NyxErinys/Nix-Config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

vaultwarden sso enable

Browse source
This commit is contained in:
nyxerinys 2026-07-15 02:13:07 -05:00
parent af5709d932
commit cdd9297e35
4 changed files with 89 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

10
modules/k3s/default.nix
View file

@ -66,16 +66,6 @@ in
key = "token";
sopsFile = "${inputs.secrets}/cluster/k3s.json";
};
pg_pass = {
format = "json";
key = "pg-pass";
sopsFile = "${inputs.secrets}/cluster/authentik.json";
};
authentik_secret_key = {
format = "json";
key = "authentik-secret-key";
sopsFile = "${inputs.secrets}/cluster/authentik.json";
};
};
services.rpcbind.enable = true;

24
modules/k3s/deployments/vaultwarden.nix
View file

@ -29,6 +29,30 @@
containerPort = 80;
}
];
env = [
{ name = "DOMAIN"; value = "https://vault.nyxerinys.dev"; }
{ name = "SSO_ENABLED"; value = "true"; }
{ name = "SSO_AUTHORITY"; value = "https://authentik.company/application/o/vaultwarden/"; }
{ name = "SSO_SCOPES"; value = "email profile offline_access"; }
{ name = "SSO_ALLOW_UNKNOWN_EMAIL_VERIFICATION"; value = "false"; }
{ name = "SSO_CLIENT_CACHE_EXPIRATION"; value = "0"; }
{ name = "SSO_ONLY"; value = "true"; }
{ name = "SSO_SIGNUPS_MATCH_EMAIL"; value = "true"; }
{
name = "SSO_CLIENT_ID";
valueFrom.secretKeyRef = {
name = "vaultwarden-secrets";
key = "sso_client_id";
};
}
{
name = "SSO_CLIENT_SECRET";
valueFrom.secretKeyRef = {
name = "vaultwarden-secrets";
key = "sso_client_secret";
};
}
];
volumeMounts = [
{
mountPath = "/data";

68
modules/k3s/secrets.nix
View file

@ -4,20 +4,58 @@ let
cfg = config.nyxs-nix.services.k3s;
in
{
sops.templates = mkIf cfg.enable {
"authentik-secrets.yaml" = {
content = ''
apiVersion: v1
kind: Secret
metadata:
name: authentik-secrets
namespace: default
type: Opaque
stringData:
pg_pass: ${config.sops.placeholder."pg_pass"}
authentik_secret_key: ${config.sops.placeholder."authentik_secret_key"}
'';
path = "/var/lib/rancher/k3s/server/manifests/authentik-secrets.yaml";
};
sops = mkIf cfg.enable {
secrets = {
pg_pass = {
format = "json";
key = "pg-pass";
sopsFile = "${inputs.secrets}/cluster/authentik.json";
};
authentik_secret_key = {
format = "json";
key = "authentik-secret-key";
sopsFile = "${inputs.secrets}/cluster/authentik.json";
};
sso_client_id = {
format = "json";
key = "sso_client_id";
sopsFile = "${inputs.secrets}/cluster/vaultwarden.json";
};
sso_client_secret = {
format = "json";
key = "sso_client_secret";
sopsFile = "${inputs.secrets}/cluster/vaultwarden.json";
}
};
templates = {
"authentik-secrets.yaml" = {
content = ''
apiVersion: v1
kind: Secret
metadata:
name: authentik-secrets
namespace: default
type: Opaque
stringData:
pg_pass: ${config.sops.placeholder."pg_pass"}
authentik_secret_key: ${config.sops.placeholder."authentik_secret_key"}
'';
path = "/var/lib/rancher/k3s/server/manifests/authentik-secrets.yaml";
};
"vaultwarden-secrets.yaml" = {
content = ''
apiVersion: v1
kind: Secret
metadata:
name: vaultwarden-secrets
namespace: default
type: Opaque
stringData:
sso_client_id: ${config.sops.placeholder."sso_client_id"}
sso_client_secret: ${config.sops.placeholder."sso_client_secret"}
'';
path = "/var/lib/rancher/k3s/server/manifests/vaultwarden-secrets.yaml";
};
};
};
}