From 0e23e021c1c0897c935bad0b2cd5b0eec4d0b600 Mon Sep 17 00:00:00 2001 From: Jade Date: Sun, 30 Apr 2023 14:56:30 +0200 Subject: [PATCH] gay --- modules/base-stuff.nix | 2 +- modules/containers/default.nix | 2 +- modules/containers/phtanumb-wiki.nix | 50 ++++++++++++++++++++++++---- modules/keycloak.nix | 10 +++++- modules/proxy.nix | 29 +++++++++------- 5 files changed, 71 insertions(+), 22 deletions(-) diff --git a/modules/base-stuff.nix b/modules/base-stuff.nix index 6e441a8..6852af6 100644 --- a/modules/base-stuff.nix +++ b/modules/base-stuff.nix @@ -25,7 +25,7 @@ }; environment.systemPackages = with pkgs; [ - neovim wget neofetch + vim wget neofetch btop ]; fileSystems."/" = { diff --git a/modules/containers/default.nix b/modules/containers/default.nix index 5d86e87..f264e83 100644 --- a/modules/containers/default.nix +++ b/modules/containers/default.nix @@ -1,6 +1,6 @@ { pkgs, ... }: { imports = [ - #./phtanumb-wiki.nix + ./phtanumb-wiki.nix ]; } diff --git a/modules/containers/phtanumb-wiki.nix b/modules/containers/phtanumb-wiki.nix index 2aee90d..20b0351 100644 --- a/modules/containers/phtanumb-wiki.nix +++ b/modules/containers/phtanumb-wiki.nix @@ -2,22 +2,33 @@ { containers."phtanumb-wiki" = { autoStart = true; - localAddress = "127.0.0.1"; + hostAddress = "127.0.0.1"; bindMounts = { "/var/mediawiki" = { hostPath = "/phtanum-b/wiki"; isReadOnly = false; }; }; + forwardPorts = [ + { + protocol = "tcp"; + hostPort = 5432; + containerPort = 5432; + } + { + protocol = "tcp"; + hostPort = 8081; + containerPort = 8081; + } + ]; config = { config, pkgs, ... }: { - services.mediawiki = { enable = true; name = "phtanum-b"; virtualHost.listen = [ { - ip = "127.0.0.1"; - port = 8080; + ip = "127.0.0.2"; + port = 8081; ssl = false; } ]; @@ -27,14 +38,39 @@ extraConfig = '' # Disable anonymous editing $wgGroupPermissions['*']['edit'] = false; + $wgDebugLogFile = "/var/log/mediawiki/debug-{$wgDBname}.log"; + $wgPluggableAuth_Config["katzen.cafe authentication"] = [ + 'plugin' => 'OpenIDConnect', + 'data' => [ + 'providerURL' => 'https://auth.katzen.cafe/realms/master/', + 'clientID' => 'phtanumb-wiki', + 'clientsecret' => '/var/mediawiki/keycloakClientSecret', + ] + ]; ''; + extensions = { + PluggableAuth = pkgs.fetchzip { + url = "https://extdist.wmflabs.org/dist/extensions/PluggableAuth-REL1_38-5331512.tar.gz"; + sha256 = "sha256-OWfr3oq2XzyJ5tynP5bRRPm34ymqz2oIBe2vBPHK+/Q="; + }; + OpenIDConnect = pkgs.fetchzip { + url = "https://extdist.wmflabs.org/dist/extensions/OpenIDConnect-REL1_38-8f8bab6.tar.gz"; + sha256 = "sha256-g+PGNzt0o2FebI3xyVamz5RA95E86MD2yqD4v8N6zKU="; + }; + }; }; system.stateVersion = "22.11"; }; }; - deployment.keys."passwordFile" = { - keyCommand = [ "cat" "/home/jade/keys/phtanumb-wiki/passwordFile" ]; - destDir = "/var/mediawiki"; + deployment.keys = { + "passwordFile" = { + keyCommand = [ "cat" "/home/jade/keys/phtanumb-wiki/passwordFile" ]; + destDir = "/phtanum-b/wiki"; + }; + "keycloakClientSecret" = { + keyCommand = [ "cat" "/home/jade/keys-tmp/phtanumb-wiki-keycloak-secret" ]; + destDir = "/phtanum-b/wiki"; + }; }; } diff --git a/modules/keycloak.nix b/modules/keycloak.nix index adf1120..278b8aa 100644 --- a/modules/keycloak.nix +++ b/modules/keycloak.nix @@ -4,12 +4,20 @@ enable = true; settings = { - http-port = 8097; + http-port = 8080; + http-enabled = true; + proxy = "edge"; + hostname = "auth.katzen.cafe"; + hostname-port = "-1"; + hostname-admin-url = "https://auth.katzen.cafe"; hostname-strict-backchannel = true; }; + #sslCertificateKey = "/var/lib/acme/auth.katzen.cafe/key.pem"; + #sslCertificate = "/var/lib/acme/auth.katzen.cafe/cert.pem"; + database = { type = "postgresql"; createLocally = true; diff --git a/modules/proxy.nix b/modules/proxy.nix index 5767c2c..7c4ebfb 100644 --- a/modules/proxy.nix +++ b/modules/proxy.nix @@ -11,10 +11,10 @@ #group = "nginx"; #keyType = "rsa4096"; #}; - #"wiki.phtanum-b.katzen.cafe" = { - #group = "nginx"; - #keyType = "rsa4096"; - #}; + "wiki.phtanum-b.katzen.cafe" = { + group = "nginx"; + keyType = "rsa4096"; + }; "auth.katzen.cafe" = { group = "nginx"; keyType = "rsa4096"; @@ -24,19 +24,24 @@ services.nginx = { enable = true; virtualHosts = { - #"wiki.phtanum-b.katzen.cafe" = { - #forceSSL = true; - #enableACME = true; - #locations."/" = { - #proxyPass = "http://127.0.0.1:8080"; - #}; - #}; + "wiki.phtanum-b.katzen.cafe" = { + forceSSL = true; + enableACME = true; + locations."/" = { + proxyPass = "http://127.0.0.2:8081"; + }; + }; "auth.katzen.cafe" = { forceSSL = true; enableACME = true; locations."/" = { - proxyPass = "http://127.0.0.1:8097"; + proxyPass = "http://127.0.0.1:8080"; }; + extraConfig = '' + proxy_set_header X-Forwarded-For $proxy_protocol_addr; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header Host $host; + ''; }; };