-This file has 62779 words spanning 16469 lines and was last revised on 2025-06-09 03:26:38 +0200. +This file has 63503 words spanning 16708 lines and was last revised on 2025-06-09 12:45:18 +0200.
@@ -763,7 +764,7 @@ This section defines my Emacs configuration. For a while, I considered to use ry
-My emacs is built using the emacs-overlay nix flake, which builds a bleeding edge emacs on wayland (pgtk) with utilities like treesitter support. By executing the below source block, the current build setting can be updated at any time, and you can see my most up-to-date build options (last updated: 2025-06-09 03:26:38 +0200) +My emacs is built using the emacs-overlay nix flake, which builds a bleeding edge emacs on wayland (pgtk) with utilities like treesitter support. By executing the below source block, the current build setting can be updated at any time, and you can see my most up-to-date build options (last updated: 2025-06-09 12:45:18 +0200)
@@ -2802,8 +2803,8 @@ This is just a demo host. It applies all the configuration found in the common p I also set theWLR_RENDERER_ALLOW_SOFTWARE=1 to allow this configuration to run in a virtualized environment. I also enable qemuGuest for a smoother experience when testing on QEMU.
-{ self, inputs, config, pkgs, lib, primaryUser, ... }:
@@ -2882,8 +2883,8 @@ in
_: @@ -2893,8 +2894,8 @@ in
_:
@@ -4671,8 +4672,8 @@ appimageTools.wrapType2 {
This programs simply runs ssh-keygen on the last host that I tried to ssh into. I need this frequently when working with cloud-init usually. @@ -4829,8 +4830,8 @@ in
{ lib, config, ... }:
@@ -4897,8 +4898,8 @@ in
{ lib, config, ... }:
@@ -4962,8 +4963,8 @@ in
{ lib, config, ... }:
@@ -4995,8 +4996,8 @@ in
{ lib, config, ... }:
@@ -5017,8 +5018,8 @@ in
{ lib, config, ... }:
@@ -5039,8 +5040,8 @@ in
{ lib, config, ... }:
@@ -5061,8 +5062,8 @@ in
{ lib, config, ... }:
@@ -5083,8 +5084,8 @@ in
{ lib, config, ... }:
@@ -5105,8 +5106,8 @@ in
{ lib, config, ... }:
@@ -5127,8 +5128,8 @@ in
{ lib, config, ... }:
@@ -5169,6 +5170,7 @@ in
emacs = lib.mkDefault true;
freshrss = lib.mkDefault true;
jenkins = lib.mkDefault false;
+ kanidm = lib.mkDefault true;
};
};
};
@@ -5180,8 +5182,8 @@ in
{ lib, config, ... }:
@@ -5238,8 +5240,8 @@ in
{ lib, config, ... }:
@@ -5296,8 +5298,8 @@ in
{ lib, config, ... }:
@@ -5349,8 +5351,8 @@ in
{ lib, config, ... }:
@@ -5370,8 +5372,8 @@ in
{ lib, config, ... }:
@@ -5391,8 +5393,8 @@ in
{ lib, config, ... }:
@@ -5413,8 +5415,8 @@ in
{ lib, config, ... }:
@@ -5432,8 +5434,8 @@ in
{ lib, config, ... }:
@@ -6966,8 +6968,8 @@ Most of the time I am using power-saver, however, it is good to be
{ lib, pkgs, config, ... }:
@@ -8673,7 +8675,9 @@ in
port = 3001;
openFirewall = true;
mediaLocation = "/Vault/Eternor/Immich";
- environment.IMMICH_MACHINE_LEARNING_URL = lib.mkForce "http://localhost:3003";
+ environment = {
+ IMMICH_MACHINE_LEARNING_URL = lib.mkForce "http://localhost:3003";
+ };
};
@@ -8715,7 +8719,7 @@ in
3.3.2.17. paperless
-{ lib, config, ... }:
+{ lib, pkgs, config, ... }:
{
options.swarselsystems.modules.server.paperless = lib.mkEnableOption "enable paperless on server";
config = lib.mkIf config.swarselsystems.modules.server.paperless {
@@ -8724,8 +8728,14 @@ in
