99 lines
2.9 KiB
Nix
99 lines
2.9 KiB
Nix
{ lib, pkgs, ... }:
|
|
let
|
|
inherit (builtins) readFile;
|
|
in
|
|
{
|
|
_class = "clan.service";
|
|
|
|
manifest = {
|
|
name = "amarth-services/zitadel";
|
|
description = "Zitadel service module";
|
|
categories = [ "System" "Identity" "IAM" ];
|
|
readme = readFile ./README.md;
|
|
};
|
|
|
|
#==============================================================================================================
|
|
# Controller configuration
|
|
#==============================================================================================================
|
|
roles.controller = {
|
|
interface = {
|
|
options = {};
|
|
};
|
|
|
|
perInstance = { instanceName, settings, machine, roles, ... }: {
|
|
# nixosModule = lib.modules.importApply ./roles/controller.nix (instanceArgs // { inherit pkgs; });
|
|
nixosModule = { config, ... }: {
|
|
clan.core.vars.generators.zitadel = {
|
|
share = false;
|
|
|
|
files.masterKey = { deploy = true; secret = true; };
|
|
files.initialAdminPassword = { deploy = true; secret = true; };
|
|
|
|
runtimeInputs = with pkgs; [ pwgen ];
|
|
|
|
script = ''
|
|
pwgen 50 1 > "$out/initialAdminPassword"
|
|
|
|
# https://zitadel.com/docs/self-hosting/manage/configure#masterkey
|
|
# The master key has to be 32 bytes
|
|
head -c 32 /dev/urandom > "$out/masterKey"
|
|
'';
|
|
};
|
|
|
|
services.zitadel = {
|
|
enable = true;
|
|
|
|
masterKeyFile = config.clan.core.vars.generators.zitadel.masterKey.path;
|
|
|
|
settings = {
|
|
Port = 9092;
|
|
|
|
ExternalDomain = "auth.amarth.cloud";
|
|
ExternalPort = 443;
|
|
ExternalSecure = true;
|
|
|
|
Metrics.Type = "otel";
|
|
Tracing.Type = "otel";
|
|
Telemetry.Enabled = true;
|
|
|
|
SystemDefaults = {
|
|
PasswordHasher.Hasher.Algorithm = "argon2id";
|
|
SecretHasher.Hasher.Algorithm = "argon2id";
|
|
};
|
|
};
|
|
|
|
steps.FirstInstance = {
|
|
InstanceName = settings.hostName;
|
|
|
|
Org = {
|
|
Name = settings.displayName;
|
|
Human = {
|
|
UserName = "chris";
|
|
FirstName = "Chris";
|
|
LastName = "Kruining";
|
|
Email = {
|
|
Address = "chris@kruining.eu";
|
|
Verified = true;
|
|
};
|
|
Password = config.clan.core.vars.generators.zitadel.initialAdminPassword.value;
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
#==============================================================================================================
|
|
# Peer configuration
|
|
#==============================================================================================================
|
|
roles.peer = {
|
|
interface = {
|
|
options = {};
|
|
};
|
|
|
|
perInstance = instanceArgs: {
|
|
nixosModule = lib.modules.importApply ./roles/peer.nix (instanceArgs // { inherit pkgs; });
|
|
};
|
|
};
|
|
}
|