From c2c6f4735b00782cb8b4be553a371f36ffb2d7d5 Mon Sep 17 00:00:00 2001
From: dish <pyrox@pyrox.dev>
Date: Sun, 7 Jun 2026 20:04:44 -0400
Subject: [PATCH] [marvin] more voidauth fixes

---
 hosts/marvin/services/auth-provider.nix    |  1 +
 hosts/marvin/services/git.nix              |  2 +-
 hosts/marvin/services/immich-config.json   |  4 +-
 hosts/marvin/services/immich.nix           |  3 +-
 nixosModules/services/voidauth/default.nix | 86 ++++++++++++++--------
 5 files changed, 60 insertions(+), 36 deletions(-)

diff --git a/hosts/marvin/services/auth-provider.nix b/hosts/marvin/services/auth-provider.nix
index 9a61424a..8ae918b3 100644
--- a/hosts/marvin/services/auth-provider.nix
+++ b/hosts/marvin/services/auth-provider.nix
@@ -26,6 +26,7 @@ in
       CONTACT_EMAIL = "webmistress@pyrox.dev";
       ADMIN_EMAILS = "daily";
       # SMTP
+      SMTP_FROM = "auth@pyrox.dev";
       SMTP_HOST = "smtp.purelymail.com";
       SMTP_PORT = "465";
       SMTP_SECURE = "true";
diff --git a/hosts/marvin/services/git.nix b/hosts/marvin/services/git.nix
index 30776718..2479580b 100644
--- a/hosts/marvin/services/git.nix
+++ b/hosts/marvin/services/git.nix
@@ -14,7 +14,7 @@ in
 {
   dish.oidcClients = [
     {
-      clientId = "dishNet-git";
+      clientId = "dishNetgit";
       displayName = "dishNet Git";
       homepageUrl = "https://${d.extUrl}";
       clientSecretFile = ./secrets/forgejo/oidc-secret.age;
diff --git a/hosts/marvin/services/immich-config.json b/hosts/marvin/services/immich-config.json
index df012d50..cfeb5fe4 100644
--- a/hosts/marvin/services/immich-config.json
+++ b/hosts/marvin/services/immich-config.json
@@ -184,10 +184,10 @@
     "autoLaunch": false,
     "autoRegister": true,
     "buttonText": "Login with dishNet",
-    "clientId": "dishNet-photos",
+    "clientId": "dishNetphotos",
     "defaultStorageQuota": null,
     "enabled": true,
-    "issuerUrl": "https://auth.pyrox.dev",
+    "issuerUrl": "https://auth.pyrox.dev/oidc/.well-known/openid-configuration",
     "mobileOverrideEnabled": false,
     "mobileRedirectUri": "",
     "profileSigningAlgorithm": "none",
diff --git a/hosts/marvin/services/immich.nix b/hosts/marvin/services/immich.nix
index 40e1ff47..31cbd7ee 100644
--- a/hosts/marvin/services/immich.nix
+++ b/hosts/marvin/services/immich.nix
@@ -11,9 +11,10 @@ in
 {
   dish.oidcClients = [
     {
-      clientId = "dishNet-photos";
+      clientId = "dishNetphotos";
       displayName = "dishNet Photos";
       homepageUrl = "https://${d.extUrl}";
+      authMethod = "client_secret_post";
       clientSecretFile = ./secrets/immich/oidc-secret.age;
       redirectUrls = [
         "app.immich:///oauth-callback"
diff --git a/nixosModules/services/voidauth/default.nix b/nixosModules/services/voidauth/default.nix
index e340164e..24ce33cc 100644
--- a/nixosModules/services/voidauth/default.nix
+++ b/nixosModules/services/voidauth/default.nix
@@ -53,7 +53,7 @@ let
     ) cfg.declaredClients
   );
 
-  oidcSecretFiles = lib.mapAttrsToList (_: v: v.path) ageSecrets;
+  oidcSecretFiles = map (x: x.path) (lib.attrValues ageSecrets);
 
   voidauthFolder = {
     user = "voidauth";
@@ -218,39 +218,61 @@ in
       group = "voidauth";
     };
     users.groups.voidauth = { };
-    systemd.services.voidauth = {
-      description = "VoidAuth OIDC Server";
-      wantedBy = [ "multi-user.target" ];
-      after = [ "postgresql.target" ];
-      environment =
-        let
-          serviceSets = lib.mergeAttrsList (map mkService cfg.declaredClients);
-        in
-        configEnv // serviceSets;
-      serviceConfig = {
-        User = "voidauth";
-        Group = "voidauth";
-        StateDirectory = "voidauth";
-        ExecStart = "${lib.getExe cfg.package} server";
-        WorkingDirectory = "/var/lib/voidauth";
-        EnvironmentFile = oidcSecretFiles ++ [ cfg.secretsFile ];
+    systemd.services.voidauth =
+      let
+        preStartFileName = "/var/lib/voidauth/oidcSecretsEnv";
+        preStartScript = pkgs.writeShellScript "voidauth-make-oidc-secrets" ''
+          touch ${preStartFileName}
+          chown voidauth:voidauth ${preStartFileName}
+          chmod 400 ${preStartFileName}
+          cat > ${preStartFileName} << EOF
+          ${lib.strings.concatMapStringsSep "\n" (
+            o:
+            let
+              clientName = lib.removeSuffix "-oidc-secret" (baseNameOf o);
+            in
+            "OIDC_${clientName}_CLIENT_SECRET=`cat ${o}`"
+          ) oidcSecretFiles}
+          EOF
+        '';
+      in
+      {
+        description = "VoidAuth OIDC Server";
+        wantedBy = [ "multi-user.target" ];
+        after = [ "postgresql.target" ];
+        environment =
+          let
+            serviceSets = lib.mergeAttrsList (map mkService cfg.declaredClients);
+          in
+          configEnv // serviceSets;
+        serviceConfig = {
+          User = "voidauth";
+          Group = "voidauth";
+          StateDirectory = "voidauth";
+          ExecStartPre = preStartScript;
+          ExecStart = "${lib.getExe cfg.package} server";
+          WorkingDirectory = "/var/lib/voidauth";
+          EnvironmentFile = [
+            cfg.secretsFile
+            preStartFileName
+          ];
 
-        # Hardening
-        ProtectProc = "invisible";
-        NoNewPrivileges = true;
-        ProtectSystem = true;
-        ProtectHome = true;
-        PrivateTmp = true;
-        PrivateDevices = true;
-        ProtectHostname = true;
-        ProtectClock = true;
-        ProtectKernelTunables = true;
-        ProtectKernelModules = true;
-        ProtectKernelLogs = true;
-        ProtectControlGroups = true;
-        RestrictSUIDSGID = true;
+          # Hardening
+          ProtectProc = "invisible";
+          NoNewPrivileges = true;
+          ProtectSystem = true;
+          ProtectHome = true;
+          PrivateTmp = true;
+          PrivateDevices = true;
+          ProtectHostname = true;
+          ProtectClock = true;
+          ProtectKernelTunables = true;
+          ProtectKernelModules = true;
+          ProtectKernelLogs = true;
+          ProtectControlGroups = true;
+          RestrictSUIDSGID = true;
+        };
       };
-    };
 
     services.postgresql = lib.mkIf (cfg.database.createLocally && cfg.database.type == "postgres") {
       ensureUsers = [
-- 
2.51.2