diff --git a/flake.lock b/flake.lock index 4eda9cf..5a5469a 100644 --- a/flake.lock +++ b/flake.lock @@ -1,5 +1,50 @@ { "nodes": { + "authentik-nix": { + "inputs": { + "authentik-src": "authentik-src", + "flake-compat": "flake-compat", + "flake-parts": "flake-parts", + "flake-utils": "flake-utils", + "nixpkgs": [ + "nixpkgs" + ], + "pyproject-build-systems": "pyproject-build-systems", + "pyproject-nix": "pyproject-nix", + "systems": "systems", + "uv2nix": "uv2nix" + }, + "locked": { + "lastModified": 1784669668, + "narHash": "sha256-t4TOTPaVDPmt7mSYARkhrq0OWFMqUFs4AZy/g64FAvY=", + "owner": "nix-community", + "repo": "authentik-nix", + "rev": "4e051db3737539af7d122430749fb4b1291c68cc", + "type": "github" + }, + "original": { + "owner": "nix-community", + "repo": "authentik-nix", + "type": "github" + } + }, + "authentik-src": { + "flake": false, + "locked": { + "lastModified": 1784135630, + "narHash": "sha256-9+43EXq4N1ecAIMyz8zGJRVkEc39LjhU11/cXAtGhN4=", + "owner": "goauthentik", + "repo": "authentik", + "rev": "8f35dc72e2b8f832dce5f385f3bf3830f7791d26", + "type": "github" + }, + "original": { + "owner": "goauthentik", + "ref": "version/2026.5.5", + "repo": "authentik", + "type": "github" + } + }, "cachyos-kernel": { "flake": false, "locked": { @@ -33,6 +78,22 @@ } }, "flake-compat": { + "flake": false, + "locked": { + "lastModified": 1767039857, + "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=", + "owner": "edolstra", + "repo": "flake-compat", + "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab", + "type": "github" + }, + "original": { + "owner": "edolstra", + "repo": "flake-compat", + "type": "github" + } + }, + "flake-compat_2": { "flake": false, "locked": { "lastModified": 1767039857, @@ -67,6 +128,24 @@ } }, "flake-parts_2": { + "inputs": { + "nixpkgs-lib": "nixpkgs-lib_2" + }, + "locked": { + "lastModified": 1782949081, + "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=", + "owner": "hercules-ci", + "repo": "flake-parts", + "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e", + "type": "github" + }, + "original": { + "owner": "hercules-ci", + "repo": "flake-parts", + "type": "github" + } + }, + "flake-parts_3": { "inputs": { "nixpkgs-lib": [ "nixvim", @@ -90,7 +169,28 @@ }, "flake-utils": { "inputs": { - "systems": "systems" + "systems": [ + "authentik-nix", + "systems" + ] + }, + "locked": { + "lastModified": 1731533236, + "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=", + "owner": "numtide", + "repo": "flake-utils", + "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b", + "type": "github" + }, + "original": { + "owner": "numtide", + "repo": "flake-utils", + "type": "github" + } + }, + "flake-utils_2": { + "inputs": { + "systems": "systems_2" }, "locked": { "lastModified": 1731533236, @@ -146,8 +246,8 @@ "inputs": { "cachyos-kernel": "cachyos-kernel", "cachyos-kernel-patches": "cachyos-kernel-patches", - "flake-compat": "flake-compat", - "flake-parts": "flake-parts", + "flake-compat": "flake-compat_2", + "flake-parts": "flake-parts_2", "nixpkgs": "nixpkgs" }, "locked": { @@ -235,6 +335,21 @@ "type": "github" } }, + "nixpkgs-lib_2": { + "locked": { + "lastModified": 1782614948, + "narHash": "sha256-ePjCwr1sNm9NYUqywL7QfK3JnlS015msC+eBu2zKlp8=", + "owner": "nix-community", + "repo": "nixpkgs.lib", + "rev": "db3f255737b94216eb71cce308e2912cf6bc2d7c", + "type": "github" + }, + "original": { + "owner": "nix-community", + "repo": "nixpkgs.lib", + "type": "github" + } + }, "nixpkgs-my-features": { "locked": { "lastModified": 1779912664, @@ -298,7 +413,7 @@ }, "nixvim": { "inputs": { - "flake-utils": "flake-utils", + "flake-utils": "flake-utils_2", "nixpkgs": "nixpkgs_3", "nixvim": "nixvim_2" }, @@ -318,9 +433,9 @@ }, "nixvim_2": { "inputs": { - "flake-parts": "flake-parts_2", + "flake-parts": "flake-parts_3", "nixpkgs": "nixpkgs_4", - "systems": "systems_2" + "systems": "systems_3" }, "locked": { "lastModified": 1783941741, @@ -356,8 +471,59 @@ "type": "github" } }, + "pyproject-build-systems": { + "inputs": { + "nixpkgs": [ + "authentik-nix", + "nixpkgs" + ], + "pyproject-nix": [ + "authentik-nix", + "pyproject-nix" + ], + "uv2nix": [ + "authentik-nix", + "uv2nix" + ] + }, + "locked": { + "lastModified": 1782093830, + "narHash": "sha256-6gmEVe69+KlRkZD4PEEV5xAlB9CB0Y9TiuEgQjDrKTQ=", + "owner": "pyproject-nix", + "repo": "build-system-pkgs", + "rev": "430680a19bc85a3bda55f12e4cc1a1aadcf2e478", + "type": "github" + }, + "original": { + "owner": "pyproject-nix", + "repo": "build-system-pkgs", + "type": "github" + } + }, + "pyproject-nix": { + "inputs": { + "nixpkgs": [ + "authentik-nix", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1782905613, + "narHash": "sha256-SvXJcAemihifkTn4BGvyE5K1FJX9bl4U8DQ5pqKvD0s=", + "owner": "pyproject-nix", + "repo": "pyproject.nix", + "rev": "7af23cfe91064865ecf2e835da28b45b3c6f49fd", + "type": "github" + }, + "original": { + "owner": "pyproject-nix", + "repo": "pyproject.nix", + "type": "github" + } + }, "root": { "inputs": { + "authentik-nix": "authentik-nix", "home-manager": "home-manager", "nix-cachyos-kernel": "nix-cachyos-kernel", "nixflix": "nixflix", @@ -390,6 +556,21 @@ } }, "systems": { + "locked": { + "lastModified": 1689347949, + "narHash": "sha256-12tWmuL2zgBgZkdoB6qXZsgJEH9LR3oUgpaQq2RbI80=", + "owner": "nix-systems", + "repo": "default-linux", + "rev": "31732fcf5e8fea42e59c2488ad31a0e651500f68", + "type": "github" + }, + "original": { + "owner": "nix-systems", + "repo": "default-linux", + "type": "github" + } + }, + "systems_2": { "locked": { "lastModified": 1681028828, "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", @@ -404,7 +585,7 @@ "type": "github" } }, - "systems_2": { + "systems_3": { "locked": { "lastModified": 1774449309, "narHash": "sha256-brhZ8DmuGtzkCYHJg4HEd602amKm89Y9ytsFZ5uWD1w=", @@ -441,6 +622,31 @@ "type": "github" } }, + "uv2nix": { + "inputs": { + "nixpkgs": [ + "authentik-nix", + "nixpkgs" + ], + "pyproject-nix": [ + "authentik-nix", + "pyproject-nix" + ] + }, + "locked": { + "lastModified": 1783511944, + "narHash": "sha256-Z/Ss9rWw9QYcRK+Qqkmty7PB1pIik5XGbrtit+ad2qs=", + "owner": "pyproject-nix", + "repo": "uv2nix", + "rev": "83995ef5e4ece3c9c704aa645bbff439e15a0ac3", + "type": "github" + }, + "original": { + "owner": "pyproject-nix", + "repo": "uv2nix", + "type": "github" + } + }, "vpn-confinement": { "locked": { "lastModified": 1778182451, diff --git a/flake.nix b/flake.nix index 70c18d3..2b31552 100644 --- a/flake.nix +++ b/flake.nix @@ -24,6 +24,10 @@ url = "github:kiriwalawren/nixflix"; inputs.nixpkgs.follows = "nixpkgs"; }; + authentik-nix = { + url = "github:nix-community/authentik-nix"; + inputs.nixpkgs.follows = "nixpkgs"; + }; }; outputs = @@ -37,6 +41,7 @@ nix-cachyos-kernel, noctalia, nixflix, + authentik-nix, ... }@inputs: let @@ -87,6 +92,7 @@ enableZram = true; additionalModules = [ nixflix.nixosModules.default + authentik-nix.nixosModules.default ]; }; nixosConfigurations."frog" = mkSystem "frog" { diff --git a/machines/bomba/networking.nix b/machines/bomba/networking.nix index 90e6698..0b1b37f 100644 --- a/machines/bomba/networking.nix +++ b/machines/bomba/networking.nix @@ -15,6 +15,8 @@ 465 587 993 + 3389 + 6636 25565 27015 ]; @@ -22,6 +24,8 @@ 53 80 443 + 3389 + 6636 34197 ]; }; diff --git a/machines/bomba/secrets.nix b/machines/bomba/secrets.nix index b9a9d92..dd764cd 100644 --- a/machines/bomba/secrets.nix +++ b/machines/bomba/secrets.nix @@ -24,6 +24,7 @@ gitea_registration_token = default; navidrome_env = default; yamtrack_env = default; + authentik_env = default; }; }; } diff --git a/machines/bomba/services/authentik.nix b/machines/bomba/services/authentik.nix new file mode 100644 index 0000000..5c149a7 --- /dev/null +++ b/machines/bomba/services/authentik.nix @@ -0,0 +1,15 @@ +{ config, ... }: +{ + services.authentik = { + enable = true; + environmentFile = config.sops.secrets.authentik_env.path; + settings = { + disable_startup_analytics = true; + avatars = "initials"; + listen = { + ldap = "0.0.0.0:3389"; + ldaps = "0.0.0.0:6636"; + }; + }; + }; +} diff --git a/machines/bomba/services/caddy.nix b/machines/bomba/services/caddy.nix index ec01633..ac19aea 100644 --- a/machines/bomba/services/caddy.nix +++ b/machines/bomba/services/caddy.nix @@ -87,6 +87,9 @@ ${basicAuth} reverse_proxy :${toString config.services.adguardhome.port} ''; + "auth.patrickcanal.it".extraConfig = '' + reverse_proxy :9000 + ''; }; }; diff --git a/machines/bomba/services/default.nix b/machines/bomba/services/default.nix index 6165614..a0af7ec 100644 --- a/machines/bomba/services/default.nix +++ b/machines/bomba/services/default.nix @@ -3,6 +3,7 @@ imports = [ ./actual.nix ./adguard.nix + ./authentik.nix ./caddy.nix ./fail2ban.nix ./gitea.nix diff --git a/modules/nix-config/caches.nix