StuRa/stura-infra
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

move authentik to new file

Browse source
This commit is contained in:
Bereich Administration Rechentechnik 2025-01-29 10:15:52 +01:00
parent 02ba4fa6ad
commit e20ddd3bbf
2 changed files with 2 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

2
authentik.nix
View file

@ -1,4 +1,4 @@
{ config, lib, pkgs, ... }:{ { config, lib, pkgs, ... }: {
users.groups.authentik = { }; users.groups.authentik = { };
users.users.authentik = { users.users.authentik = {
isSystemUser = true; isSystemUser = true;

31
configuration.nix
View file

@ -4,6 +4,7 @@
imports = imports =
[ [
./hardware-configuration.nix ./hardware-configuration.nix
./authentik.nix
]; ];
security.pam.loginLimits = [{ security.pam.loginLimits = [{
@ -36,12 +37,6 @@
useXkbConfig = true; # use xkb.options in tty. useXkbConfig = true; # use xkb.options in tty.
}; };
users.groups.authentik = { };
users.users.authentik = {
isSystemUser = true;
extraGroups = [ "docker" ];
group = "authentik";
};
users.users.administration = { users.users.administration = {
isNormalUser = true; isNormalUser = true;
extraGroups = [ "wheel" "docker" ]; # Enable ‘sudo’ for the user. extraGroups = [ "wheel" "docker" ]; # Enable ‘sudo’ for the user.
@ -60,30 +55,6 @@
]; ];
services.openssh.enable = true; services.openssh.enable = true;
services.authentik = {
enable = true;
# The environmentFile needs to be on the target host!
# Best use something like sops-nix or agenix to manage it
environmentFile = "/var/lib/authentik_secret";
settings = {
email = {
host = "mail.stura.htw-dresden.de";
port = 25;
username = "authentik@stura.htw-dresden.de";
use_tls = false;
use_ssl = false;
from = "authentik@stura.htw-dresden.de";
};
disable_startup_analytics = true;
avatars = "initials";
};
nginx = {
enable = true;
enableACME = true;
host = "auth.htw.stura-dresden.de";
};
};
services.dovecot2 = { services.dovecot2 = {
extraConfig = '' extraConfig = ''
auth_verbose = yes auth_verbose = yes