sora/nixconfig
1
0
Fork 0
Code Issues 2 Pull Requests Actions Releases Activity

Add tmpfile rule

Browse Source
This commit is contained in:
soraefir
2026-05-05 00:27:24 +02:00
parent cd05d939a8
commit b2d040d414
2 changed files with 72 additions and 69 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
modules/server/containers/default.nix
View File

@@ -8,7 +8,7 @@ let
inherit (containerCfg) port special_param; inherit (containerCfg) port special_param;
} }
) enabledConfigs; ) enabledConfigs;
mergedContainers = lib.attrsets.mergeAttrsList containerSetsList; mergedContainers = lib.attrsets.mergeAttrsList (lib.map(e: e.containers) containerSetsList);
in in
{ {
config = lib.mkIf ( enabledConfigs != {} ) { config = lib.mkIf ( enabledConfigs != {} ) {

139
modules/server/containers/defs/authentik.nix
View File

@@ -1,79 +1,82 @@
{ config, pkgs, lib, ... }: { config, pkgs, lib, ... }:
let serverCfg = config.syscfg.server; let serverCfg = config.syscfg.server;
in { in {
auth_postgresql = { systemd.tmfiles.rules = [
image = "postgres:14-alpine"; "d ${serverCfg.dataPath}/authentik/media 0755 root root -"
hostname = "auth_postgresql"; "d ${serverCfg.dataPath}/authentik/template 0755 root root -"
volumes = [ ]; ];
environment = { containers = {
POSTGRES_PASSWORD = "/run/secrets/AUTHENTIK_POSTGRESQL__PASSWORD"; auth_postgresql = {
POSTGRES_USER = "authentik"; image = "postgres:14-alpine";
POSTGRES_DB = "authentik"; hostname = "auth_postgresql";
volumes = [ ];
environment = {
POSTGRES_PASSWORD = "/run/secrets/AUTHENTIK_POSTGRESQL__PASSWORD";
POSTGRES_USER = "authentik";
POSTGRES_DB = "authentik";
};
}; };
labels = { "traefik.enable" = "false"; };
};
auth_redis = { auth_redis = {
image = "redis:alpine"; image = "redis:alpine";
hostname = "auth_redis"; hostname = "auth_redis";
volumes = [ ]; volumes = [ ];
environment = { }; environment = { };
labels = { "traefik.enable" = "false"; }; };
};
auth_server = { auth_server = {
image = "ghcr.io/goauthentik/server:latest"; image = "ghcr.io/goauthentik/server:latest";
hostname = "auth_server"; hostname = "auth_server";
volumes = [ volumes = [
"${serverCfg.dataPath}/authentik/media:/media" "${serverCfg.dataPath}/authentik/media:/media"
"${serverCfg.dataPath}/authentik/templates:/templates" "${serverCfg.dataPath}/authentik/templates:/templates"
]; ];
environment = { environment = {
"AUTHENTIK_REDIS__HOST" = "auth_redis"; "AUTHENTIK_REDIS__HOST" = "auth_redis";
"AUTHENTIK_POSTGRESQL__HOST" = "auth_postgresql"; "AUTHENTIK_POSTGRESQL__HOST" = "auth_postgresql";
"AUTHENTIK_POSTGRESQL__USER" = "authentik"; "AUTHENTIK_POSTGRESQL__USER" = "authentik";
"AUTHENTIK_POSTGRESQL__NAME" = "authentik"; "AUTHENTIK_POSTGRESQL__NAME" = "authentik";
"AUTHENTIK_POSTGRESQL__PASSWORD" = "AUTHENTIK_DB_PASSWORD"; "AUTHENTIK_POSTGRESQL__PASSWORD" = "AUTHENTIK_DB_PASSWORD";
"AUTHENTIK_SECRET_KEY" = "AUTHENTIK_SECRET_KEY"; "AUTHENTIK_SECRET_KEY" = "AUTHENTIK_SECRET_KEY";
"AUTHENTIK_EMAIL__HOST" = "${serverCfg.mailDomain}"; "AUTHENTIK_EMAIL__HOST" = "${serverCfg.mailDomain}";
"AUTHENTIK_EMAIL__PORT" = "587"; "AUTHENTIK_EMAIL__PORT" = "587";
"AUTHENTIK_EMAIL__USERNAME" = "noreply@${serverCfg.hostDomain}"; "AUTHENTIK_EMAIL__USERNAME" = "noreply@${serverCfg.hostDomain}";
"AUTHENTIK_EMAIL__PASSWORD" = "AUTHENTIK_EMAIL_PASSWORD"; "AUTHENTIK_EMAIL__PASSWORD" = "AUTHENTIK_EMAIL_PASSWORD";
"AUTHENTIK_EMAIL__USE_TLS" = "true"; "AUTHENTIK_EMAIL__USE_TLS" = "true";
"AUTHENTIK_EMAIL__USE_SSL" = "false"; "AUTHENTIK_EMAIL__USE_SSL" = "false";
"AUTHENTIK_EMAIL__TIMEOUT" = "10"; "AUTHENTIK_EMAIL__TIMEOUT" = "10";
"AUTHENTIK_EMAIL__FROM" = "sso@noreply.${serverCfg.hostDomain}"; "AUTHENTIK_EMAIL__FROM" = "sso@noreply.${serverCfg.hostDomain}";
};
labels = {
"traefik.enable" = "true";
"traefik.http.routers.sso.entrypoints" = "web-secure";
"traefik.http.routers.sso.rule" = "Host(`sso.${serverCfg.hostDomain}`)";
"traefik.http.routers.sso.tls" = "true";
"traefik.http.services.sso.loadbalancer.server.port" = "9000";
};
cmd = [ "server" ];
ports = [
"9999:9000"
];
}; };
labels = {
"traefik.enable" = "true";
"traefik.http.routers.sso.entrypoints" = "web-secure";
"traefik.http.routers.sso.rule" = "Host(`sso.${serverCfg.hostDomain}`)";
"traefik.http.routers.sso.tls" = "true";
"traefik.http.services.sso.loadbalancer.server.port" = "9000";
};
cmd = [ "server" ];
ports = [
"9999:9000"
];
};
auth_worker = { auth_worker = {
image = "ghcr.io/goauthentik/server:latest"; image = "ghcr.io/goauthentik/server:latest";
hostname = "auth_worker"; hostname = "auth_worker";
volumes = [ volumes = [
"${serverCfg.dataPath}/authentik/media:/media" "${serverCfg.dataPath}/authentik/media:/media"
"${serverCfg.dataPath}/authentik/templates:/templates" "${serverCfg.dataPath}/authentik/templates:/templates"
"/var/run/docker.sock:/var/run/docker.sock" "/var/run/docker.sock:/var/run/docker.sock"
]; ];
environment = { environment = {
"AUTHENTIK_REDIS__HOST" = "auth_redis"; "AUTHENTIK_REDIS__HOST" = "auth_redis";
"AUTHENTIK_POSTGRESQL__HOST" = "auth_postgresql"; "AUTHENTIK_POSTGRESQL__HOST" = "auth_postgresql";
"AUTHENTIK_POSTGRESQL__USER" = "authentik"; "AUTHENTIK_POSTGRESQL__USER" = "authentik";
"AUTHENTIK_POSTGRESQL__NAME" = "authentik"; "AUTHENTIK_POSTGRESQL__NAME" = "authentik";
"AUTHENTIK_POSTGRESQL__PASSWORD" = "AUTHENTIK_DB_PASSWORD"; "AUTHENTIK_POSTGRESQL__PASSWORD" = "AUTHENTIK_DB_PASSWORD";
"AUTHENTIK_SECRET_KEY" = "AUTHENTIK_SECRET_KEY"; "AUTHENTIK_SECRET_KEY" = "AUTHENTIK_SECRET_KEY";
};
cmd = [ "worker" ];
}; };
labels = { "traefik.enable" = "false"; };
cmd = [ "worker" ];
}; };
} }