From 81759c7fe6b898ba18d60f8eddb4e7006e893ef2 Mon Sep 17 00:00:00 2001 From: dish Date: Sun, 7 Jun 2026 15:44:17 -0400 Subject: [PATCH] [marvin] add voidauth and switch forgejo to it --- hosts/default.nix | 1 + hosts/marvin/default.nix | 2 +- .../{pocket-id.nix => auth-provider.nix} | 42 ++++++++++++++++--- hosts/marvin/services/git.nix | 9 ++++ .../services/secrets/forgejo/oidc-secret.age | 8 ++++ hosts/marvin/services/secrets/secrets.nix | 4 +- .../services/secrets/voidauth-secrets.age | 7 ++++ nixosModules/services/voidauth/default.nix | 1 - 8 files changed, 66 insertions(+), 8 deletions(-) rename hosts/marvin/services/{pocket-id.nix => auth-provider.nix} (50%) create mode 100644 hosts/marvin/services/secrets/forgejo/oidc-secret.age create mode 100644 hosts/marvin/services/secrets/voidauth-secrets.age diff --git a/hosts/default.nix b/hosts/default.nix index a22c752d..e475784c 100644 --- a/hosts/default.nix +++ b/hosts/default.nix @@ -34,6 +34,7 @@ inputs.tangled.nixosModules.knot inputs.tangled.nixosModules.spindle inputs.tsnsrv.nixosModules.default + inputs.self.nixosModules.voidauth ]; }; prefect = { diff --git a/hosts/marvin/default.nix b/hosts/marvin/default.nix index c0fbb22a..72ca4e50 100644 --- a/hosts/marvin/default.nix +++ b/hosts/marvin/default.nix @@ -10,6 +10,7 @@ # Running Services # keep-sorted start ./services/anubis.nix + ./services/auth-provider.nix ./services/avahi.nix ./services/bots.nix ./services/databases.nix @@ -28,7 +29,6 @@ ./services/paperless.nix ./services/pinchflat.nix ./services/planka.nix - ./services/pocket-id.nix ./services/podman.nix ./services/prometheus.nix ./services/scrutiny.nix diff --git a/hosts/marvin/services/pocket-id.nix b/hosts/marvin/services/auth-provider.nix similarity index 50% rename from hosts/marvin/services/pocket-id.nix rename to hosts/marvin/services/auth-provider.nix index bad8f0ca..9a61424a 100644 --- a/hosts/marvin/services/pocket-id.nix +++ b/hosts/marvin/services/auth-provider.nix @@ -5,10 +5,35 @@ }: let d = self.lib.data.services.pocket-id; + sec = config.age.secrets; in { - services.pocket-id = { + dish.voidauth = { enable = true; + database = { + type = "postgres"; + createLocally = true; + }; + secretsFile = sec.voidauth-secrets.path; + declaredClients = self.data.oidcClients; + settings = { + APP_URL = "https://${d.extUrl}"; + APP_PORT = toString d.port; + SIGNUP = "false"; + # Customization + APP_TITLE = "dishNet Auth"; + APP_FONT = "Inter, sans-serif"; + CONTACT_EMAIL = "webmistress@pyrox.dev"; + ADMIN_EMAILS = "daily"; + # SMTP + SMTP_HOST = "smtp.purelymail.com"; + SMTP_PORT = "465"; + SMTP_SECURE = "true"; + SMTP_USER = "auth@pyrox.dev"; + }; + }; + services.pocket-id = { + enable = false; environmentFile = config.age.secrets.pocket-id-secrets.path; settings = { APP_URL = "https://${d.extUrl}"; @@ -33,10 +58,17 @@ in }; }; - age.secrets.pocket-id-secrets = { - file = ./secrets/pocket-id-secrets.age; - owner = "pocket-id"; - group = "pocket-id"; + age.secrets = { + pocket-id-secrets = { + file = ./secrets/pocket-id-secrets.age; + owner = "pocket-id"; + group = "pocket-id"; + }; + voidauth-secrets = { + file = ./secrets/voidauth-secrets.age; + owner = "voidauth"; + group = "voidauth"; + }; }; services.anubis.instances = { pocket-id = { diff --git a/hosts/marvin/services/git.nix b/hosts/marvin/services/git.nix index ea985de6..30776718 100644 --- a/hosts/marvin/services/git.nix +++ b/hosts/marvin/services/git.nix @@ -12,6 +12,15 @@ let d = self.lib.data.services.git; in { + dish.oidcClients = [ + { + clientId = "dishNet-git"; + displayName = "dishNet Git"; + homepageUrl = "https://${d.extUrl}"; + clientSecretFile = ./secrets/forgejo/oidc-secret.age; + redirectUrls = [ "https://git.pyrox.dev/user/oauth2/dishNet/callback" ]; + } + ]; catppuccin.forgejo.enable = true; py.services.forgejo-runner = { enable = true; diff --git a/hosts/marvin/services/secrets/forgejo/oidc-secret.age b/hosts/marvin/services/secrets/forgejo/oidc-secret.age new file mode 100644 index 00000000..59ef92ce --- /dev/null +++ b/hosts/marvin/services/secrets/forgejo/oidc-secret.age @@ -0,0 +1,8 @@ +age-encryption.org/v1 +-> mlkem768x25519 