceDir}/images   0750 root root - -"
-    ];
+    systemd.tmpfiles.settings."12-slink" = builtins.listToAttrs (
+      map
+        (path: {
+          name = "${serviceDir}/${path}";
+          value = {
+            d = {
+              group = "root";
+              user = "root";
+              mode = "0750";
+            };
+          };
+        }) [
+        "${serviceDir}/var/data"
+        "${serviceDir}/images"
+      ]
+    );
 
     networking.firewall.allowedTCPPorts = [ servicePort ];