From 9eeef02edecea2706dd1a20638976e6a818e6ac9 Mon Sep 17 00:00:00 2001 From: dawn <90008@gaze.systems> Date: Tue, 20 Jan 2026 04:54:08 +0300 Subject: [PATCH] atlogin experiments --- dns/dnsconfig.js | 4 +- .../dzwonek/modules/headscale.nix/default.nix | 10 +-- hosts/dzwonek/modules/tailscale.nix | 4 +- hosts/trimounts/modules/atlogin.disabled | 77 ++++++++++++++++++ pkgs-set/pkgs/atlogin.nix | 25 ++++++ secrets/atloginCfg.age | Bin 0 -> 1104 bytes secrets/headscaleOidcSecret.age | 30 +++---- secrets/secrets.nix | 1 + 8 files changed, 127 insertions(+), 24 deletions(-) create mode 100644 hosts/trimounts/modules/atlogin.disabled create mode 100644 pkgs-set/pkgs/atlogin.nix create mode 100644 secrets/atloginCfg.age diff --git a/dns/dnsconfig.js b/dns/dnsconfig.js index 163c65d..22e2a46 100644 --- a/dns/dnsconfig.js +++ b/dns/dnsconfig.js @@ -55,7 +55,7 @@ D( DnsProvider(DSP_PRIMARY), TRIMOUNTS( [ - "@", "pmart", "dash", "id", + "@", "pmart", "dash", "knot", "spindle", "guestbook", ], @@ -124,7 +124,7 @@ D( "ptr.pet", REG_NONE, DnsProvider(DSP_PRIMARY), - TRIMOUNTS(["@", "tunes", "corpus", "x"], CF_PROXY_OFF), + TRIMOUNTS(["@", "tunes", "corpus", "x", "id"], CF_PROXY_OFF), DZWONEK(["nucleus", "trill", "dysnomia"], CF_PROXY_OFF), TXT("_kicya", "3b11cb74243eea1fc84e62ffefd7e246279c2f203e1cae42e19d0454dc8d2172"), // atproto diff --git a/hosts/dzwonek/modules/headscale.nix/default.nix b/hosts/dzwonek/modules/headscale.nix/default.nix index 01da79d..5b1b359 100644 --- a/hosts/dzwonek/modules/headscale.nix/default.nix +++ b/hosts/dzwonek/modules/headscale.nix/default.nix @@ -73,11 +73,11 @@ in ]; }; oidc = { - issuer = "https://id.gaze.systems"; - client_id = "ba2c2024-f75f-49a2-a156-8593becfba28"; - client_secret_path = config.age.secrets.headscaleOidcSecret.path; - pkce.enabled = true; - only_start_if_oidc_is_available = true; + # issuer = "https://atlogin.net"; + # client_id = "ptr-pet-at-atlogin-net-headscale-v1"; + # client_secret_path = config.age.secrets.headscaleOidcSecret.path; + # pkce.enabled = true; + only_start_if_oidc_is_available = false; }; }; }; diff --git a/hosts/dzwonek/modules/tailscale.nix b/hosts/dzwonek/modules/tailscale.nix index 1547462..a5f43d4 100644 --- a/hosts/dzwonek/modules/tailscale.nix +++ b/hosts/dzwonek/modules/tailscale.nix @@ -1,4 +1,4 @@ -{ config, ... }: +{ lib, config, ... }: { imports = [ ../../../modules/network/tailscale.nix ]; @@ -7,6 +7,6 @@ services.tailscale = { extraSetFlags = [ "--advertise-exit-node" ]; - useRoutingFeatures = "both"; + useRoutingFeatures = lib.mkForce "both"; }; } diff --git a/hosts/trimounts/modules/atlogin.disabled b/hosts/trimounts/modules/atlogin.disabled new file mode 100644 index 0000000..fcbca89 --- /dev/null +++ b/hosts/trimounts/modules/atlogin.disabled @@ -0,0 +1,77 @@ +{ config, pkgs, terra, ... }: +let + rootDomain = "ptr.pet"; + domain = "id.