Ud/rNb38cgM+PR/VXMKyX++7B68CyC2LIlf+N7OXxkgiQ7g6YeESGK9yVQibFpbPj4vujKv+Ger30nTyL5IMaLnHChb1XfhPacpqf7BRxHch+psJ3ucqzKv33RkQiBvBpFWg6UMzNvdqEZK81qvFcLNq4hXraK2QLQGIEwpvzz4R1P4ZdSBD6Hggp2sw0yO3WJsw4Qqpas7wRYSJlOIp9zi2xCkgkpeG7v/J2Osh8Z4/ag1dz+rHU6Vtck8WKv23uuwdgsvUbsRsFKHDQ8QC57eZ1XezyfQNvM6FEff9/DHyglZRYPclNSVzHxxcjKzwjUAK2c7r1HDgzGDr/+evqznQChfNQH97hSweAyZoFskbOj10YC5+G9z0WCc8Hkpd2kyNNZl5PhXvpRl7iSgoVohLtlQe46LgunAVpejFGTx4MLzeHdEZFigdMi8srnzymQ6ZMwrxefqr9a1HvcexKXl3vfn/Wss8qhZjuTrmgijBlN/KlmBBb8OnTyja32lf4/AYR9eMddgfq+XQkYAX5a0UzF/6N/uEbPZGIJEio2yY14vgFiaoeXc8gorkxrsbRst0lqcj747pwOILensDpgWNhYdk2KFG7BAXjKnhpD3aY+RM9M3Gzfl2xSeYIHnwEcqfHYCSo7NaNzD6BBeC3ibTXSbFZKFQuwTqJOrNE9yq2rnGQ44hwJU8h6TfXeJgU97SIJaYN1ykn1x1B2oY9Hy8Yu0axQPj1eo+NLj+2y8SikseGOobMMzph5ebMhhOtzlvuaMJVM7XDVGxD2jMi4NUt6wZzecgRvZR3YP1AMiNtq3NEKXMta27HIWOdky7b4kw9qMLvsiiYmMQSP5J4nsaXVBCRho8XlmpF/Pg2xKbEcyrvdNujQEFm22GrH+6mI0UedaNxMTSzReRUjUAtKqRk3HP1mvsnf/vU9X4RlBI/VAWJVqb5XlkpLvd8/w/m8+sNRPwdiwiok+LWulB+BJwaGIp+PrWWk0G8uKtJou9Vd/yaZezzEuO2xNIGnGN9Q1nEHaiQ5grq865AbJcJ22I59OW95SyJ+jpAOkEOy7kCZ6BpLS+rJYzDiF4UTlIDfLQdmjeF9E71rwPU/ER0Uw6ke2UM0KubPKCGdvgTwAzYXtKawSXMDPTmg8Bn0AYcanXbq6UmDwRZUIOcM4V5CADZIiLR1dsjACWd1w99eqoeNqQvpR9Xhu0jS6DkApF4glCIDgxthy0n8D0O7hh27VVzz7bNDQRNI83JaY//erFIb4c9LVY664jZncXSq00vgctly9MOVp4wxBkvdVTeVsugwTnAuf34zcBf1LHbHvTumlwaAmtgcSoQ5ykvN+EjqEYY7eTTrqcWt/R4eBnjEuyMNS8UmRwfizfiQeOw7tl5VSo1DDXLeeZ+TB2wAvAW8dUUEZm+UWtv5WR3WAsk83ds/Z+ifyTwAg8UpCuhZhkBXUNhiNNKUKst1JDI+1UXlIa0OXd0/POnS36+4toaQ +evj3j3QUhDU/iB8Shs2o4YUHOCd5fToiHmYcPHfHf+A +-> mlkem768x25519 3TtJ49LPuT0MfeYEMliYOqN4nR50uAXfXKf/Tj3dhSB2dhmRUEfUprr8P6XzQ0GbTNRlYfkhpMxdavYdOmvaKbhqtvCnFwvLlO2NHgSvY/W2RKgL+OmPE4/zMFZYblHZShvwKUqcQGu/f84cBtL+5qqOdZObPUye06KjGi1deeB9Qmv9Wl5j09VlzV2tN8kZf4GAoc2+tFbqDXt/ZqviY1KAss4zrJWV8sVpNN/ooGVjarM++LwKPnkEZhl/15gfAM2x+SObXUJuHQ0iqp5rNk91v90V0nBPQ/tVI0yGkmmhgpvpjuEgK24nMtqR49z+PJ8tm0qjYfv/K9TonQcNCpTpTq9/eu9+V0fJRx87TO8heX6KMZ6x6cbXn3rUgBT5xaypITcLhvsfX8ZKI3beBqI87e3WOeL9Xu/8jj99WVj5xJbF4ycKtATUXRVBiJYFWViEoUaTpv2A6+hKQuvEMaPD45jEs3Juww86vxfSG4A4Z3drN9euoCQq1z8rX9y3od9l/LK8tGL62KaBbZ9zsi5PK277qlEh9p7HrXqb/ahCFtSFoYBO7yCmv4O8fVGmpINTX7zfIDzBE/iryx5/PHLtjrSmPlV8OIJxXEnaSrKn5PGw8KaOq1eQPwejlQvjBbRCByIhbaoYUDPTSej7C81AZwKY+eW+ohBK2X+urmGJRakYg5J2lFufvf/UZOEpsEaFuKTeshcJCTedIdSLGHHLW7WhPibkABzjmTJcSC0899nx4ShI2TSgSJfsr8Fyr3rUIPFlTtjCqrcrRt/rx2WLEYRy2EoQABkay88hNKv+wpMCSGdHuWbXylhnROW6394HnM9oyHRskiUMqG4NEnL630j+uvOMlefFKeQmRG4Woj55WxYnIB/bE+7ThDyNRbOpls1luwA4UmfbqQh/LxFQGmgQThHd83TUvwM490zzbjo/jFEjb2tyPGg6A6s96rvNmgYBLI3fNkInmRKNzkYXZi6yIFaZfLrSUTrBWg8