extract pocket-id setup to sso role
2 files changed, 34 insertions(+), 21 deletions(-)
changed files
M system/hosts/linde.nix → system/hosts/linde.nix
@@ -35,6 +35,7 @@ ../roles/reverse-proxy.nix ../roles/binary-cache.nix ../roles/forgejo-runner.nix ../roles/searchix.nix + ../roles/sso.nix ../settings/services/git-server.nix ]; age.secrets = {@@ -54,7 +55,6 @@ redis-website.file = ../../secrets/redis-website.age; cifs-jellyfin.file = ../../secrets/cifs-jellyfin.age; cifs-paperless.file = ../../secrets/cifs-paperless.age; ntfy.file = ../../secrets/ntfy.age; - pocket-id.file = ../../secrets/pocket-id.age; readeck.file = ../../secrets/readeck.age; open-webui.file = ../../secrets/open-webui.age; };@@ -461,17 +461,6 @@ } reverse_proxy 127.0.0.1:8081 ''; }; - "id.alin.ovh" = { - extraConfig = '' - encode zstd gzip - reverse_proxy 127.0.0.1:1411 - ''; - }; - "iam.alin.ovh" = { - extraConfig = '' - redir https://id.alin.ovh{uri} permanent - ''; - }; "files.${domain}" = { extraConfig = '' encode zstd gzip@@ -662,15 +651,6 @@ ]; PAPERLESS_FILENAME_FORMAT = "{correspondent}/{created} {title} {asn}"; PAPERLESS_FILENAME_FORMAT_REMOVE_NONE = true; - }; - }; - - services.pocket-id = { - enable = true; - environmentFile = config.age.secrets.pocket-id.path; - settings = { - APP_URL = "https://id.alin.ovh"; - TRUST_PROXY = true; }; };
A system/roles/sso.nix
@@ -0,0 +1,33 @@ +{ + config, + ... +}: +let + domain = config.networking.domain; +in +{ + age.secrets.pocket-id.file = ../../secrets/pocket-id.age; + + services.pocket-id = { + enable = true; + environmentFile = config.age.secrets.pocket-id.path; + settings = { + APP_URL = "https://id.${domain}"; + TRUST_PROXY = true; + }; + }; + + services.caddy.virtualHosts = { + "id.${domain}" = { + extraConfig = '' + encode zstd gzip + reverse_proxy 127.0.0.1:1411 + ''; + }; + "iam.${domain}" = { + extraConfig = '' + redir https://id.${domain}{uri} permanent + ''; + }; + }; +}