NyxErinys/Nix-Config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

add authentik

Browse source
This commit is contained in:
NyxErinys 2026-06-13 03:27:22 -05:00
parent 1b2b582c80
commit 59f75e7d71
5 changed files with 252 additions and 58 deletions
Download patch file Download diff file Expand all files Collapse all files

34
modules/k3s/default.nix
View file

@ -33,11 +33,23 @@ in
openiscsi
];
sops.secrets.k3s_token = {
format = "json";
key = "token";
sopsFile = "${inputs.secrets}/k3s.json";
};
sops.secrets = {
k3s_token = {
format = "json";
key = "token";
sopsFile = "${inputs.secrets}/cluster/k3s.json";
};
pg_pass = {
format = "json";
key = "pg-pass";
sopsFile = "${inputs.secrets}/cluster/authentik.json";
};
authentik_secret_key = {
format = "json";
key = "authentik-secret-key";
sopsFile = "${inputs.secrets}/cluster/authentik.json";
};
}
services.rpcbind.enable = true;
services.k3s = {
@ -49,14 +61,6 @@ in
disable = [];
};
# services.udev.packages = with pkgs; [
# openiscsi
# ];
# services.udev.extraRules = ''
# ACTION=="add", SUBSYSTEM=="scsi_host", KERNEL=="host*", RUN+="${pkgs.bash}/bin/sh -c 'echo - - - > /sys/class/scsi_host/%k/scan'"
# '';
systemd.services.k3s = {
restartTriggers = [
(builtins.toJSON config.services.k3s.manifests)
@ -66,10 +70,6 @@ in
wants = [ "rpcbind.service" ];
path = with pkgs; [
openiscsi
# util-linux
# kmod
# systemd
# udev
];
};