WA/vcOgUKpAG5Ydv6VwZArE0JEOE/z4nrIEkXJBEbgRdGb7qLDdvwY3POT0t+a2Vgxjy9GMAVv30JUKFeaTqJ72trxuIKikm1R3UHEkbMwK38jaQeM3LhyYFHJOw/CoZNgki9GtirM9N2seZAnGM6hMii/qYCuSpshcnyjHfqcjnpbsdJnAK4dI3bX/GiYsU0sm3ZgSocrctMBdwXtlimjXpz6Qwzvgo+HLhdBzTpEOb2nBPCIPgx9v4QHKp/CxPW8wcbUuRjenjj0BwIf6O4fD3GV/MuSgrmubEAheidqtQOW5UZPNc60HX4IVZMyVGVnYMyV9Pbrg4W397RM4wpaw3mL94s+0xaMhcdAQVn4rdcXH7U3M1lpc9xaL82qBdH3itgA3r3Kr7qyU/6Ub9Fu+eXQ2CEcqwueMxMc9mU740yUAogDZz4Bt1ahp2QJ4HRo2r2DLJYFDFFWMLRX/juK3DyGIeT4Z5HeCUfSeGFJw +q+7bSo+ZtQ0iM+hwfTNeM7AzL0BjlBx4yXvH4eFXPmk +--- tTJFiO3npBbMKv/D+z5PWZezg8M6+9wgy4OVEhCK5pM +�p�� +& mlkem768x25519 39mhSx46ae9tbZ86DarMdC/dEF13YCkmpobFacHwNZWw1gwhLR8+yidkWEernl9VKVcw4KUHcHCOPngmzcZoUF3u/Sa4tzCW+vhAYDRBb2QgsP4Q23X5gpvCDS0Fvz7tzVAowWG1/4/p5DdPok+W5hyRzW8E0xJhodcsPppBa7hNTdyohz9gsLlGiZAzFdBNOHUXQfZZIB3MJnPT2SSVYalnfGFTMyPWzCet5DeLH2nkdZSFRRZdEnvIw1j+4jPffeo/sTY8b9jzMxCWTmPGsQxt4q9f1jN9LPkc5LpJ/mCFJT9gw0Wn7eqJI6P/BqxZYlRIrf9MpeiA9PZPq9zs9ZHsQOJAIgZsfpPLydSQuHZMsRXkj7q+RJG93GCOcr86+hf9lghQbyxPPqyifXcWciY7umGwoBGdq3k2yniv3S9BOpCbG4CGYzOtDaPRqNwjsGFWMULIYQtDV2YAa8oK1i81tfNleS191UJELXF3AueAUZgxPUwuHjXqOhbrl/qfnchZc8QcI+0F4S6QBeZgQVimesYqJtj670811pRwI62NiNr+OIu6O5AqlE2b8RkJYhBS6DnOb0R2psY3kJsMPPmNNGbRYR/a3EWP/WS5Zs6FPt3stW/BOcSMM0yzz/jHfTEDeUJ5C5x3anbbqvUuTmHn6bmlggQcBFXA+u+xfeLrEeoK1NWTUhq4p5umXJsLKh4yhytBDICgfjEXRl4nST6+XxKqMbbqTujRbxdOWl28SdNYU3uAeEsFnDOv6R0LUCa0y3wq4JflbruzfylZPZAMVqKJ7EfP3/ytOC27Y7mgGy1M8VGR+yDVm3c7vhKV4nKsqRVhshtlp/LKj5rMaf4MCV1UenUdhx1gT3b1EFzgfd6EpE8Uj20t1WO682AvkrcX53e2LS2oFX7yHyqQZntRo8/1ruQyEsF/ePpXYzp/kcH+fsO3yU3BSzinvR/dWJ2tO79exaLAEy5Dy/HHvzq/J2o6Bn958/mBzp4gfgcKrpymSfFPVsHmLkI4Smol4vNesk0aGu7TxJbBq/JLI41B8l29o5BZo/t3IOBe/N969zgxOYCC7XdPiI//6fjhMTisMVLQhpAFJofmRk5lnnuCElLclQeN3GvOYyFYloj0FlrOa9vD2vgmxayOI/8ixKE3On3V4c9idSSmH2Gfy7O/agY7RmPZnUBxpWfipHg9e2aPnDZaIxXyvJfuRU/7cPh5lPQCYiTm97Y5TrySKMUy5Fx9IFXzjcy3uT5s52PD7bdZH9vwwvrVU2J01UpGkCF+xyt4p+YAToMUSFKu5tEZCo9iYcybI64AryZbAvnV8mXqUQZeTUnLiL9zNxRV200BFQaV7TYA9N+H1aKFaQp6RGb7nt2pq4XVsOF6B76qqgOkDurNd+/LIFhz1HH8wMEhb7B+zLg5s9l6isbzpzaVziZsu6vu6w6gpkzuvTrzYuxx4pOcHBjQNEqF/88VDabNJUWeoMNQd0/f3GQSfg ++gre1lzkaQi2XiZXYuEAQaCYlZS2I9LK63rE/zMFohw +-> mlkem768x25519 