depot/hosts/VEGAS/services/sso/default.nix

58 lines
1.7 KiB
Nix
Raw Normal View History

2022-08-07 23:54:59 +03:00
{ cluster, config, inputs, lib, pkgs, tools, ... }:
2021-10-16 21:24:30 +03:00
with tools.nginx;
let
login = "login.${tools.meta.domain}";
2022-06-18 03:44:51 +03:00
kc = config.links.keycloak;
2022-08-07 23:54:59 +03:00
patroni = cluster.config.links.patroni-pg-access;
2021-10-16 21:24:30 +03:00
in
{
2022-06-18 03:44:51 +03:00
links.keycloak.protocol = "http";
2021-11-29 02:38:59 +02:00
2021-10-16 21:24:30 +03:00
imports = [
./identity-management.nix
];
age.secrets.keycloak-dbpass = {
file = ../../../../secrets/keycloak-dbpass.age;
owner = "root";
group = "root";
mode = "0400";
};
services.nginx.virtualHosts = {
2022-06-18 03:44:51 +03:00
"${login}" = lib.recursiveUpdate (vhosts.proxy kc.url) {
2021-10-16 21:24:30 +03:00
locations."= /".return = "302 /auth/realms/master/account/";
};
"account.${domain}" = vhosts.redirect "https://${login}/auth/realms/master/account/";
};
services.keycloak = {
enable = true;
2022-07-31 23:36:07 +03:00
package = inputs.self.packages.${pkgs.system}.keycloak;
2021-10-16 21:24:30 +03:00
database = {
2022-08-07 23:54:59 +03:00
createLocally = false;
2021-10-16 21:24:30 +03:00
type = "postgresql";
2022-08-07 23:54:59 +03:00
host = patroni.ipv4;
inherit (patroni) port;
useSSL = false;
2021-10-16 21:24:30 +03:00
passwordFile = config.age.secrets.keycloak-dbpass.path;
};
2022-05-30 23:00:21 +03:00
settings = {
2022-06-18 03:44:51 +03:00
http-host = kc.ipv4;
http-port = kc.port;
2022-05-30 23:00:21 +03:00
hostname = login;
proxy = "edge";
# for backcompat, TODO: remove
http-relative-path = "/auth";
2021-10-16 21:24:30 +03:00
};
};
2022-06-19 01:16:25 +03:00
systemd.services.keycloak.environment = {
JAVA_OPTS = builtins.concatStringsSep " " [
"-javaagent:${inputs.self.packages.${pkgs.system}.opentelemetry-java-agent-bin}"
"-Dotel.resource.attributes=service.name=keycloak"
"-Dotel.traces.exporter=otlp"
];
OTEL_EXPORTER_OTLP_PROTOCOL = "grpc";
OTEL_EXPORTER_OTLP_ENDPOINT = config.links.tempo-otlp-grpc.url;
OTEL_TRACES_SAMPLER = "parentbased_traceidratio";
OTEL_TRACES_SAMPLER_ARG = "0.01";
};
2021-10-16 21:24:30 +03:00
}