mirror of
https://github.com/Swarsel/.dotfiles.git
synced 2025-12-06 17:17:22 +01:00
36 lines
1 KiB
Nix
36 lines
1 KiB
Nix
{ lib, config, globals, confLib, ... }:
|
|
let
|
|
inherit (confLib.gen { name = "opkssh"; user = "opksshuser"; group = "opksshuser"; }) serviceName serviceUser serviceGroup;
|
|
|
|
kanidmDomain = globals.services.kanidm.domain;
|
|
|
|
inherit (config.swarselsystems) mainUser;
|
|
inherit (config.repo.secrets.local) persons;
|
|
in
|
|
{
|
|
options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
|
|
config = lib.mkIf config.swarselmodules.server.${serviceName} {
|
|
|
|
services.${serviceName} = {
|
|
enable = true;
|
|
user = serviceUser;
|
|
group = serviceGroup;
|
|
providers = {
|
|
kanidm = {
|
|
lifetime = "oidc";
|
|
issuer = "https://${kanidmDomain}/oauth2/openid/${serviceName}";
|
|
clientId = serviceName;
|
|
};
|
|
};
|
|
authorizations = [
|
|
{
|
|
user = mainUser;
|
|
principal = builtins.head persons.${mainUser}.mailAddresses;
|
|
inherit (config.services.opkssh.providers.kanidm) issuer;
|
|
}
|
|
];
|
|
};
|
|
|
|
};
|
|
|
|
}
|