extraGroups = [ "users" ];
};
-
- sops.secrets.paperless_admin = { owner = "paperless"; };
+ sops.secrets = {
+ paperless_admin = { owner = "paperless"; };
+ kanidm-paperless-client = {
+ owner = "paperless";
+ group = "paperless";
+ mode = "440";
+ };
+ };
services.paperless = {
enable = true;
@@ -8743,9 +8753,35 @@ in
invalidate_digital_signatures = true;
pdfa_image_compression = "lossless";
};
+ PAPERLESS_APPS = "allauth.socialaccount.providers.openid_connect";
+ PAPERLESS_SOCIALACCOUNT_PROVIDERS = builtins.toJSON {
+ openid_connect = {
+ OAUTH_PKCE_ENABLED = "True";
+ APPS = [
+ rec {
+ provider_id = "kanidm";
+ name = "Kanidm";
+ client_id = "paperless";
+ # secret will be added dynamically
+ #secret = "";
+ settings.server_url = "https://sso.swarsel.win/oauth2/openid/${client_id}/.well-known/openid-configuration";
+ }
+ ];
+ };
+ };
};
};
+ # Add secret to PAPERLESS_SOCIALACCOUNT_PROVIDERS
+ systemd.services.paperless-web.script = lib.mkBefore ''
+ oidcSecret=$(< ${config.sops.secrets.kanidm-paperless-client.path})
+ export PAPERLESS_SOCIALACCOUNT_PROVIDERS=$(
+ ${pkgs.jq}/bin/jq <<< "$PAPERLESS_SOCIALACCOUNT_PROVIDERS" \
+ --compact-output \
+ --arg oidcSecret "$oidcSecret" '.openid_connect.APPS.[0].secret = $oidcSecret'
+ )
+ '';
+
services.nginx = {
virtualHosts = {
"scan.swarsel.win" = {
@@ -9104,7 +9140,7 @@ in
-3.3.2.21. monitoring
+3.3.2.21. monitoring (Grafana)
This section exposes several metrics that I use to check the health of my server. I need to expand on the exporters section at some point, but for now I have everything I need.
@@ -9112,6 +9148,9 @@ This section exposes several metrics that I use to check the health of my server
{ self, lib, config, ... }:
+let
+ grafanaDomain = "status.swarsel.win";
+in
{
options.swarselsystems.modules.server.monitoring = lib.mkEnableOption "enable monitoring on server";
config = lib.mkIf config.swarselsystems.modules.server.monitoring {
@@ -9123,6 +9162,11 @@ This section exposes several metrics that I use to check the health of my server
prometheusadminpass = {
owner = "grafana";
};
+ kanidm-grafana-client = {
+ owner = "grafana";
+ group = "grafana";
+ mode = "440";
+ };
};
users = {
@@ -9148,7 +9192,7 @@ This section exposes several metrics that I use to check the health of my server
{
name = "prometheus";
type = "prometheus";
- url = "https://status.swarsel.win/prometheus";
+ url = "https://${grafanaDomain}/prometheus";
editable = false;
access = "proxy";
basicAuth = true;
@@ -9173,10 +9217,30 @@ This section exposes several metrics that I use to check the health of my server
settings = {
security.admin_password = "$__file{/run/secrets/grafanaadminpass}";
server = {
+ domain = grafanaDomain;
+ root_url = "https://${grafanaDomain}";
http_port = 3000;
- http_addr = "127.0.0.1";
+ http_addr = "0.0.0.0";
protocol = "http";
- domain = "status.swarsel.win";
+ };
+ "auth.generic_oauth" = {
+ enabled = true;
+ name = "Kanidm";
+ icon = "signin";
+ allow_sign_up = true;
+ #auto_login = true;
+ client_id = "grafana";
+ client_secret = "$__file{${config.sops.secrets.kanidm-grafana-client.path}}";
+ scopes = "openid email profile";
+ login_attribute_path = "preferred_username";
