all repos — nixfiles @ 4b8a6dbe53b4635a332ea98f9b97ac82bc473fa1

System and user configuration, managed by nix and home-manager

system/roles/opia/auth.nix (view raw)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
{
  config,
  inputs,
  ...
}:
let
  domain = "opia.ovh";
  subdomain = "auth";
  port = 8083;
in
{
  imports = [
    inputs.tg-auth.nixosModules.tg-auth
  ];

  age.secrets.tgauth.file = ../../../secrets/tgauth.age;

  services.caddy = {
    extraConfig = ''
      (tg_auth) {
        forward_auth localhost:${toString port} {
            uri /
        }
      }
    '';
    virtualHosts."${subdomain}.${domain}" = {
      extraConfig = ''
        tls {
          dns_challenge_override_domain _acme-challenge.${subdomain}.opia.${config.networking.domain}
        }
        encode zstd gzip
        reverse_proxy localhost:${toString port}
      '';
    };
  };

  services.tg-auth = {
    enable = true;

    environment = {
      PORT = toString port;
      BOT_NAME = "OpiaCommunityBot"; # Username without @

      SIGNIN_URL = "https://${subdomain}.${domain}/signin";
      SIGNIN_REDIRECT_CALLBACK_URL = "https://${subdomain}.${domain}/signin/callback";
      SIGNIN_AFTER_SIGNIN_URL = "https://${subdomain}.${domain}/";

      AUTHZ_CHANNEL_IDS = "-1002285871016"; # may need "-100" in front, just "-" or neither
      AUTHZ_CACHE = "5m";

      AUTHN_COOKIE_NAME = "tgauth_session";
      AUTHN_COOKIE_DOMAIN = domain;
      AUTHN_SESSION_TTL = "48h";
    };

    environmentFile = config.age.secrets.tgauth.path;
  };
}