checkpoint

clan.nix

@@ -141,6 +141,16 @@
       };
     };
 
+    persistence = {
+      module = {
+        name = "persistence";
+        input = "self";
+      };
+
+      # TODO :: Convert to use tags instead
+      roles.default.tags = ["operational:availability:always-on" "operational:storage:large"];
+    };
+
     identity = {
       module = {
         name = "identity";
@@ -151,20 +161,139 @@
         tags = ["operational:availability:always-on"];
 
         settings = {
+          persistence_instance = "persistence";
+
+          organization = {
+            nix = {
+              user = {
+                chris = {
+                  email = "chris@kruining.eu";
+                  firstName = "Chris";
+                  lastName = "Kruining";
+
+                  roles = ["ORG_OWNER"];
+                  instanceRoles = ["IAM_OWNER"];
+                };
+
+                kaas = {
+                  email = "chris+kaas@kruining.eu";
+                  firstName = "Kaas";
+                  lastName = "Kruining";
+                };
+              };
+
+              project = {
+                ulmo = {
+                  projectRoleCheck = true;
+                  projectRoleAssertion = true;
+                  hasProjectCheck = true;
+
+                  role = {
+                    jellyfin = {
+                      group = "jellyfin";
+                    };
+                    jellyfin_admin = {
+                      group = "jellyfin";
+                    };
+                  };
+
+                  assign = {
+                    chris = ["jellyfin" "jellyfin_admin"];
+                    kaas = ["jellyfin"];
+                  };
+
+                  application = {
+                    jellyfin = {
+                      redirectUris = ["https://jellyfin.kruining.eu/sso/OID/redirect/zitadel"];
+                      grantTypes = ["authorizationCode"];
+                      responseTypes = ["code"];
+                    };
+
+                    forgejo = {
+                      redirectUris = ["https://git.amarth.cloud/user/oauth2/zitadel/callback"];
+                      grantTypes = ["authorizationCode"];
+                      responseTypes = ["code"];
+                    };
+
+                    vaultwarden = {
+                      redirectUris = ["https://vault.kruining.eu/identity/connect/oidc-signin"];
+                      grantTypes = ["authorizationCode"];
+                      responseTypes = ["code"];
+                      exportMap = {
+                        client_id = "SSO_CLIENT_ID";
+                        client_secret = "SSO_CLIENT_SECRET";
+                      };
+                    };
+
+                    matrix = {
+                      redirectUris = ["https://matrix.kruining.eu/_synapse/client/oidc/callback"];
+                      grantTypes = ["authorizationCode"];
+                      responseTypes = ["code"];
+                    };
+
+                    mydia = {
+                      redirectUris = ["http://localhost:2010/auth/oidc/callback"];
+                      grantTypes = ["authorizationCode"];
+                      responseTypes = ["code"];
+                    };
+
+                    grafana = {
+                      redirectUris = ["http://localhost:9001/login/generic_oauth"];
+                      grantTypes = ["authorizationCode"];
+                      responseTypes = ["code"];
+                    };
+                  };
+                };
+
+                convex = {
+                  projectRoleCheck = true;
+                  projectRoleAssertion = true;
+                  hasProjectCheck = true;
+
+                  application = {
+                    scry = {
+                      redirectUris = ["https://nautical-salamander-320.eu-west-1.convex.cloud/api/auth/callback/zitadel"];
+                      grantTypes = ["authorizationCode"];
+                      responseTypes = ["code"];
+                    };
+                  };
+                };
+              };
+
+              action = {
+                flattenRoles = {
+                  script = ''
+                    (ctx, api) => {
+                      if (ctx.v1.user.grants == undefined || ctx.v1.user.grants.count == 0) {
+                        return;
+                      }
+
+                      const roles = ctx.v1.user.grants.grants.flatMap(({ roles, projectId }) => roles.map(role => projectId + ':' + role));
+
+                      api.v1.claims.setClaim('nix:zitadel:custom', JSON.stringify({ roles }));
+                    };
+                  '';
+                };
+              };
+
+              triggers = [
+                {
+                  flowType = "customiseToken";
+                  triggerType = "preUserinfoCreation";
+                  actions = ["flattenRoles"];
+                }
+                {
+                  flowType = "customiseToken";
+                  triggerType = "preAccessTokenCreation";
+                  actions = ["flattenRoles"];
+                }
+              ];
+            };
+          };
         };
       };
     };
 
-    persistence = {
-      module = {
-        name = "persistence";
-        input = "self";
-      };
-
-      # TODO :: Convert to use tags instead
-      roles.default.tags = ["operational:availability:always-on" "operational:storage:large"];
-    };
-
     servarr = {
       module = {
         name = "servarr";