+ auth_url = "https://sso.swarsel.win/ui/oauth2";
+ token_url = "https://sso.swarsel.win/oauth2/token";
+ api_url = "https://sso.swarsel.win/oauth2/openid/grafana/userinfo";
+ use_pkce = true;
+ use_refresh_token = true;
+ # Allow mapping oauth2 roles to server admin
+ allow_assign_grafana_admin = true;
+ role_attribute_path = "contains(groups[*], 'server_admin') && 'GrafanaAdmin' || contains(groups[*], 'admin') && 'Admin' || contains(groups[*], 'editor') && 'Editor' || 'Viewer'";
};
};
};
@@ -9260,6 +9324,7 @@ This section exposes several metrics that I use to check the health of my server
locations = {
"/" = {
proxyPass = "http://localhost:3000";
+ proxyWebsockets = true;
extraConfig = ''
client_max_body_size 0;
'';
@@ -9516,6 +9581,184 @@ It serves both a Greader API at
+3.3.2.27. kanidm
+
+
+{ self, lib, pkgs, config, ... }:
+let
+ certsSopsFile = self + /secrets/certs/secrets.yaml;
+ kanidmDomain = "sso.swarsel.win";
+ kanidmPort = 8300;
+in
+{
+ options.swarselsystems.modules.server.kanidm = lib.mkEnableOption "enable kanidm on server";
+ config = lib.mkIf config.swarselsystems.modules.server.kanidm {
+
+ users.users.kanidm = {
+ group = "kanidm";
+ isSystemUser = true;
+ };
+
+ users.groups.kanidm = { };
+
+ sops.secrets = {
+ "kanidm-self-signed-crt" = { sopsFile = certsSopsFile; owner = "kanidm"; group = "kanidm"; mode = "440"; };
+ "kanidm-self-signed-key" = { sopsFile = certsSopsFile; owner = "kanidm"; group = "kanidm"; mode = "440"; };
+ "kanidm-admin-pw" = { owner = "kanidm"; group = "kanidm"; mode = "440"; };
+ "kanidm-idm-admin-pw" = { owner = "kanidm"; group = "kanidm"; mode = "440"; };
+ "kanidm-immich" = { owner = "kanidm"; group = "kanidm"; mode = "440"; };
+ "kanidm-paperless" = { owner = "kanidm"; group = "kanidm"; mode = "440"; };
+ "kanidm-forgejo" = { owner = "kanidm"; group = "kanidm"; mode = "440"; };
+ "kanidm-grafana" = { owner = "kanidm"; group = "kanidm"; mode = "440"; };
+ };
+
+ services.kanidm = {
+ package = pkgs.kanidmWithSecretProvisioning;
+ enableServer = true;
+ serverSettings = {
+ domain = kanidmDomain;
+ origin = "https://${kanidmDomain}";
+ tls_chain = config.sops.secrets.kanidm-self-signed-crt.path;
+ tls_key = config.sops.secrets.kanidm-self-signed-key.path;
+ bindaddress = "0.0.0.0:${toString kanidmPort}";
+ trust_x_forward_for = true;
+ };
+ enableClient = true;
+ clientSettings = {
+ uri = config.services.kanidm.serverSettings.origin;
+ verify_ca = true;
+ verify_hostnames = true;
+ };
+ provision = {
+ enable = true;
+ adminPasswordFile = config.sops.secrets.kanidm-admin-pw.path;
+ idmAdminPasswordFile = config.sops.secrets.kanidm-idm-admin-pw.path;
+ groups = {
+ "immich.access" = { };
+ "paperless.access" = { };
+ "forgejo.access" = { };
+ "forgejo.admins" = { };
+ "grafana.access" = { };
+ "grafana.editors" = { };
+ "grafana.admins" = { };
+ "grafana.server-admins" = { };
+ };
+ persons = {
+ swarsel = {
+ present = true;
+ mailAddresses = [ "leon@swarsel.win" ];
+ legalName = "Leon Schwarzäugl";
+ groups = [
+ "immich.access"
+ "paperless.access"
+ "grafana.access"
+ "forgejo.access"
+ ];
+ displayName = "Swarsel";
+ };
+ };
+ systems = {
+ oauth2 = {
+ immich = {
+ displayName = "Immich";
+ originUrl = [
+ "https://shots.swarsel.win/auth/login"
