Skip to content
This repository was archived by the owner on Sep 14, 2025. It is now read-only.

Commit 503144f

Browse files
felbingerfelbinger
committed
peering-manager: restructure
1 parent a5e8893 commit 503144f

File tree

1 file changed

+108
-75
lines changed

1 file changed

+108
-75
lines changed

‎modules/peering-manager.nix‎

Lines changed: 108 additions & 75 deletions
Original file line numberDiff line numberDiff line change
@@ -4,123 +4,156 @@
44
pkgs,
55
...
66
}:
7+
let
8+
cfg = config.secshell.peering-manager;
9+
inherit (lib)
10+
mkIf
11+
types
12+
mkEnableOption
13+
mkOption
14+
mkMerge
15+
;
16+
in
717
{
818
options.secshell.peering-manager = {
9-
enable = lib.mkEnableOption "peering-manager";
10-
domain = lib.mkOption {
11-
type = lib.types.str;
19+
enable = mkEnableOption "peering-manager";
20+
domain = mkOption {
21+
type = types.str;
1222
default = "peering-manager.${toString config.networking.fqdn}";
1323
defaultText = "peering-manager.\${toString config.networking.fqdn}";
1424
description = ''
1525
The primary domain name for this service.
1626
Used for virtual host configuration, TLS certificates, and service URLs.
1727
'';
1828
};
19-
internal_port = lib.mkOption {
20-
type = lib.types.port;
29+
internal_port = mkOption {
30+
type = types.port;
2131
description = ''
2232
The local port the service listens on.
2333
'';
2434
};
2535
oidc = {
26-
domain = lib.mkOption {
27-
type = lib.types.str;
36+
domain = mkOption {
37+
type = types.str;
2838
default = "";
2939
description = ''
3040
The open id connect server used for authentication.
3141
Leave null to disable oidc authentication.
3242
'';
3343
};
34-
realm = lib.mkOption {
35-
type = lib.types.str;
44+
realm = mkOption {
45+
type = types.str;
3646
default = "main";
3747
description = ''
3848
The realm to use for the open id connect authentication.
3949
'';
4050
};
41-
clientId = lib.mkOption {
42-
type = lib.types.str;
43-
default = config.secshell.peering-manager.domain;
51+
clientId = mkOption {
52+
type = types.str;
53+
default = cfg.domain;
4454
defaultText = "config.secshell.peering-manager.domain";
4555
description = ''
4656
The client id for the open id connect authentication.
4757
'';
4858
};
4959
};
5060
};
51-
config = lib.mkIf config.secshell.peering-manager.enable {
52-
sops = {
53-
secrets = {
54-
"peering-manager/secretKey".owner = "peering-manager";
55-
}
56-
// (lib.optionalAttrs (config.secshell.peering-manager.oidc.domain != "") {
57-
"peering-manager/oidcSecret".owner = "peering-manager";
58-
});
61+
config = mkIf cfg.enable (mkMerge [
62+
# base
63+
{
64+
sops.secrets."peering-manager/secretKey".owner = "peering-manager";
5965

60-
templates."peering-manager/oidc-config".content = ''
61-
# CLIENT_ID and SECRET are required to authenticate against the provider
62-
OIDC_RP_CLIENT_ID = "${config.secshell.peering-manager.oidc.clientId}"
63-
OIDC_RP_CLIENT_SECRET = "${config.sops.placeholder."peering-manager/oidcSecret"}"
66+
services = {
67+
postgresql = {
68+
enable = true;
69+
ensureDatabases = [ "peering-manager" ];
70+
};
71+
};
6472

65-
# The following two may be required depending on your provider,
66-
# check the configuration endpoint for JWKS information
67-
OIDC_RP_SIGN_ALGO = "RS256"
68-
OIDC_OP_JWKS_ENDPOINT = "https://${config.secshell.peering-manager.oidc.domain}/realms/${config.secshell.peering-manager.oidc.realm}/protocol/openid-connect/certs"
73+
services = {
74+
peering-manager = {
75+
enable = true;
76+
secretKeyFile = config.sops.secrets."peering-manager/secretKey".path;
77+
port = cfg.internal_port;
78+
listenAddress = "127.0.0.1";
6979

70-
# Refer to the configuration endpoint of your provider
71-
OIDC_OP_AUTHORIZATION_ENDPOINT = "https://${config.secshell.peering-manager.oidc.domain}/realms/${config.secshell.peering-manager.oidc.realm}/protocol/openid-connect/auth"
72-
OIDC_OP_TOKEN_ENDPOINT = "https://${config.secshell.peering-manager.oidc.domain}/realms/${config.secshell.peering-manager.oidc.realm}/protocol/openid-connect/token"
73-
OIDC_OP_USER_ENDPOINT = "https://${config.secshell.peering-manager.oidc.domain}/realms/${config.secshell.peering-manager.oidc.realm}/protocol/openid-connect/userinfo"
80+
settings = {
81+
LOGIN_REQUIRED = true;
82+
TIME_ZONE = "Europe/Berlin";
83+
ALLOWED_HOSTS = [ (toString cfg.domain) ];
84+
};
85+
};
86+
nginx = {
87+
enable = true;
88+
virtualHosts."${toString cfg.domain}" = {
89+
locations = {
90+
"/".proxyPass = "http://127.0.0.1:${toString cfg.internal_port}";
91+
"/static/".alias = "${pkgs.peering-manager}/opt/peering-manager/static/";
92+
};
93+
serverName = toString cfg.domain;
7494