${rootDomain}"; + + cfg = { + host = "127.0.0.1"; + port = 9411; + stateDir = "/var/lib/atlogin"; + }; +in { + environment.systemPackages = [( + pkgs.writeShellScriptBin "atlogin" ''${terra.atlogin}/bin/atlogin -state-dir=${cfg.stateDir} "$@"'' + )]; + + # ensure state directory exists + systemd.tmpfiles.rules = [ + "d ${cfg.stateDir} 0700 atlogin atlogin -" + ]; + + users.users.atlogin = { + isSystemUser = true; + group = "atlogin"; + home = cfg.stateDir; + }; + users.groups.atlogin = {}; + + age.secrets.atloginCfg = { + file = ../../../secrets/atloginCfg.age; + owner = "atlogin"; + mode = "0600"; + }; + + # systemd service + systemd.services.atlogin = { + description = "atlogin oidc identity provider"; + wantedBy = ["multi-user.target"]; + after = ["network.target"]; + + preStart = '' + ${pkgs.coreutils}/bin/cp -f ${config.age.secrets.atloginCfg.path} ${cfg.stateDir}/config.json + ''; + + serviceConfig = { + Type = "simple"; + User = "atlogin"; + Group = "atlogin"; + ExecStart = "${terra.atlogin}/bin/atlogin -state-dir=${cfg.stateDir}"; + Restart = "on-failure"; + RestartSec = "5s"; + # harden + NoNewPrivileges = true; + PrivateTmp = true; + ProtectSystem = "strict"; + ProtectHome = true; + ReadWritePaths = [cfg.stateDir]; + }; + }; + + security.acme.certs.${rootDomain}.extraDomainNames = [domain]; + services.nginx.virtualHosts.${domain} = { + useACMEHost = rootDomain; + forceSSL = true; + quic = true; + kTLS = true; + + locations."/" = { + proxyPass = "http://${cfg.host}:${toString cfg.port}"; + proxyWebsockets = true; + }; + + # webfinger endpoint helper (as mentioned in the code comments) + locations."/.well-known/webfinger" = { + proxyPass = "http://${cfg.host}:${toString cfg.port}/helpers/webfinger"; + }; + }; +} \ No newline at end of file diff --git a/pkgs-set/pkgs/atlogin.nix b/pkgs-set/pkgs/atlogin.nix new file mode 100644 index 0000000..eee094f --- /dev/null +++ b/pkgs-set/pkgs/atlogin.nix @@ -0,0 +1,25 @@ +{ + buildGoModule, + fetchFromGitHub, + ... +}: +let + rev = "943b11de2f5592a6680a826c67e763f292c664ff"; +in +buildGoModule { + pname = "atlogin"; + version = builtins.substring 0 8 rev; + + src = fetchFromGitHub { + owner = "apenwarr"; + repo = "atlogin"; + inherit rev; + hash = "sha256-E4B1zj3jYxVw9LKxLkJjNwa72UfrrkRJj4sxPnHhdsA="; + }; + + vendorHash = "sha256-bmoNRyzxIKZmz7hzDKhMSulYZ67PmqpnDzYxtTQhI0o="; + + subPackages = ["cmd/atlogin"]; + + ldflags = ["-s" "-w"]; +} \ No newline at end of file diff --git a/secrets/atloginCfg.age b/secrets/atloginCfg.age new file mode 100644 index 0000000000000000000000000000000000000000..4e59a8945f09c668347fc3db24451329c72301ec GIT binary patch literal 1104 zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!*`Do#{zOv)`wOy?>LGb_z6)-DNg z*Z0XU2~G1(Ni_}gNcYI}F)(qj3QaH1H8sdKH%?CrFi1=G4ym%p^D)WH^~%<-h%k3? z4)NqlatV8n2#WNmDsVGQObIN^FHSPA z2rDazC=T+;cPh`ZbaF4{@`)-7bF(lEF*P)ev~c!wOfmEIaL#wm_A0GRc6QEpcg=}N zb~P;X^VD{6HZpYc_BG4R2#a*ik2FdNO*Kr-ip3(Ju8WwD7BP(GKyf z$jOK*@h&e5adL5VPOEavO7Ssr42g8jNOLzX@GSQW3W)LzHT0~=i{h%RDl{?k^YV`{ zD=jR`D$4P8GBph?%?qu}aE{6-c6KZD2`P083XC$aa5M37b~H;2&i2xFF{w0g&U4XD z%P-)H&`&MOG|$a-D@;y|2#qq$P01_Db~DH_&+|_+u<-K?3pU6t$jfmwOsOg^E2%Uy ziSi6g&d5*ns;Ef!i?DR%GA%aqt4Inj56=k8v?