+ "https://shots.swarsel.win/user-settings"
+ "app.immich:///oauth-callback"
+ "https://shots.swarsel.win/api/oauth/mobile-redirect"
+ ];
+ originLanding = "https://shots.swarsel.win/";
+ basicSecretFile = config.sops.secrets.kanidm-immich.path;
+ preferShortUsername = true;
+ enableLegacyCrypto = true; # can use RS256 / HS256, not ES256
+ scopeMaps."immich.access" = [
+ "openid"
+ "email"
+ "profile"
+ ];
+ };
+ paperless = {
+ displayName = "Paperless";
+ originUrl = "https://scan.swarsel.win/accounts/oidc/kanidm/login/callback/";
+ originLanding = "https://scan.swarsel.win/";
+ basicSecretFile = config.sops.secrets.kanidm-paperless.path;
+ preferShortUsername = true;
+ scopeMaps."paperless.access" = [
+ "openid"
+ "email"
+ "profile"
+ ];
+ };
+ forgejo = {
+ displayName = "Forgejo";
+ originUrl = "https://swagit.swarsel.win/user/oauth2/kanidm/callback";
+ originLanding = "https://swagit.swarsel.win/";
+ basicSecretFile = config.sops.secrets.kanidm-forgejo.path;
+ scopeMaps."forgejo.access" = [
+ "openid"
+ "email"
+ "profile"
+ ];
+ # XXX: PKCE is currently not supported by gitea/forgejo,
+ # see https://github.com/go-gitea/gitea/issues/21376.
+ allowInsecureClientDisablePkce = true;
+ preferShortUsername = true;
+ claimMaps.groups = {
+ joinType = "array";
+ valuesByGroup."forgejo.admins" = [ "admin" ];
+ };
+ };
+ grafana = {
+ displayName = "Grafana";
+ originUrl = "https://status.swarsel.win/login/generic_oauth";
+ originLanding = "https://status.swarsel.win/";
+ basicSecretFile = config.sops.secrets.kanidm-grafana.path;
+ preferShortUsername = true;
+ scopeMaps."grafana.access" = [
+ "openid"
+ "email"
+ "profile"
+ ];
+ claimMaps.groups = {
+ joinType = "array";
+ valuesByGroup = {
+ "grafana.editors" = [ "editor" ];
+ "grafana.admins" = [ "admin" ];
+ "grafana.server-admins" = [ "server_admin" ];
+ };
+ };
+ };
+ };
+ };
+ };
+ };
+
+ systemd.services.kanidm.serviceConfig.RestartSec = "30";
+
+ services.nginx = {
+ virtualHosts = {
+ "sso.swarsel.win" = {
+ enableACME = true;
+ forceSSL = true;
+ acmeRoot = null;
+ locations = {
+ "/" = {
+ proxyPass = "https://localhost:${toString kanidmPort}";
+ };
+ };
+ extraConfig = ''
+ proxy_ssl_verify off;
+ '';
+ };
+ };
+ };
+ };
+}
+
+
+
+
3.3.3. Darwin
@@ -9728,8 +9971,8 @@ This smashes Atmosphere 1.3.2 on the switch, which is what I am currenty using.
This holds configuration that is specific to framework laptops. @@ -9767,8 +10010,8 @@ This holds configuration that is specific to framework laptops.
{ lib, config, ... }:
@@ -9784,8 +10027,8 @@ This holds configuration that is specific to framework laptops.
{ lib, config, ... }:
@@ -9807,8 +10050,8 @@ This holds configuration that is specific to framework laptops.
{ lib, config, ... }:
@@ -9839,8 +10082,8 @@ This holds configuration that is specific to framework laptops.
{ lib, config, ... }:
@@ -12788,8 +13031,8 @@ The `extraConfig` section here CANNOT be reindented. This has something to do wi
{ lib, config, ... }:
@@ -14038,8 +14281,8 @@ in
This holds configuration that is specific to framework laptops. @@ -17879,8 +18122,8 @@ autocmd DocStart vc-impimba-1.m.imp.ac.at/ui/webconsole mode ignore
@@ -18377,7 +18620,7 @@ sync USER HOST: