85 lines
2.7 KiB
Nix
85 lines
2.7 KiB
Nix
{ config, containerCfg, pkgs, lib, ... }:
|
|
let
|
|
serverCfg = config.syscfg.server;
|
|
in {
|
|
paths = [{
|
|
path="${serverCfg.dataPath}/authentik/media";
|
|
owner = "1000:1000";
|
|
mode = "0755";
|
|
}{
|
|
path="${serverCfg.dataPath}/authentik/templates";
|
|
owner = "1000:1000";
|
|
mode = "0755";
|
|
}];
|
|
|
|
containers = {
|
|
|
|
auth_server = {
|
|
image = "ghcr.io/goauthentik/server:latest";
|
|
hostname = "auth_server";
|
|
volumes = [
|
|
"${serverCfg.dataPath}/authentik/media:/media"
|
|
"${serverCfg.dataPath}/authentik/templates:/templates"
|
|
];
|
|
environmentFiles = [
|
|
config.sops.secrets."AUTHENTIK".path
|
|
];
|
|
environment = {
|
|
"AUTHENTIK_REDIS__HOST" = "host.containers.internal";
|
|
"AUTHENTIK_POSTGRESQL__HOST" = "host.containers.internal";
|
|
"AUTHENTIK_POSTGRESQL__USER" = "authentik_user";
|
|
"AUTHENTIK_POSTGRESQL__NAME" = "authentik_db";
|
|
"AUTHENTIK_EMAIL__HOST" = "${serverCfg.mailDomain}";
|
|
"AUTHENTIK_EMAIL__PORT" = "587";
|
|
"AUTHENTIK_EMAIL__USERNAME" = "noreply@${serverCfg.hostDomain}";
|
|
"AUTHENTIK_EMAIL__USE_TLS" = "true";
|
|
"AUTHENTIK_EMAIL__USE_SSL" = "false";
|
|
"AUTHENTIK_EMAIL__TIMEOUT" = "10";
|
|
"AUTHENTIK_EMAIL__FROM" = "sso@noreply.${serverCfg.hostDomain}";
|
|
};
|
|
labels = {
|
|
"traefik.enable" = "true";
|
|
"traefik.http.routers.sso.entrypoints" = "web-secure";
|
|
"traefik.http.routers.sso.rule" = "Host(`sso.${serverCfg.hostDomain}`)";
|
|
"traefik.http.routers.sso.tls" = "true";
|
|
"traefik.http.services.sso.loadbalancer.server.port" = "${toString containerCfg.port}";
|
|
};
|
|
cmd = [ "server" ];
|
|
extraOptions = [
|
|
"--add-host=host.containers.internal:host-gateway"
|
|
"--replace"
|
|
"--rm"
|
|
"--ip=${containerCfg.ip}"
|
|
];
|
|
ports = [
|
|
"9999:${toString containerCfg.port}"
|
|
];
|
|
};
|
|
|
|
auth_worker = {
|
|
image = "ghcr.io/goauthentik/server:latest";
|
|
hostname = "auth_worker";
|
|
volumes = [
|
|
"${serverCfg.dataPath}/authentik/media:/media"
|
|
"${serverCfg.dataPath}/authentik/templates:/templates"
|
|
"/var/run/docker.sock:/var/run/docker.sock"
|
|
];
|
|
environmentFiles = [
|
|
config.sops.secrets."AUTHENTIK".path
|
|
];
|
|
environment = {
|
|
"AUTHENTIK_REDIS__HOST" = "host.containers.internal";
|
|
"AUTHENTIK_POSTGRESQL__HOST" = "host.containers.internal";
|
|
"AUTHENTIK_POSTGRESQL__USER" = "authentik_user";
|
|
"AUTHENTIK_POSTGRESQL__NAME" = "authentik_db";
|
|
};
|
|
extraOptions = [
|
|
"--add-host=host.containers.internal:host-gateway"
|
|
"--replace"
|
|
"--rm"
|
|
];
|
|
cmd = [ "worker" ];
|
|
};
|
|
};
|
|
}
|