75-
# Set these to the base path of your Peering Manager installation
76-
LOGIN_REDIRECT_URL = "https://${config.secshell.peering-manager.domain}"
77-
LOGOUT_REDIRECT_URL = "https://${config.secshell.peering-manager.domain}"
95+
# use ACME DNS-01 challenge
96+
useACMEHost = toString cfg.domain;
97+
forceSSL = true;
98+
};
99+
};
100+
};
101+
security.acme.certs."${toString cfg.domain}" = { };
102+
}
78103

79-
# If this is True, new users will be created if not yet existing.
80-
OIDC_CREATE_USER = True
81-
'';
82-
templates."peering-manager/oidc-config".owner = "peering-manager";
83-
};
104+
# external database
105+
{
106+
# the nixpkgs module configures a local postgres instance, which we a simply not using
107+
# disabling postgres in this postgres module might cause trouble with other modules that should use a local postgres instance
108+
# TODO
109+
#services.peering-manager.settings.DATABASE = {
110+
# NAME = "peering-manager";
111+
# USER = "peering-manager";
112+
# HOST = "/run/postgresql";
113+
#};
114+
}
84115

85-
services = {
86-
postgresql = {
87-
enable = true;
88-
ensureDatabases = [ "peering-manager" ];
89-
};
90-
};
116+
# oidc
117+
# TODO requires adjustments for https://github.com/NixOS/nixpkgs/pull/382862
118+
(mkIf (cfg.oidc.domain != "") {
119+
sops = {
120+
secrets = (
121+
lib.optionalAttrs (cfg.oidc.domain != "") {
122+
"peering-manager/oidcSecret".owner = "peering-manager";
123+
}
124+
);
125+
126+
templates."peering-manager/oidc-config" = {
127+
content = ''
128+
# CLIENT_ID and SECRET are required to authenticate against the provider
129+
OIDC_RP_CLIENT_ID = "${cfg.oidc.clientId}"
130+
OIDC_RP_CLIENT_SECRET = "${config.sops.placeholder."peering-manager/oidcSecret"}"
131+
132+
# The following two may be required depending on your provider,
133+
# check the configuration endpoint for JWKS information
134+
OIDC_RP_SIGN_ALGO = "RS256"
135+
OIDC_OP_JWKS_ENDPOINT = "https://${cfg.oidc.domain}/realms/${cfg.oidc.realm}/protocol/openid-connect/certs"
136+
137+
# Refer to the configuration endpoint of your provider
138+
OIDC_OP_AUTHORIZATION_ENDPOINT = "https://${cfg.oidc.domain}/realms/${cfg.oidc.realm}/protocol/openid-connect/auth"
139+
OIDC_OP_TOKEN_ENDPOINT = "https://${cfg.oidc.domain}/realms/${cfg.oidc.realm}/protocol/openid-connect/token"
140+
OIDC_OP_USER_ENDPOINT = "https://${cfg.oidc.domain}/realms/${cfg.oidc.realm}/protocol/openid-connect/userinfo"
91141
92-
services = {
93-
peering-manager = {
94-
enable = true;
95-
secretKeyFile = config.sops.secrets."peering-manager/secretKey".path;
96-
port = config.secshell.peering-manager.internal_port;
97-
listenAddress = "127.0.0.1";
98-
enableOidc = config.secshell.peering-manager.oidc.domain != "";
99-
oidcConfigPath = lib.mkIf (
100-
config.secshell.peering-manager.oidc.domain != ""
101-
) config.sops.templates."peering-manager/oidc-config".path;
142+
# Set these to the base path of your Peering Manager installation
143+
LOGIN_REDIRECT_URL = "https://${cfg.domain}"
144+
LOGOUT_REDIRECT_URL = "https://${cfg.domain}"
102145
103-
settings = {
104-
LOGIN_REQUIRED = true;
105-
TIME_ZONE = "Europe/Berlin";
106-
ALLOWED_HOSTS = [ (toString config.secshell.peering-manager.domain) ];
146+
# If this is True, new users will be created if not yet existing.
147+
OIDC_CREATE_USER = True
148+
'';
149+
owner = "peering-manager";
107150
};
108151
};
109-
nginx = {
110-
enable = true;
111-
virtualHosts."${toString config.secshell.peering-manager.domain}" = {
112-
locations = {
113-
"/".proxyPass = "http://127.0.0.1:${toString config.secshell.peering-manager.internal_port}";
114-
"/static/".alias = "${pkgs.peering-manager}/opt/peering-manager/static/";
115-
};
116-
serverName = toString config.secshell.peering-manager.domain;
117152

118-
# use ACME DNS-01 challenge
119-
useACMEHost = toString config.secshell.peering-manager.domain;
120-
forceSSL = true;
121-
};
153+
services.peering-manager = {
154+
enableOidc = true;
155+
oidcConfigPath = config.sops.templates."peering-manager/oidc-config".path;
122156
};
123-
};
124-
security.acme.certs."${toString config.secshell.peering-manager.domain}" = { };
125-
};
157+
})
158+
]);
126159
}

0 commit comments

Comments
 (0)