OYjMnC9GtA4KYkgE9M+ZhYKn99xbTrv7ayEUJUvLU2bfjQhYQPvI+/tQ0x0MiYaPm92rYN+wyfW8oX4tsVcq7jp+aF6PKrPsEJ+kEdk99NTCuZymy1E9kFvqSzbSpmPsHpHm4fTAFk2f4d6jwRpj4EdER/qM8v7btbTRUddqNAG9Z3RKF0iq657LKIbN38GMzf80+jMa0NEgOFR7hIH8d1a8lS6uq6q6qUC9Lyphv6sW8RdtVG6HUsQp1XZcRZtoN0XPRaRiahR0LM95iuVB/8d/q0QRsh+RqW4+XpGjyNoWiCDCqtJk/GABNdZUmNamUSmJyciOSrUxj5dqYRzhwDdUAEFM5ohIJv6KD5HnpbEr4p13A2Vv0CZWo0jfgmbTt0kInuIsXT+hqISundeaGwNDV1AYPgWIMMKffJNTF6w9cAhcZ31RwDGf/Zf2cYGGywDBugSggMRLSS6IdLwfZ4cqqgqGbHtEXPnDZLFshsAYmiG/xwbGz7dt/KZljfWzR3MPlYGy137LVn9bzumhfGLibU7O0p+KHDXxhn05MVDx6bj7DZh/SF/FEDed5HpM0FYMXE0EsQx0ju450vqbYR3VWstP/qXg6/c8p7KB36N4p2EsMwpjXDW51WTKmIl7nWjwOJ+I7tr5SzP+vxK0Er3UCqMA9987pHuYoefEndZTsi4lmBIVKP37BEAEBXMh09jFsioXQq/UqBZ5oP0eQcykRXEdfxxHtqKEXmkM3CsCv4fu19Yp04iI5LsARZ6voN9ErUZ+0KrTnReaDRvlrLbiwqcXZFiQBge8xqw3jSBXkYucPTZ21ZDSQDjptJYOlHgrDHcmHJp9RJWA6kR7ovFueHRjxdi6IqIOOgbVs2zKZA3Oe2uMuhQk5v6w3sqPb9AYN9w6eDp/Sz42gPb24DmxxCco97loP9Xt+F1fLoPeYjKwj7rIm9OVFbsf0Zbn2p1WjH2HL1nZkf1Ghe+RD6G9FwwWngxbYGSPaI0q1Rwa4athfmxEVV0s0o6ho+jd4ly6CHyXbbgr8orWDf7YRNLK4fY1ituDjfpOPMvDT6QOLAIn0x/+b9kL1nNoCj1C7K6v/UZJr0aJrtcNRcW3dkZRLlODvVDiJ3LxPDQgoMJmu3VDW8DoRlP4r8dkAuJD13x7fUagNBEsXzGpqfpRkcvTZoEWboFJhe+9KPI3amukOvnEDPRHYyLTtvMe42pgaS1ExWYC5upanF/4Ad1iQ/KvmhccqJGyBzTaDEzNJLiRMbAbwr6CaRq7ob5mFrulaUZnb3gRMdSOrjIwjeKs6iW31MfM2bVXNObPThKjKx++b53/T/N5488SF9NiFLwZyfWu9qYbvUvkFPCBkxzw00nWEk7S2MouRlxeC+IacMgZG/39gXH8Er3cKu0Z5Lbe1U/+zdJSha1MOUMd2j8QsPr4r4AcTDIbHXEu9CvwVFoRi/v/fIftWG48MkgjCAA9FYB9ctIKkGgpSL/DxKP7KQ +6j1Dg2YLAB3ys92o1mdi5bwOrWcbUwNn0Ea8naNPmRY +--- KBwA6UqZTGgDJd8INY2wyg9BwKbcTEKRgfKCmHw46Vg +ˣ��H[��@�����ƨ�S ��-��w�F��[�mq�U�n����H�}�;�D�B�V^24�LKիWQ���)3l��>�Q� �dnڅIb� �kʶCn�~��^��~�t1�CM�<���c`�6΄Dʖ��l}���D���!\X3�Ф8�o�!�_�}����׏57�� ���h���l���ґ' \ No newline at end of file diff --git a/nixosModules/services/voidauth/default.nix b/nixosModules/services/voidauth/default.nix index e92dad7e..e340164e 100644 --- a/nixosModules/services/voidauth/default.nix +++ b/nixosModules/services/voidauth/default.nix @@ -118,7 +118,6 @@ let redirectUrls = lib.mkOption { description = "Valid URLs that this OIDC client can redirect to after authentication with VoidAuth"; type = types.listOf types.str; - default = [ ]; example = [ "https://example.com/oidc-redirect" ]; }; responseTypes = lib.mkOption { -- 2.51.2