234
modules/k3s/deployments/authentik.nix
View file

@ -1,31 +1,225 @@
{ ... }:
{ config, ... }:
let
authentik-version = "2026.5.0"
in
{
authentik.content = [
{
apiVersion = "v1";
kind = "Pod";
metadata.name = "ubuntu-test";
apiVersion = "apps/v1";
kind = "Deployment";
metadata = {
name = "authentik";
labels.app = "authentik";
};
spec = {
containers = [
{
name = "ubuntu-test";
image = "ubuntu:latest";
command = [ "tail" "-f" "/dev/null" ];
volumeMounts = [
selector.matchLabels.app = "authentik";
template = {
metadata = {
labels.app = "authentik";
};
spec = {
securityContext = {
runAsUser = 1000;
runAsGroup = 1000;
};
containers = [
{
mountPath = "/test";
name = "test";
subPath = "ubuntu-test";
name = "authentik-postgres";
image = "docker.io/library/postgres:16-alpine";
env = [
{
name = "POSTGRES_DB";
value = "authentik";
}
{
name = "POSTGRES_USER";
value = "authentik";
}
{
name = "POSTGRES_PASSWORD";
valueFrom.secretKeyRef = {
name = "authentik-secrets";
key = "pg_pass";
};
}
];
livenessProbe = {
exec.command = [ "pg_isready" "-d" "authentik" "-U" "authentik" ];
initialDelaySeconds = 20;
failureThreshold = 5;
periodSeconds = 30;
timeoutSeconds = 5;
};
ports = [
{
name = "test-port";
containerPort = 80;
}
];
volumeMounts = [
{
mountPath = "/var/lib/postgresql/data";
name = "iscsi";
subPath = "postgres";
}
];
}
{
name = "authentik-server";
image = "ghcr.io/goauthentik/server:${authentik-version}";
args = "server";
env = [
{
name = "AUTHENTIK_POSTGRESQL__HOST";
value = "127.0.0.1";
}
{
name = "AUTHENTIK_POSTGRESQL__NAME";
value = "authentik";
}
{
name = "AUTHENTIK_POSTGRESQL__USER";
value = "authentik";
}
{
name = "AUTHENTIK_POSTGRESQL__PASSWORD";
valueFrom.secretKeyRef = {
name = "authentik-secrets";
key = "pg_pass";
};
}
{
name = "AUTHENTIK_SECRET_KEY";
valueFrom.secretKeyRef = {
name = "authentik-secrets";
key = "authentik_secret_key";
};
}
];
ports = [
{
name = "server-http";
containerPort = 9000;
}
{
name = "server-https";
containerPort = 9443;
}
];
volumeMounts = [
{
mountPath = "/data";
name = "iscsi";
subPath = "server/data";
}
{
mountPath = "/templates";
name = "iscsi";
subPath = "server/templates";
}
{
mountPath = "/dev/shm";
name = "dshm";
}
];
}
{
name = "authentik-server";
image = "ghcr.io/goauthentik/server:${authentik-version}";
args = "worker";
env = [
{
name = "AUTHENTIK_POSTGRESQL__HOST";
value = "127.0.0.1";
}
{
name = "AUTHENTIK_POSTGRESQL__NAME";
value = "authentik";
}
{
name = "AUTHENTIK_POSTGRESQL__USER";
value = "authentik";
}
{
name = "AUTHENTIK_POSTGRESQL__PASSWORD";
valueFrom.secretKeyRef = {
name = "authentik-secrets";
key = "pg_pass";
};
}
{
name = "AUTHENTIK_SECRET_KEY";
valueFrom.secretKeyRef = {
name = "authentik-secrets";
key = "authentik_secret_key";
};
}
];
volumeMounts = [
{
mountPath = "/data";
name = "iscsi";
subPath = "worker/data";
}
{
mountPath = "/templates";
name = "iscsi";
subPath = "worker/templates";
}
{
mountPath = "/certs";
name = "iscsi";
subPath = "worker/certs";
}
{
mountPath = "/dev/shm";
name = "dshm";
}
];
}
];
}
];
volumes = [
volumes = [
{
name = "iscsi";
iscsi = {
targetPortal = "10.5.0.2:3260";
iqn = "iqn.2026-01.dev.nyxerinys:poseidon.authentik";
lun = 0;
fsType = "xfs";
readOnly = false;
};
}
{
name = "dshm";
emptyDir = {
medium = "Memory";
sizeLimit = "1Gi";
};
}
];
};
};
};
}
{
apiVersion = "v1";
kind = "Service";
metadata.name = "authentik";
spec = {
type = "NodePort";
selector.app = "authentik";
ports = [
{
name = "test";
persistentVolumeClaim = {
claimName = "nfs-main-pvc";
};
name = "authentik-http";
portocol = "TCP";
port = 9000;
nodePort = 30000;
}
{
name = "authentik-https";
portocol = "TCP";
port = 9443;
nodePort = 30001;
}
];
};

19
modules/k3s/deployments/ubuntu-test.nix
View file

@ -32,15 +32,6 @@
name = "test";
subPath = "ubuntu-test";
}
{
mountPath = "/test2";
name = "iscsi";
}
{
mountPath = "/test3";
name = "iscsi";
subPath = "test";
}
];
}
];
@ -51,16 +42,6 @@
claimName = "nfs-main-pvc";
};
}
{
name = "iscsi";
iscsi = {
targetPortal = "10.5.0.2:3260";
iqn = "iqn.2026-01.dev.nyxerinys:poseidon.authentik";
lun = 0;
fsType = "xfs";
readOnly = false;
};
}
];
};
};

19
modules/k3s/secrets.nix Normal file
View file

@ -0,0 +1,19 @@
{ config, ... }:
{
sops.templates = {
"authentik-secrets.yaml" = {
content = ''
apiVersion: v1
kind: Secret
metadata:
name: authentik-secrets
namespace: default
type: Opaque
stringData:
pg_pass: ${config.sops.placeholder."pg_pass"}
authentik_secret_key: ${config.sops.placeholder."authentik_secret_key"}
'';
path = "/var/lib/rancher/k3s/server/manifests/authentik-secrets.yaml";
}
};
}