tower: WIP kanidm service

3 files changed, 73 insertions, 0 deletions

diff --git a/hosts/tower/web/caddy.nix b/hosts/tower/web/caddy.nix
index 5979806..21e564b 100644
--- a/hosts/tower/web/caddy.nix
+++ b/hosts/tower/web/caddy.nix
@@ -26,6 +26,10 @@ let
     domain = config.services.cgit.internal.nginx.virtualHost;
     port = 1923;
   };
+  kanidm = {
+    domain = config.services.kanidm.server.settings.domain;
+    port = 8443;
+  };
   blog.port = 7291;
 
   tls-config = "tls {$CREDENTIALS_DIRECTORY}/sorre.internal.crt {$CREDENTIALS_DIRECTORY}/sorre.internal.key";
@@ -101,6 +105,16 @@ in
           }
         '';
       };
+
+      "${kanidm.domain}" = lib.mkIf config.services.kanidm.server.enable {
+        listenAddresses = [ wg-ip ];
+        extraConfig = ''
+          reverse_proxy :${toString kanidm.port} {
+            header_up True-Client-IP {remote_host}
+            header_up X-Real-IP {remote_host}
+          }
+        '';
+      };
     };
   };
 
diff --git a/hosts/tower/web/default.nix b/hosts/tower/web/default.nix
index 556c8c4..3e8c046 100644
--- a/hosts/tower/web/default.nix
+++ b/hosts/tower/web/default.nix
@@ -7,5 +7,10 @@
     ./vaultwarden.nix
     ./caddy.nix
     ./kanboard.nix
+    ./idm.nix
   ];
+
+  security.acme.defaults = {
+    email = "isabella@sorre.xyz";
+  };
 }
diff --git a/hosts/tower/web/idm.nix b/hosts/tower/web/idm.nix
new file mode 100644
index 0000000..8c93097
--- /dev/null
+++ b/hosts/tower/web/idm.nix
@@ -0,0 +1,54 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  inherit (lib)
+    mkIf
+    mkForce
+    ;
+
+  cfg = config.services.kanidm.server;
+  domainName = "idm.sorre.xyz";
+in
+{
+  security.acme."${domainName}" = {
+    group = "kanidm";
+    postRun = ''
+      cp --dereference --verbose {cert,key,chain}.pem /var/lib/kanidm/
+      chown kanidm:kanidm /var/lib/kanidm/{cert,key,chain}.pem
+      chmod 400 /var/lib/kanidm/{cert,key,chain}.pem
+    '';
+    reloadServices = [ "kanidm.service" ];
+  };
+
+  services.kanidm = {
+    package = pkgs.kanidm_1_11;
+    server = {
+      enable = false;
+      settings = {
+        version = "2";
+        role = "WriteReplica";
+        bindaddress = "127.0.0.1:8443";
+        domain = domainName;
+        origin = "https://${domainName}";
+        online_backup = {
+          path = "/var/lib/backups/kanidm";
+          # at 22:00 every day
+          schedule = "00 22 * * *";
+          versions = 5;
+        };
+
+        tls_chain = "/var/lib/kanidm/chain.pem";
+        tls_key = "/var/lib/kanidm/key.pem";
+      };
+    };
+  };
+
+  systemd.services.kanidm = mkIf cfg.enable {
+    # TODO: backups that aren't editable by the service itself
+    serviceConfig.StateDirectory = mkForce "kanidm backups/kanidm";
+  };
+}