From 5c3f0886e592ff2d3e3a8588ab496f36c19e0ce9 Mon Sep 17 00:00:00 2001
From: Grigory Shipunov
Date: Tue, 14 Jan 2025 21:24:05 +0000
Subject: yeet authentik, add keycloak and radicale

---
 hosts/cloud/proxy/auth.nix      | 24 ++++++++++++++++++++++++
 hosts/cloud/proxy/authentik.nix | 31 -------------------------------
 hosts/cloud/proxy/default.nix   | 27 +++++----------------------
 hosts/minime/uvm.nix            |  6 +++++-
 4 files changed, 34 insertions(+), 54 deletions(-)
 create mode 100644 hosts/cloud/proxy/auth.nix
 delete mode 100644 hosts/cloud/proxy/authentik.nix

(limited to 'hosts')

diff --git a/hosts/cloud/proxy/auth.nix b/hosts/cloud/proxy/auth.nix
new file mode 100644
index 0000000..27ee2ee
--- /dev/null
+++ b/hosts/cloud/proxy/auth.nix
@@ -0,0 +1,24 @@
+{ ... }:
+{
+  services.nginx.upstreams.keycloak = {
+    servers = {
+      "10.89.88.11:38080" = {};
+      "[fd31:185d:722f::11]:38080" = {};
+    };
+  };
+
+  services.nginx.virtualHosts."auth.oxapentane.com" = {
+    forceSSL = true;
+    enableACME = true;
+    locations."/" = {
+      proxyPass = "http://keycloak";
+      extraConfig = ''
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-Host $host;
+        proxy_set_header X-Forwarded-Port 433;
+      '';
+    };
+  };
+}
diff --git a/hosts/cloud/proxy/authentik.nix b/hosts/cloud/proxy/authentik.nix
deleted file mode 100644
index c6c9685..0000000
--- a/hosts/cloud/proxy/authentik.nix
+++ /dev/null
@@ -1,31 +0,0 @@
-# TODO: integrade with oxalab-wg
-{ config, ... }:
-{
-  # authentik
-  services.nginx.upstreams.authentik = {
-    extraConfig = ''
-          keepalive 10;
-    '';
-    servers =
-      {
-        "10.89.88.2:9000" = { };
-        "[fd31:185d:722f::2]:9000" = { };
-      };
-    };
-
-    services.nginx.virtualHosts."sso.oxapentane.com" = {
-      forceSSL = true;
-      enableACME = true;
-      locations."/" = {
-        proxyWebsockets = true;
-        proxyPass = "http://authentik";
-        extraConfig = ''
-          proxy_set_header X-Forwarded-Proto $scheme;
-          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-          proxy_set_header Host $host;
-          proxy_set_header Upgrade $http_upgrade;
-          proxy_set_header Connection $connection_upgrade;
-        '';
-      };
-    };
-  }
diff --git a/hosts/cloud/proxy/default.nix b/hosts/cloud/proxy/default.nix
index 046c807..798b34d 100644
--- a/hosts/cloud/proxy/default.nix
+++ b/hosts/cloud/proxy/default.nix
@@ -1,7 +1,7 @@
 { config, ... }:
 {
   imports = [
-    ./authentik.nix
+    ./auth.nix
   ];
 
   networking.firewall.allowedTCPPorts = [ 80 443 ];
@@ -12,24 +12,11 @@
     recommendedGzipSettings = true;
     recommendedOptimisation = true;
     recommendedTlsSettings = true;
+    recommendedProxySettings = true;
 
     sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL";
 
     appendHttpConfig = ''
-      ### recommendedProxySettings minus proxy_redirect (breaks authentik)
-      # proxy_redirect          off;
-      proxy_connect_timeout   60s;
-      proxy_send_timeout      60s;
-      proxy_read_timeout      60s;
-      proxy_http_version      1.1;
-      proxy_set_header        "Connection" "";
-      proxy_set_header        Host $host;
-      proxy_set_header        X-Real-IP $remote_addr;
-      proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
-      proxy_set_header        X-Forwarded-Proto $scheme;
-      proxy_set_header        X-Forwarded-Host $host;
-      proxy_set_header        X-Forwarded-Server $host;
-
       ### TLS
       # Add HSTS header with preloading to HTTPS requests.
       # Adding this header to HTTP requests is discouraged
@@ -39,13 +26,13 @@
       add_header Strict-Transport-Security $hsts_header;
 
       # Enable CSP for your services.
-      add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always;
+      # add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always;
 
       # Minimize information leaked to other domains
       add_header 'Referrer-Policy' 'origin-when-cross-origin';
 
       # Disable embedding as a frame
-      add_header X-Frame-Options DENY;
+      # add_header X-Frame-Options DENY;
 
       # Prevent injection of code in other mime types (XSS Attacks)
       add_header X-Content-Type-Options nosniff;
@@ -56,11 +43,7 @@
       enableACME = true;
       # default = true;
       locations."/" = {
-        return = "200 '<html><body><h1>¯\\_(ツ)_/¯</h1></body></html>'";
-        extraConfig = ''
-          default_type text/html;
-        '';
-
+        return = "503";
       };
     };
   };
diff --git a/hosts/minime/uvm.nix b/hosts/minime/uvm.nix
index 7f10579..0437cdf 100644
--- a/hosts/minime/uvm.nix
+++ b/hosts/minime/uvm.nix
@@ -2,7 +2,11 @@
 {
   microvm.stateDir = "/var/lib/microvms";
   microvm.vms = {
-    authentik = {
+    auth = {
+      flake = inputs.self;
+      updateFlake = "github:gshipunov/nix-config/master";
+    };
+    radicale = {
       flake = inputs.self;
       updateFlake = "github:gshipunov/nix-config/master";
     };
-- 
cgit v1.3.1