networkException/katzen-cafe
1
0
Fork 0
forked from katzen-cafe/katzen-cafe
Code Pull requests Activity

get mediawiki working finally with auth and permissions

Browse source
This commit is contained in:
Schrottkatze 2023-05-03 00:01:02 +02:00
parent 0e23e021c1
commit 530087cf05
6 changed files with 237 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

1
modules/containers/default.nix
View file

@ -2,5 +2,6 @@
{
imports = [
./phtanumb-wiki.nix
./penpot.nix
];
}

92
modules/containers/penpot.nix Normal file
View file

@ -0,0 +1,92 @@
{ pkgs, inputs, ... }:
{
imports = [ inputs.arion.nixosModules.arion ];
virtualisation.docker.enable = true;
virtualisation.arion = {
backend = "docker";
projects.penpot.settings = {
networks.penpot.name = "penpot";
services = {
"penpot-backend".service = {
image = "penpotapp/backend:latest";
volumes = [ "/penpot/assets:/opt/data/assets" ];
depends_on = [ "penpot-postgres" "penpot-redis" ];
networks = [ "penpot" ];
environment = {
"PENPOT_FLAGS" = "enable-registration disable-login disable-login-with-password enable-login-with-oidc";
"PENPOT_PREPL_HOST" = "0.0.0.0";
"PENPOT_PUBLIC_URI" = "https://design.katzen.cafe/";
"PENPOT_DATABASE_URI" = "postgresql://penpot-postgres/penpot";
"PENPOT_DATABASE_USERNAME" = "penpot";
"PENPOT_DATABASE_PASSWORD" = "penpot";
"PENPOT_REDIS_URI" = "redis://penpot-redis/0";
"PENPOT_ASSETS_STORAGE_BACKEND" = "assets-fs";
"PENPOT_STORAGE_ASSETS_FS_DIRECTORY" = "/opt/data/assets";
#"PENPOT_OIDC_NAME_ATTR" = "username";
"PENPOT_TELEMETRY_ENABLED" = "false";
"PENPOT_OIDC_CLIENT_ID" = "penpot";
"PENPOT_OIDC_BASE_URI" = "https://auth.katzen.cafe/realms/master/";
#"PENPOT_OIDC_" = "";
#"PENPOT_SMTP_DEFAULT_FROM" = "Penpot <noreply-pp@schrottkatze.de>";
#"PENPOT_SMTP_DEFAULT_REPLY_TO" = "Penpot <noreply-pp@schrottkatze.de>";
#"PENPOT_SMTP_HOST" = "smtp.migadu.com";
#"PENPOT_SMTP_PORT" = "587";
#"PENPOT_SMTP_USERNAME" = "noreply-pp@schrottkatze.de";
#"PENPOT_SMTP_PASSWORD" = "${builtins.readFile ../secret-data/penpot-smtp-pass}";
#"PENPOT_SMTP_TLS" = "true";
#"PENPOT_SMTP_SSL" = "false";
};
env_file = [ "/penpot/secret/oidcPpSecret" ];
};
"penpot-frontend".service = {
image = "penpotapp/frontend:latest";
ports = [ "9001:80" ];
volumes = [ "/penpot/assets:/opt/data/assets" ];
depends_on = [ "penpot-backend" "penpot-exporter" ];
networks = [ "penpot" ];
environment = {
"PENPOT_FLAGS" = "enable-registration disable-login disable-login-with-password enable-login-with-oidc";
};
};
"penpot-exporter".service = {
image = "penpotapp/exporter:latest";
networks = [ "penpot" ];
environment = {
"PENPOT_PUBLIC_URI" = "http://penpot-frontend";
"PENPOT_REDIS_URI" = "redis://penpot-redis/0";
};
};
"penpot-postgres".service = {
image = "postgres:15";
stop_signal = "SIGINT";
volumes = [ "/penpot/postgres_v15:/var/lib/postgresql/data" ];
networks = [ "penpot" ];
environment = {
"POSTGRES_INITDB_ARGS" = "--data-checksums";
"POSTGRES_DB" = "penpot";
"POSTGRES_USER" = "penpot";
"POSTGRES_PASSWORD" = "penpot";
};
};
"penpot-redis".service = {
image = "redis:7";
networks = [ "penpot" ];
};
};
};
};
deployment.keys = {
"oidcPpSecret" = {
keyCommand = [ "cat" "/home/jade/keys-tmp/penpot-keycloak-secret" ];
destDir = "/penpot/secret/";
};
};
}

27
modules/containers/phtanumb-wiki.nix
View file

@ -36,15 +36,33 @@
virtualHost.adminAddr = "admin@katzen.cafe";
passwordFile = "/var/mediawiki/passwordFile";
extraConfig = ''
# $wgShowExceptionDetails = true;
# $wgDebugToolbar = true;
# $wgShowDebug = true;
# $wgDevelopmentWarnings = true;
# Disable anonymous editing
$wgGroupPermissions['*']['edit'] = false;
$wgGroupPermissions['oidc_editor']['edit'] = true;
$wgGroupPermissions['oidc_editor']['createpage'] = true;
$wgGroupPermissions['oidc_interface_admin'] = $wgGroupPermissions['interface_admin'];
$wgGroupPermissions['oidc_admin'] = $wgGroupPermissions['sysop'];
$wgGroupPermissions['oidc_admin']['userrights'] = true;
$wgDebugLogFile = "/var/log/mediawiki/debug-{$wgDBname}.log";
$wgPluggableAuth_Config["katzen.cafe authentication"] = [
$oidcClientSecret = file_get_contents('/var/mediawiki/keycloakClientSecret', false, null, 0, 32);
$wgPluggableAuth_Config[] = [
'plugin' => 'OpenIDConnect',
'data' => [
'providerURL' => 'https://auth.katzen.cafe/realms/master/',
'providerURL' => 'https://auth.katzen.cafe/realms/phtanum-b',
'clientID' => 'phtanumb-wiki',
'clientsecret' => '/var/mediawiki/keycloakClientSecret',
# hack to try dynamically get the secret
'clientsecret' => $oidcClientSecret,
'global_roles' => ['property' => ['realm_access', 'roles']],
'wiki_roles' => ['property' => ['resource_access', 'phtanumb-wiki', 'roles']]
]
];
'';
@ -65,12 +83,13 @@
};
deployment.keys = {
"passwordFile" = {
keyCommand = [ "cat" "/home/jade/keys/phtanumb-wiki/passwordFile" ];
keyCommand = [ "cat" "/home/jade/keys-tmp/phtanumb-wiki-passwordFile" ];
destDir = "/phtanum-b/wiki";
};
"keycloakClientSecret" = {
keyCommand = [ "cat" "/home/jade/keys-tmp/phtanumb-wiki-keycloak-secret" ];
destDir = "/phtanum-b/wiki";
permissions = "0604";
};
};
}