import opia roles
1 file changed, 58 insertions(+), 0 deletions(-)
changed files
A system/roles/opia/auth.nix
@@ -0,0 +1,58 @@ +{ + config, + inputs, + ... +}: +let + domain = "opia.ovh"; + subdomain = "auth"; + port = 8083; +in +{ + imports = [ + inputs.tg-auth.nixosModules.tg-auth + ]; + + age.secrets.tgauth.file = ../../../secrets/tgauth.age; + + services.caddy = { + extraConfig = '' + (tg_auth) { + forward_auth localhost:${toString port} { + uri / + } + } + ''; + virtualHosts."${subdomain}.${domain}" = { + extraConfig = '' + tls { + dns_challenge_override_domain _acme-challenge.${subdomain}.opia.${config.networking.domain} + } + encode zstd gzip + reverse_proxy localhost:${toString port} + ''; + }; + }; + + services.tg-auth = { + enable = true; + + environment = { + PORT = toString port; + BOT_NAME = "OpiaCommunityBot"; # Username without @ + + SIGNIN_URL = "https://${subdomain}.${domain}/signin"; + SIGNIN_REDIRECT_CALLBACK_URL = "https://${subdomain}.${domain}/signin/callback"; + SIGNIN_AFTER_SIGNIN_URL = "https://${subdomain}.${domain}/"; + + AUTHZ_CHANNEL_IDS = "-1002285871016"; # may need "-100" in front, just "-" or neither + AUTHZ_CACHE = "5m"; + + AUTHN_COOKIE_NAME = "tgauth_session"; + AUTHN_COOKIE_DOMAIN = domain; + AUTHN_SESSION_TTL = "48h"; + }; + + environmentFile = config.age.secrets.tgauth.path; + }; +}