From fd47adf57091563fa5780b0c0b39557540cb19eb Mon Sep 17 00:00:00 2001 From: servius Date: Mon, 11 May 2026 10:43:25 +0530 Subject: [PATCH] feat: Use pre-configured consent mode for authelia --- nixos/tako/services/affine.nix | 2 ++ nixos/tako/services/excalidraw.nix | 2 ++ nixos/tako/services/gitea.nix | 2 ++ nixos/tako/services/headscale.nix | 2 ++ nixos/tako/services/immich.nix | 2 ++ nixos/tako/services/matrix/tuwunel.nix | 2 ++ nixos/tako/services/monitoring.nix | 2 ++ nixos/tako/services/nextcloud.nix | 2 ++ nixos/tako/services/paperless.nix | 2 ++ nixos/tako/services/vaultwarden.nix | 2 ++ 10 files changed, 20 insertions(+) diff --git a/nixos/tako/services/affine.nix b/nixos/tako/services/affine.nix index 4c35195..d7e6260 100644 --- a/nixos/tako/services/affine.nix +++ b/nixos/tako/services/affine.nix @@ -65,6 +65,8 @@ in { client_secret = ''{{ secret "${config.sops.secrets."authelia/oidc/affine/client_secret".path}" }}''; public = false; authorization_policy = "one_factor"; + consent_mode = "pre-configured"; + pre_configured_consent_duration = "1y"; require_pkce = false; redirect_uris = [ "https://${domain}/oauth/callback" diff --git a/nixos/tako/services/excalidraw.nix b/nixos/tako/services/excalidraw.nix index 6689d83..976153d 100644 --- a/nixos/tako/services/excalidraw.nix +++ b/nixos/tako/services/excalidraw.nix @@ -72,6 +72,8 @@ in { client_secret = ''{{ secret "${config.sops.secrets."authelia/oidc/excalidraw/client_secret".path}" }}''; public = false; authorization_policy = "one_factor"; + consent_mode = "pre-configured"; + pre_configured_consent_duration = "1y"; require_pkce = false; redirect_uris = [ "https://draw.${base_domain}/auth/callback" diff --git a/nixos/tako/services/gitea.nix b/nixos/tako/services/gitea.nix index a6d1f71..fc0a156 100644 --- a/nixos/tako/services/gitea.nix +++ b/nixos/tako/services/gitea.nix @@ -156,6 +156,8 @@ client_secret = ''{{ secret "${config.sops.secrets."authelia/oidc/gitea/client_secret".path}" }}''; public = false; authorization_policy = "one_factor"; + consent_mode = "pre-configured"; + pre_configured_consent_duration = "1y"; require_pkce = false; # pkce_challenge_method = "S256"; redirect_uris = [ diff --git a/nixos/tako/services/headscale.nix b/nixos/tako/services/headscale.nix index 6ec54c3..d403c50 100644 --- a/nixos/tako/services/headscale.nix +++ b/nixos/tako/services/headscale.nix @@ -59,6 +59,8 @@ client_secret = ''{{ secret "${config.sops.secrets.headscale-authelia.path}" }}''; public = false; authorization_policy = "one_factor"; + consent_mode = "pre-configured"; + pre_configured_consent_duration = "1y"; require_pkce = true; pkce_challenge_method = "S256"; redirect_uris = [ diff --git a/nixos/tako/services/immich.nix b/nixos/tako/services/immich.nix index dd6438e..a4c2646 100644 --- a/nixos/tako/services/immich.nix +++ b/nixos/tako/services/immich.nix @@ -98,6 +98,8 @@ client_secret = ''{{ secret "${config.sops.secrets."authelia/oidc/immich/client_secret".path}" }}''; public = false; authorization_policy = "one_factor"; + consent_mode = "pre-configured"; + pre_configured_consent_duration = "1y"; require_pkce = false; redirect_uris = [ "https://photos.darksailor.dev/auth/login" diff --git a/nixos/tako/services/matrix/tuwunel.nix b/nixos/tako/services/matrix/tuwunel.nix index a05b2dd..0f21159 100644 --- a/nixos/tako/services/matrix/tuwunel.nix +++ b/nixos/tako/services/matrix/tuwunel.nix @@ -169,6 +169,8 @@ in { client_secret = ''{{ secret "${config.sops.secrets."tuwunel/client_secret".path}" }}''; public = false; authorization_policy = "one_factor"; + consent_mode = "pre-configured"; + pre_configured_consent_duration = "1y"; require_pkce = false; # pkce_challenge_method = "S256"; redirect_uris = [ diff --git a/nixos/tako/services/monitoring.nix b/nixos/tako/services/monitoring.nix index e2a525b..5ac687c 100644 --- a/nixos/tako/services/monitoring.nix +++ b/nixos/tako/services/monitoring.nix @@ -168,6 +168,8 @@ in { client_secret = ''{{ secret "${config.sops.secrets."authelia/oidc/grafana/client_secret_digest".path}" }}''; public = false; authorization_policy = "one_factor"; + consent_mode = "pre-configured"; + pre_configured_consent_duration = "1y"; require_pkce = true; pkce_challenge_method = "S256"; redirect_uris = [ diff --git a/nixos/tako/services/nextcloud.nix b/nixos/tako/services/nextcloud.nix index 36ebedb..83d29a7 100644 --- a/nixos/tako/services/nextcloud.nix +++ b/nixos/tako/services/nextcloud.nix @@ -77,6 +77,8 @@ client_secret = ''{{ secret "${config.sops.secrets."authelia/oidc/nextcloud/client_secret".path}" }}''; public = false; authorization_policy = "one_factor"; + consent_mode = "pre-configured"; + pre_configured_consent_duration = "1y"; require_pkce = true; pkce_challenge_method = "S256"; redirect_uris = [ diff --git a/nixos/tako/services/paperless.nix b/nixos/tako/services/paperless.nix index 5bfdf1d..b9646fc 100644 --- a/nixos/tako/services/paperless.nix +++ b/nixos/tako/services/paperless.nix @@ -81,6 +81,8 @@ client_secret = ''{{ secret "${config.sops.secrets."authelia/oidc/paperless/client_secret".path}" }}''; public = false; authorization_policy = "one_factor"; + consent_mode = "pre-configured"; + pre_configured_consent_duration = "1y"; require_pkce = false; redirect_uris = [ "https://paperless.darksailor.dev/auth/login" diff --git a/nixos/tako/services/vaultwarden.nix b/nixos/tako/services/vaultwarden.nix index 6b959e4..f9924d0 100644 --- a/nixos/tako/services/vaultwarden.nix +++ b/nixos/tako/services/vaultwarden.nix @@ -68,6 +68,8 @@ in { client_secret = "{{ secret \"${config.sops.secrets."authelia/oidc/vaultwarden/client_secret".path}\" }}"; public = false; authorization_policy = "one_factor"; + consent_mode = "pre-configured"; + pre_configured_consent_duration = "1y"; require_pkce = true; pkce_challenge_method = "S256"; redirect_uris = ["https://pass.darksailor.dev/identity/connect/oidc-signin"]; -- 2.51.2