feat(bomba): add authentik

machines/bomba/networking.nix

@@ -15,6 +15,8 @@
         465
         587
         993
+        3389
+        6636
         25565
         27015
       ];
@@ -22,6 +24,8 @@
         53
         80
         443
+        3389
+        6636
         34197
       ];
     };

machines/bomba/secrets.nix

@@ -24,6 +24,7 @@
         gitea_registration_token = default;
         navidrome_env = default;
         yamtrack_env = default;
+        authentik_env = default;
       };
     };
 }

machines/bomba/services/authentik.nix

@@ -0,0 +1,15 @@
+{ config, ... }:
+{
+  services.authentik = {
+    enable = true;
+    environmentFile = config.sops.secrets.authentik_env.path;
+    settings = {
+      disable_startup_analytics = true;
+      avatars = "initials";
+      listen = {
+        ldap = "0.0.0.0:3389";
+        ldaps = "0.0.0.0:6636";
+      };
+    };
+  };
+}

machines/bomba/services/caddy.nix

@@ -87,6 +87,9 @@
           ${basicAuth}
           reverse_proxy :${toString config.services.adguardhome.port}
         '';
+        "auth.patrickcanal.it".extraConfig = ''
+          reverse_proxy :9000
+        '';
       };
     };
 

machines/bomba/services/default.nix

@@ -3,6 +3,7 @@
   imports = [
     ./actual.nix
     ./adguard.nix
+    ./authentik.nix
     ./caddy.nix
     ./fail2ban.nix
     ./gitea.nix