b/modules/nix-config/caches.nix index 68f9cf0..5b0f38d 100644 --- a/modules/nix-config/caches.nix +++ b/modules/nix-config/caches.nix @@ -7,6 +7,7 @@ "https://nixvim-superredstone.cachix.org" "https://noctalia.cachix.org" "https://attic.xuyh0120.win/lantian" + "https://nix-community.cachix.org" ]; trusted-public-keys = [ "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=" @@ -14,6 +15,7 @@ "nixvim-superredstone.cachix.org-1:mEXHVxEv5dKka3FOxTMFDfdk/DJ0baydsahi+zZIcQE=" "noctalia.cachix.org-1:pCOR47nnMEo5thcxNDtzWpOxNFQsBRglJzxWPp3dkU4=" "lantian:EeAUQ+W+6r7EtwnmYjeVwx5kOGEBpjlBfPlzGlTNvHc=" + "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=" ]; trusted-users = [ "root" diff --git a/secrets/bomba.sops.yaml b/secrets/bomba.sops.yaml index 2f07be7..5a1537f 100644 --- a/secrets/bomba.sops.yaml +++ b/secrets/bomba.sops.yaml @@ -12,6 +12,7 @@ indexers_ilcorsaroblu_password: ENC[AES256_GCM,data:w3CIGQqLxHEkUHvscZc=,iv:fjsB gitea_registration_token: ENC[AES256_GCM,data:aHoUBwPXtlme9RgGObwWt1V90JU5qeVBUtpINrb1hY6XjKi4+kLxAg==,iv:zkgDdx82Lku7/oNIoSoKUIrxvZuyPaGUI411V/rkW9c=,tag:0eBC0Kd71UwokH9scs/AKA==,type:str] navidrome_env: ENC[AES256_GCM,data:SjEg735zoiWNjp0+uYi5CyLadDd7mSXpG1LInLsaqESz0LNgMi+r46ohPjpEC3GD+WbE9D3XRwhB22oIey3K7p3GdB/bYjIR6wOa8MVjj3EDvzdBWbnhkXsGnIhLGuyZwDmMdA==,iv:gHv7lZzU09V3XVjs3nEOEm55xRwD23+sVWfgbuX18p4=,tag:8UAMIGXPGobQfBAao2nI6Q==,type:str] yamtrack_env: ENC[AES256_GCM,data:viu/+B369Csc/nb1Psx5sIcrYw9IpUjtBPwiEAWRiBoCTlowLJ3xfRgUSx7w3/IhaCmuxEFTPBvIGCFFLgU0ZeHl5CnGe210O+uAgDpwJK+904zND3yVBPJmQ9u/ACHwqPOLON+ZFudEPtzW/5rkiQSXJdPelF28/0fkCLl1P7dVeEkwjRxPJKCt6lGv2WMlcqoHKEUCIsPWS/btRhzmLV5897AvZKTLDvrJxJi2yrPpfds=,iv:6i/1vFrwhGaq4pzCoX2og+kPRnJuqEWm9EqwOk9TSBA=,tag:122SE01quqmSjM4ttUn12w==,type:str] +authentik_env: ENC[AES256_GCM,data:kAva3C4pWZ4+BFhGbbq9j1rSXeldb+NAwU16aZUD7wiw8k7Sg0kVq/43rj1HtR2ZTQY6DxhPlsK5I7opVAg953GwN0kTErpuhKLRWaRGSb8rC8kkxnY=,iv:X61qSjH18KQRWNOtYq1o8IZmY6Dz4TrJzehJWxE7b2o=,tag:mifmD1C3A+XSQveLviLt2w==,type:str] sops: age: - enc: | @@ -23,7 +24,7 @@ sops: ZQ17gIIOjhKHlGx8Lo5t/PekzFyQKCKdijS7caq74dVib1vO3tk+uQ== -----END AGE ENCRYPTED FILE----- recipient: age1ynu6zhhy84rr5xqce0flp25x5tnfgskesxfe39u7ewsk900fvagq9sq0lx - lastmodified: "2026-07-08T06:48:25Z" - mac: ENC[AES256_GCM,data:T92NqPVsMRcSrKhw87eZ182yB9tyosItanm3efW3klZqfv/L1LE9OTvwIqjhJA1EGfhgAJ1j3vW6d9WmjnMWAJ5dGwWAi9PA6NhqG5IvuOdGwF9ZRhA5Rv74MOeUyBLI9WPqP4fISupz6O5i70vfB6eD+CI+N+z+2WptebE/WDI=,iv:v24irSdN35hLDA8hBqGqQ6F75fABFHZ5ORkymkcXyis=,tag:1WrO5o4xSsEzDJcOTlpUbA==,type:str] + lastmodified: "2026-07-22T21:31:17Z" + mac: ENC[AES256_GCM,data:z4AB4bpj/z3L7XuWrcxk76e+KatdHYB2HWIYNZsaVfaMfBtVDl0UVfpq/ajBgLNdmBaNZ+c/ePqpPMZ64nsvyseZFDkm+a8GvJBDevUEpi2YGtqT/M5dj/9hLDMcX2T+nk/u5inTjTuirndHSZW8bAHqL8s+bVsTBQ4wtoDrFNg=,iv:EVMAXtIvr6hdLHZ/+8fvMILP/iBrRucRKizeCYnFd9o=,tag:D3CU9YA7luRxpCiJ+MG0Pw==,type:str] unencrypted_suffix: _unencrypted - version: 3.13.1 + version: 3.13.2