4 files changed, 14 insertions, 45 deletions
diff --git a/hosts/auth/authentik.nix b/hosts/auth/authentik.nix
new file mode 100644
index 0000000..00589ab
--- /dev/null
+++ b/hosts/auth/authentik.nix
@@ -0,0 +1,13 @@
+{ config, ... }:
+{
+  sops.secrets."authentik/env" = {};
+  services.authentik = {
+    enable = true;
+    environmentFile = config.sops.secrets."authentik/env".path;
+    settings = {
+      log_level = "debug";
+      disable_startup_analytics = true;
+      avatars = "initials";
+    };
+  };
+}
diff --git a/hosts/auth/default.nix b/hosts/auth/default.nix
index 95e3153..de5044d 100644
--- a/hosts/auth/default.nix
+++ b/hosts/auth/default.nix
@@ -4,8 +4,7 @@ let
 in
 {
   imports = [
-    ./keycloak.nix
-    ./oauth2-proxy.nix
+    ./authentik.nix
   ];
   sops.defaultSopsFile = ./secrets.yaml;
   sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
diff --git a/hosts/auth/keycloak.nix b/hosts/auth/keycloak.nix
deleted file mode 100644
index de537ef..0000000
--- a/hosts/auth/keycloak.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-{ config, ... }:
-{
-  services.keycloak = {
-    enable = true;
-    database = {
-      type = "postgresql";
-      createLocally = true;
-      passwordFile = config.sops.secrets."keycloak/db_pass".path;
-    };
-    settings = {
-      hostname = "https://auth.oxapentane.com";
-      http-port = 38080;
-      http-enabled = true;
-      proxy-headers = "xforwarded";
-      proxy-trusted-addresses = "10.89.88.0/24,fd31:185d:722f::/48";
-    };
-  };
-}
diff --git a/hosts/auth/oauth2-proxy.nix b/hosts/auth/oauth2-proxy.nix
deleted file mode 100644
index 81cdf8f..0000000
--- a/hosts/auth/oauth2-proxy.nix
+++ /dev/null
@@ -1,25 +0,0 @@
-{ config, ... }:
-{
-  sops.secrets."oauth2-proxy/env" = {
-    owner = config.users.users.oauth2-proxy.name;
-  };
-
-  services.oauth2-proxy = {
-    enable = true;
-    reverseProxy = true;
-    provider = "keycloak-oidc";
-    httpAddress = "0.0.0.0:4180";
-    oidcIssuerUrl = "https://auth.oxapentane.com/realms/0xalab-prod";
-    clientID = "radicale-proxy";
-    redirectURL = "https://dav.oxapentane.com/oauth2/callback";
-    keyFile = config.sops.secrets."oauth2-proxy/env".path;
-    scope = "openid";
-    email.domains = [ "*" ];
-    setXauthrequest = true;
-    cookie = {
-      secure = true;
-      refresh = "48h0m0s";
-      domain = ".oxapentane.com";
-    };
-  };
-}