$5Z)=o`zjYu>%a0@MUH%c@2Dl03G zD$0v6bqz`h(l&|mGuHPH^GFH|whSo94D&BD<}&ceGA;~>45|pswlp(zaWeJ~(9a3i zPjYj~_OlEvGbk)K4=*lHOZ0H92+B#x_s{nYDm3@Y^$iQOtjx_Z&*X9qFf+*YG_S}v zDt6L0^35+uEzeK)th5OCjmk~)Dl>A83Jy2(c62v2HS-U0O%Ach2@dvfDmAHciS#Ne zv^3`mcMCMg*H6pPclF9jD#&pz2nw|DsW1;Ha4$2<@=0{5Dk(}Wt8&v1^T_fpGSDtG z&oA*Tb}h*?_H$1SE=djJvPepDFADL@c1#b*c62wgNDOlg^e)KPFDNicObHB6GtcqN zE-v&n@=S|_rQ_5TBU4jDO9h|Az~r2Cg>+xf0#`FLPj7dZRO6g*{ zZ9mUoS4YRdjPR^7H!nj2E~nD)`~ox2k{s=Z$qWOS3#$I z=zGsIQhaB#4smXaznT5R*8TXey?yJ~R2$R@c28`K>zJ(VI_=EC<*#Sl_;UP~uh^DE z*)V;M=-2<6rY_id%~APim89q*?W20S^LI(=9$S$e(VBg!;nw5A9gzn13~MLMsuxk| zPFQ|*ZFtM(->ZN9-l)B$Rd9!r{{NR(OEPDisk$1os+C2Gsfxi;ZldN<*WVs>N6iYK ZrEUKDY_~L5xzef=f ssh-rsa Abmvag -iCAioy9OUeFw+o+gqWPf6lmUAt9XM5CfDYD343fGYdVSKi+8V8dJFVwaLEUd7hTl -XunScV4IJzm4Ka2F0ILnOxdsnxmqy8nmWYyAX84hn8Y9+oJxjUL0tVhQ5tp7Mjwk -VExB5OO3fi8ft7LDhAn8G0p9rzOMH+q2VsEq+yOcAREPcPJhbr8ggGiFtYMGOJHP -DNtcwPDUmdagm0FEJYXpwNrx2Dt5VT1cTVBNUhwwFK54khFAAvBJgTDXl/4QEQJt -2gTNkYgVQbeijBgLNSZK506hKUKCLBn2DWUT7+njiLbho3No1lcFs0ywOcMRF8Ym -qNmewkeWA0i2pIemeFUudhwBj2EoFAuS3fa2NP1fsGN03hQ2WyeSjsTnfu/9bb4Q -VtsPKRBPlStsvKY3yYug/UvoTnGosgDcWYadUc8YA7250TbIQGT3A6AP/lJ7io64 -26kQd7cPUIXxISUjqOwSlQYShqoEuUjTxad3rpa/G7W8ipFXQR7BdzVV1IZaYmWT -OgVheJ5A9TfHbYG87+7TAZnKjYdYZ53AlZGfdTWb4hAHJVqByZ3LBcH74yuElFQS -Og/3k2FPKrXHpFH09LhyM0ro3UPwHwpkMuKM/x+80HUZE0Ple+etSy1+umpDXlqN -UftNwoLc1mvp+I5Nkc2M2+hwCRC81kl9lYq6f31xp+0 --> ssh-ed25519 y5W/qA M8TkWQD89YNmflfSs86D1ago/yYM3B1ZG2/IHLkaYG4 -fb2gabcKsPzF8Njs7lz7P2S+7361CEoLGIJmRSNHJcM ---- zAZubmMLjvK/7icW5btyg3KKOvjvSYmInXLuhhXpm6s -���9M*@$�0�/����gI�Y�0�m�����e�b\YK�Ǩ���P����*X�V����(�=q \ No newline at end of file +Z2CkWLzk0uI9J+Hy8orxxmVO+ZQ9HbmbNl69LbZ9rdZqbXUX5hBaFiu/HrIYCPu7 +7SDTc1Q3qKSsKrNJ/zOLScBPmsvgg2It34nDRD+l171jSNezdOIN1EuWvQmOdFTw +K6dNW6AUJUJCNZC4GZLT98mkA4R30h2ROdonZlZTtXYu05eiuobVD2kxKgBTtWNY +VSa4UHO+8Y4+67foVebXMAXtF+2AYdmoxdQag2XRTDriFqxMSWWMEVDvH+54yxuZ +03bIaGrRWQgUWNUBR/teT7McQwgZkoBnUhcVl0jnGwyTz4YyPqPzRIZaF0lu+iC/ +uwIl16483BDD3jX+HQNlZUlfMWEuv6nUhSHJgdk5LJvSAKuZ/tQcsVGfzJ6P2nhk +A9SdFelIOU02Z4RzviFMu7gsxWROx8ftVIwm7UcDobUCpoeda8kmLZb2yp9bkAhc +s8k7YUv6Fw9/IwrQHI2bLs/AdnC5TvN0h4V4WhmSJdG+x7uOcr0Bf8Egg0wlkNR5 +Z1R4pGQcZmn21hO48mdTXQIPgdyjMILONSthvL2F754gzUXR0ItuW2vTPsUiQjDj +/pWxYn4J6fsLZulZO7hzrw+JpqQN/V6Ynn4Cai/XkNhoZnd6kOonRIvDMsL2UK62 +It8PtLVk2LiuMKki0rEjFhLpKsYC7cZA3g5RHiUuy2E +-> ssh-ed25519 y5W/qA IKHTo5/MwhVyr55ap+NYQNgONiJ0mLl8eoHsWP7DliU +BuqdJ4fPg7Jy7DtFR0pjLY9RE5sCtzAmFLESJj5dBig +--- K24esprRHelD1k6vw11psKaNf9jUOEU0uMgK4dAkpYE +gCR�N"����?��`�1q������uH������vu���1@-�v1��� \ No newline at end of file diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 6cebf78..6ba8351 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -33,4 +33,5 @@ in "atfileCfg.age".publicKeys = [yusdacra]; "ziplineCfg.age".publicKeys = [yusdacra trimounts]; "callieMusic.age".publicKeys = [yusdacra trimounts]; + "atloginCfg.age".publicKeys = [yusdacra trimounts]; } -- 2.51.2