swarsel/.dotfiles
1
0
Fork 0
mirror of https://github.com/Swarsel/.dotfiles.git synced 2025-12-06 00:57:22 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat: add kanidm module

Browse source
This commit is contained in:
Leon Schwarzäugl 2025-06-09 05:02:01 +02:00
parent 616522bfa6
commit f87164088f
Signed by: swarsel
GPG key ID: 26A54C31F2A4FD84
9 changed files with 854 additions and 130 deletions
Download patch file Download diff file Expand all files Collapse all files

38
modules/nixos/server/paperless.nix
View file

@ -1,4 +1,4 @@
{ lib, config, ... }:
{ lib, pkgs, config, ... }:
{
options.swarselsystems.modules.server.paperless = lib.mkEnableOption "enable paperless on server";
config = lib.mkIf config.swarselsystems.modules.server.paperless {
@ -7,8 +7,14 @@
extraGroups = [ "users" ];
};
sops.secrets.paperless_admin = { owner = "paperless"; };
sops.secrets = {
paperless_admin = { owner = "paperless"; };
kanidm-paperless-client = {
owner = "paperless";
group = "paperless";
mode = "440";
};
};
services.paperless = {
enable = true;
@ -26,9 +32,35 @@
invalidate_digital_signatures = true;
pdfa_image_compression = "lossless";
};
PAPERLESS_APPS = "allauth.socialaccount.providers.openid_connect";
PAPERLESS_SOCIALACCOUNT_PROVIDERS = builtins.toJSON {
openid_connect = {
OAUTH_PKCE_ENABLED = "True";
APPS = [
rec {
provider_id = "kanidm";
name = "Kanidm";
client_id = "paperless";
# secret will be added dynamically
#secret = "";
settings.server_url = "https://sso.swarsel.win/oauth2/openid/${client_id}/.well-known/openid-configuration";
}
];
};
};
};
};
# Add secret to PAPERLESS_SOCIALACCOUNT_PROVIDERS
systemd.services.paperless-web.script = lib.mkBefore ''
oidcSecret=$(< ${config.sops.secrets.kanidm-paperless-client.path})
export PAPERLESS_SOCIALACCOUNT_PROVIDERS=$(
${pkgs.jq}/bin/jq <<< "$PAPERLESS_SOCIALACCOUNT_PROVIDERS" \
--compact-output \
--arg oidcSecret "$oidcSecret" '.openid_connect.APPS.[0].secret = $oidcSecret'
)
'';
services.nginx = {
virtualHosts = {
"scan.swarsel.win" = {