From 81ba782c92f6076d83acd08312612209f6e09f3f Mon Sep 17 00:00:00 2001
From: Superredstone <patrickcanal3@gmail.com>
Date: Sun, 26 Jul 2026 09:17:25 +0200
Subject: [PATCH] feat(adguard): enable sso

---
 machines/bomba/networking.nix         |  4 ---
 machines/bomba/services/authentik.nix |  4 ---
 machines/bomba/services/caddy.nix     | 41 ++++++---------------------
 3 files changed, 8 insertions(+), 41 deletions(-)

diff --git a/machines/bomba/networking.nix b/machines/bomba/networking.nix
index 0b1b37f..90e6698 100644
--- a/machines/bomba/networking.nix
+++ b/machines/bomba/networking.nix
@@ -15,8 +15,6 @@
         465
         587
         993
-        3389
-        6636
         25565
         27015
       ];
@@ -24,8 +22,6 @@
         53
         80
         443
-        3389
-        6636
         34197
       ];
     };
diff --git a/machines/bomba/services/authentik.nix b/machines/bomba/services/authentik.nix
index 5c149a7..4119938 100644
--- a/machines/bomba/services/authentik.nix
+++ b/machines/bomba/services/authentik.nix
@@ -6,10 +6,6 @@
     settings = {
       disable_startup_analytics = true;
       avatars = "initials";
-      listen = {
-        ldap = "0.0.0.0:3389";
-        ldaps = "0.0.0.0:6636";
-      };
     };
   };
 }
diff --git a/machines/bomba/services/caddy.nix b/machines/bomba/services/caddy.nix
index 719416f..f0af96f 100644
--- a/machines/bomba/services/caddy.nix
+++ b/machines/bomba/services/caddy.nix
@@ -1,15 +1,17 @@
 {
-  pkgs,
   config,
-  currentSystemUser,
   ...
 }:
 {
   services.caddy =
     let
-      basicAuth = ''
-        basic_auth {
-          ${currentSystemUser} $2a$14$L6SBwu.0FhGBYwH2LWa6uOrBSeRHo8Lo95Vkle/g5uB7kZl7nmJPO
+      authentikAuth = ''
+        reverse_proxy /outpost.goauthentik.io/* http://127.0.0.1:9000
+
+        forward_auth http://127.0.0.1:9000 {
+          uri /outpost.goauthentik.io/auth/caddy
+          copy_headers X-Authentik-Username X-Authentik-Groups X-Authentik-Entitlements X-Authentik-Email X-Authentik-Name X-Authentik-Uid X-Authentik-Jwt X-Authentik-Meta-Jwks X-Authentik-Meta-Outpost X-Authentik-Meta-Provider X-Authentik-Meta-App X-Authentik-Meta-Version
+          trusted_proxies private_ranges
         }
       '';
     in
@@ -20,18 +22,6 @@
           root /var/www/patrickcanal.it/public
           file_server
         '';
-        "novnc.patrickcanal.it".extraConfig = ''
-          handle {
-            ${basicAuth}
-            root ${pkgs.novnc}/share/webapps/novnc
-            file_server browse
-          }
-
-          handle /websockify {
-            ${basicAuth}
-            reverse_proxy 127.0.0.1:6080
-          }
-        '';
         "vaultwarden.patrickcanal.it".extraConfig = ''
           encode zstd gzip
           reverse_proxy :8003 {
@@ -84,7 +74,7 @@
           reverse_proxy :${toString config.services.homebox.settings.HBOX_WEB_PORT}
         '';
         "adguard.patrickcanal.it".extraConfig = ''
-          ${basicAuth}
+          ${authentikAuth}
           reverse_proxy :${toString config.services.adguardhome.port}
         '';
         "auth.patrickcanal.it".extraConfig = ''
@@ -92,19 +82,4 @@
         '';
       };
     };
-
-  systemd.services.websockify = {
-    description = "Websockify for noVNC";
-    after = [ "network.target" ];
-    wantedBy = [ "multi-user.target" ];
-    serviceConfig = {
-      Restart = "always";
-      DynamicUser = true;
-      ExecStart = ''
-        ${pkgs.python3Packages.websockify}/bin/websockify \
-          --web ${pkgs.novnc}/share/webapps/novnc \
-          6080 127.0.0.1:5900
-      '';
-    };
-  };
 }