homelab/hosts/thea/authelia.nix

{
  pkgs,
  config,
  lib,
  ...
}:
let
  cfg = config.services.authelia.instances.main;
  dataDir = "/var/lib/authelia-${cfg.name}";
  authelia-snippets = pkgs.callPackage ./lib/autheliaSnippets.nix { inherit pkgs; };
in
{
  services.authelia.instances = {
    main = {
      enable = true;
      secrets = {
        jwtSecretFile = config.age.secrets.authelia-jwt.path;
        storageEncryptionKeyFile = config.age.secrets.authelia-encryption.path;
        sessionSecretFile = config.age.secrets.authelia-session.path;
      };
      settings = {
        theme = "light";
        log.level = "debug";

        authentication_backend = {
          file = {
            path = dataDir + "/users.yml";
          };
        };
        storage = {
          local = {
            path = dataDir + "/db.sqlite3";
          };
        };
        session = {
          cookies = [
            {
              domain = "shobu.fr";
              authelia_url = "https://auth.shobu.fr";
              default_redirection_url = "https://shobu.fr";
            }
          ];
        };
        notifier = {
          filesystem = {
            filename = "${dataDir}/notification.txt";
          };
        };
        access_control = {
          default_policy = "deny";
          rules = [
            {
              domain = "auth.shobu.fr";
              policy = "bypass";
            }
            {
              domain = "*.shobu.fr";
              policy = "two_factor";
            }
          ];
        };
        server = {
          endpoints = {
            authz = {
              auth-request = {
                implementation = "AuthRequest";
              };
            };
          };
        };
        identity_providers = {
          oidc = {
            hmac_secret = "this_is_a_secret_abc123abc123abc"; # 64+ character secret
            jwks = [
              {
                key = ''
                  -----BEGIN PRIVATE KEY-----
                  MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDBGxQpgV074AB1
                  ee+JiDMxuiVooVuD8RzVISTy0tVNBFS5vydB1g5k072shMdCE8S2M4oTaW7ZG1h0
                  A+XbgZj+wZFcdHA+lD6QRGSN03FlrRZBMv8BCKzctdgAW1Dtrho31+Nw+3jTrrbO
                  DiQaH2kzanET0GZJ+cD3AngWYV0KCkq8yws3T8AiK4oNghyv6Amknmbf7sJ+aZ8C
                  f8WCixiErT/TjEGKRxFTKw3LMrdrbljE8JP+f1sTpDZP6uOtH0YS0iJ4nWHvxKYH
                  LHLzrx3rO0zBrPiXK3eAtP2baPxS5y26kJcVL5bUSbDdB3NCznZc50OO14huX2s+
                  GVct0FsLAgMBAAECggEAAUoZTy91wXa5gn8EzQVWzj9YfJDv2Pn4/hjLmRNHFADQ
                  gmtXfhNJiHte7qqdjB1ag8TgOcHd8oyRFmcgCs3BaL68uwEdtq/hT4FXvF37EKW+
                  q/PyS38XNMWBIpfD+tmYGJHfzp2HsuPCz5tbSzG5qioZvMNHd4FtRXj6cGntjRAg
                  uW1Ns2h//BajftwD8RLHOvq7lWLaPWbdbte396KNBdNpceargISf9VEJik/dPWrT
                  jV5bNAm7chvEfjhLqFCJ/p6j7z4DLFGrhYnh50btfe9FnWRtUYAGxhfaobveDPVe
                  AI0lFN7IFU6+G6cYHTZAtAviWIutDwK0K9ACYCo1wQKBgQDiWEIdoYvjAh2J9K8f
                  8YWa660YuvLSYQmvimr7E9FzoFdiUeFqlVCw/SIz7mRuDDCliDFxheekc8+jJB5U
                  kfR2C2o3llRy+wLVap6X5OmqVAjFuHXxntbK/zwyv4K5uecwtEgDyGdXW2eZDog7
                  VohuWOD3cTDAkVFu/Mw/02/CqwKBgQDaZ/b1Rfu9QXLvgtf23PpqKb0VG6gOo/Sm
                  bpGnEBG9sAnsvDHBs85UTxzzr0qWOSguDh5NMxd0/IxKiLDRPvshhod9rWw0T8Qh
