tower: WIP kanidm service

1 files changed, 54 insertions, 0 deletions

diff --git a/hosts/tower/web/idm.nix b/hosts/tower/web/idm.nix
new file mode 100644
index 0000000..8c93097
--- /dev/null
+++ b/hosts/tower/web/idm.nix
@@ -0,0 +1,54 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  inherit (lib)
+    mkIf
+    mkForce
+    ;
+
+  cfg = config.services.kanidm.server;
+  domainName = "idm.sorre.xyz";
+in
+{
+  security.acme."${domainName}" = {
+    group = "kanidm";
+    postRun = ''
+      cp --dereference --verbose {cert,key,chain}.pem /var/lib/kanidm/
+      chown kanidm:kanidm /var/lib/kanidm/{cert,key,chain}.pem
+      chmod 400 /var/lib/kanidm/{cert,key,chain}.pem
+    '';
+    reloadServices = [ "kanidm.service" ];
+  };
+
+  services.kanidm = {
+    package = pkgs.kanidm_1_11;
+    server = {
+      enable = false;
+      settings = {
+        version = "2";
+        role = "WriteReplica";
+        bindaddress = "127.0.0.1:8443";
+        domain = domainName;
+        origin = "https://${domainName}";
+        online_backup = {
+          path = "/var/lib/backups/kanidm";
+          # at 22:00 every day
+          schedule = "00 22 * * *";
+          versions = 5;
+        };
+
+        tls_chain = "/var/lib/kanidm/chain.pem";
+        tls_key = "/var/lib/kanidm/key.pem";
+      };
+    };
+  };
+
+  systemd.services.kanidm = mkIf cfg.enable {
+    # TODO: backups that aren't editable by the service itself
+    serviceConfig.StateDirectory = mkForce "kanidm backups/kanidm";
+  };
+}