basic authella configuration

hosts/thea/authelia.nix

@@ -0,0 +1,120 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.services.authelia.instances.main;
+  dataDir = "/var/lib/authelia-${cfg.name}";
+  authelia-snippets = pkgs.callPackage ./lib/autheliaSnippets.nix { inherit pkgs; };
+in
+{
+  services.authelia.instances = {
+    main = {
+      enable = true;
+      secrets = {
+        jwtSecretFile = config.age.secrets.authelia-jwt.path;
+        storageEncryptionKeyFile = config.age.secrets.authelia-encryption.path;
+        sessionSecretFile = config.age.secrets.authelia-session.path;
+      };
+      settings = {
+        theme = "light";
+        log.level = "debug";
+
+        authentication_backend = {
+          file = {
+            path = dataDir + "/users.yml";
+          };
+        };
+        storage = {
+          local = {
+            path = dataDir + "/db.sqlite3";
+          };
+        };
+        session = {
+          cookies = [
+            {
+              domain = "shobu.fr";
+              authelia_url = "https://auth.shobu.fr";
+              default_redirection_url = "https://shobu.fr";
+            }
+          ];
+        };
+        notifier = {
+          filesystem = {
+            filename = "${dataDir}/notification.txt";
+          };
+        };
+        access_control = {
+          default_policy = "deny";
+          rules = [
+            {
+              domain = "*.shobu.fr";
+              policy = "one_factor";
+            }
+          ];
+        };
+        server = {
+          endpoints = {
+            authz = {
+              auth-request = {
+                implementation = "AuthRequest";
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+
+  # systemd.tmpfiles.rules = lib.mkIf cfg.enable [
+  #   "d '${dataDir}' 0700 ${cfg.user} ${cfg.group} - -"
+  # ];
+
+  age.secrets = {
+    authelia-jwt = {
+      owner = cfg.user;
+      file = ./secrets/authelia-jwt.age;
+      mode = "700";
+    };
+    authelia-encryption = {
+      owner = cfg.user;
+      file = ./secrets/authelia-encryption.age;
+      mode = "700";
+    };
+    authelia-session = {
+      owner = cfg.user;
+      file = ./secrets/authelia-session.age;
+      mode = "700";
+    };
+  };
+
+  services.nginx = {
+    enable = true;
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+
+    virtualHosts."auth.shobu.fr" =
+      let
+        upstream = "http://thea:9091";
+      in
+      {
+        enableACME = true;
+        forceSSL = true;
+
+        locations."/" = {
+          proxyPass = upstream;
+          extraConfig = ''
+            include ${authelia-snippets.proxy};
+          '';
+        };
+        locations."/api/verify" = {
+          proxyPass = upstream;
+        };
+        locations."/api/authz" = {
+          proxyPass = upstream;
+        };
+      };
+  };
+}