                  jBDYsDLBZlBT1AVKvkeELZx9DW1Iomx6bdtYRX3SkgBKVK43q17J3T37U/UJ36PQ
                  5e1lBbDJIQKBgQDcEcP222MPTLc7stOy0zl77zlVmi8NrZulOYfapuI28ecEiWgK
                  ITNbYkMnCtpKxT9nMowgPHmEw7VWgX+b6m0teNvFQDzLrpKKvieEt+UY3qvI0hia
                  3D0rEg6NqPaJbd8C08ZRJ0CTByQrBJ4gU3pDD9drvnoQQTpUFybfx8waEQKBgQDL
                  6a1FKuXyuRyaSktgjMiwPe/vuTabFLDigvEyTWqC880QXlUGSN4nEQYy7kJxJ0RA
                  W6Ym5cDM1M4W+LA9bNQDZRszV6ti2+Z+e8tuxHNe5iuxWI7oTedvnTYx+0tBOYSW
                  eeME8zyaUP48Z/uQtkt1pT6tXKG3ajoEW+fdHgcEgQKBgCCTnBkASe21/n+D3c02
                  vGekM3ioWNe9heIWv/7aWmMXb14DBCZMVXNyfOe7gQs2u3OX+IBW8UscGhY2LjVV
                  5dKLMIWHw8Afccw4isYhequmJeai2Q3SSenWc7lIqOG4FDpwkcjW0VBBaU/p7ZnA
                  h3JJ7q49hdgOKpF/xZNwmmfI
                  -----END PRIVATE KEY-----''; # rsa private key
              }
            ];
            claims_policies = {
              trilium = {
                id_token = [
                  "email"
                  "name"
                ];
              };
            };
            clients = [
              {
                client_id = "trilium";
                client_name = "Trilium Notes";
                client_secret = "$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng";
                public = false;
                authorization_policy = "two_factor";
                claims_policy = "trilium";
                require_pkce = false;
                pkce_challenge_method = "";
                redirect_uris = [ "https://trilium.shobu.fr/callback" ];
                scopes = [
                  "openid"
                  "profile"
                  "email"
                ];
                response_types = [ "code" ];
                grant_types = [ "authorization_code" ];
                access_token_signed_response_alg = "none";
                userinfo_signed_response_alg = "none";
                token_endpoint_auth_method = "client_secret_basic";
              }
            ];
          };
        };
      };
    };
  };

  # systemd.tmpfiles.rules = lib.mkIf cfg.enable [
  #   "d '${dataDir}' 0700 ${cfg.user} ${cfg.group} - -"
  # ];

  age.secrets = {
    authelia-jwt = {
      owner = cfg.user;
      file = ./secrets/authelia-jwt.age;
      mode = "700";
    };
    authelia-encryption = {
      owner = cfg.user;
      file = ./secrets/authelia-encryption.age;
      mode = "700";
    };
    authelia-session = {
      owner = cfg.user;
      file = ./secrets/authelia-session.age;
      mode = "700";
    };
  };

  services.nginx = {
    enable = true;
    recommendedProxySettings = true;
    recommendedTlsSettings = true;

    virtualHosts."auth.shobu.fr" =
      let
        upstream = "http://thea:9091";
      in
      {
        enableACME = true;
        forceSSL = true;

        locations."/" = {
          proxyPass = upstream;
          extraConfig = ''
            error_log /var/log/nginx/debug_authelia.log debug;
            include ${authelia-snippets.proxy};
            set $upstream ${upstream};
          '';
        };
        locations."/api/verify" = {
          proxyPass = upstream;
        };
        locations."/api/authz" = {
          proxyPass = upstream;
        };
      };
  };
}