diff --git a/modules/features/forgejo.nix b/modules/features/forgejo.nix index 2381efc..498dd8c 100644 --- a/modules/features/forgejo.nix +++ b/modules/features/forgejo.nix @@ -11,6 +11,23 @@ type = lib.types.str; }; + pocketId = { + enable = lib.mkEnableOption "Configure Pocket ID as a Forgejo OIDC provider"; + + discoveryUrl = lib.mkOption { + type = lib.types.nullOr lib.types.str; + default = null; + example = "https://id.example.com"; + description = "OpenID Connect discovery URL for Pocket ID."; + }; + + name = lib.mkOption { + type = lib.types.str; + default = "pocket-id"; + description = "Forgejo external auth source name for Pocket ID."; + }; + }; + port = lib.mkOption { type = lib.types.port; default = 3000; @@ -27,8 +44,20 @@ }; config = lib.mkIf cfg.enable { + assertions = [ + { + assertion = !cfg.pocketId.enable || cfg.pocketId.discoveryUrl != null; + message = "forgejo.pocketId.discoveryUrl must be set when forgejo.pocketId.enable is true."; + } + ]; + networking.firewall.allowedTCPPorts = lib.optionals cfg.openFirewall [ cfg.port ]; + mtls = lib.mkIf cfg.https { + certReaders = lib.mkAfter [ config.services.forgejo.user ]; + renew.reloadUnits = lib.mkAfter [ "forgejo.service" ]; + }; + systemd.services.forgejo.serviceConfig = lib.mkIf needsPrivilegedPort { AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ]; CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ]; @@ -40,6 +69,9 @@ "forgejo/internal_token".owner = config.services.forgejo.user; "forgejo/jwt_secret".owner = config.services.forgejo.user; "forgejo/lfs_jwt_secret".owner = config.services.forgejo.user; + } // lib.optionalAttrs cfg.pocketId.enable { + "forgejo/pocket_id/client_id".owner = config.services.forgejo.user; + "forgejo/pocket_id/client_secret".owner = config.services.forgejo.user; }; services = { @@ -48,9 +80,7 @@ lfs.enable = true; database.type = "postgres"; settings = { - DEFAULT = { - RUN_MODE = "dev"; - }; + DEFAULT.RUN_MODE = "dev"; server = lib.mkMerge [ { HTTP_PORT = cfg.port; @@ -71,13 +101,9 @@ ACCOUNT_LINKING = "login"; REGISTER_EMAIL_CONFIRM = false; }; - repository = { - ENABLE_PUSH_CREATE_USER = true; - }; + repository.ENABLE_PUSH_CREATE_USER = true; ui.SHOW_USER_EMAIL = false; - markup = { - ENABLED = true; - }; + markup.ENABLED = true; }; secrets = { @@ -109,6 +135,59 @@ --work-path ${config.services.forgejo.dump.backupDir} ''; + systemd.services.forgejo-pocket-id-oidc = lib.mkIf cfg.pocketId.enable { + description = "Ensure Pocket ID OIDC auth source exists in Forgejo"; + after = [ "forgejo.service" ]; + requires = [ "forgejo.service" ]; + wantedBy = [ "multi-user.target" ]; + + serviceConfig = { + Type = "oneshot"; + User = config.services.forgejo.user; + Group = config.services.forgejo.group; + WorkingDirectory = config.services.forgejo.stateDir; + }; + + script = '' + set -euo pipefail + + client_id="$(<${config.sops.secrets."forgejo/pocket_id/client_id".path})" + client_secret="$(<${config.sops.secrets."forgejo/pocket_id/client_secret".path})" + provider_name="${cfg.pocketId.name}" + forgejo_bin="${lib.getExe config.services.forgejo.package}" + forgejo_config="${config.services.forgejo.customDir}/conf/app.ini" + forgejo_work_path="${config.services.forgejo.stateDir}" + + auth_id="$( + "$forgejo_bin" --config "$forgejo_config" --work-path "$forgejo_work_path" admin auth list \ + | ${lib.getExe' pkgs.gawk "awk"} '$2 == "'"$provider_name"'" { print $1; exit }' + )" + + if [ -n "$auth_id" ]; then + "$forgejo_bin" --config "$forgejo_config" --work-path "$forgejo_work_path" admin auth update-oauth \ + --id "$auth_id" \ + --name "$provider_name" \ + --provider openidConnect \ + --key "$client_id" \ + --secret "$client_secret" \ + --auto-discover-url "${cfg.pocketId.discoveryUrl}" \ + --scopes openid \ + --scopes profile \ + --scopes email + else + "$forgejo_bin" --config "$forgejo_config" --work-path "$forgejo_work_path" admin auth add-oauth \ + --name "$provider_name" \ + --provider openidConnect \ + --key "$client_id" \ + --secret "$client_secret" \ + --auto-discover-url "${cfg.pocketId.discoveryUrl}" \ + --scopes openid \ + --scopes profile \ + --scopes email + fi + ''; + }; + environment.systemPackages = let systemctl = lib.getExe' pkgs.systemd "systemctl"; diff --git a/modules/features/mtls/config.nix b/modules/features/mtls/config.nix index be0676e..09224e6 100644 --- a/modules/features/mtls/config.nix +++ b/modules/features/mtls/config.nix @@ -28,6 +28,11 @@ type = lib.types.str; default = "${config.certDir}/mtls.pem"; }; + certGroup = lib.mkOption { + description = "Group that should be granted read access to generated certificate material."; + type = lib.types.str; + default = "mtls"; + }; subject = lib.mkOption { description = "Subject for the cert"; type = lib.types.str; diff --git a/modules/features/mtls/mtls-wrappers.nix b/modules/features/mtls/mtls-wrappers.nix index 1ad6663..d647406 100644 --- a/modules/features/mtls/mtls-wrappers.nix +++ b/modules/features/mtls/mtls-wrappers.nix @@ -11,7 +11,11 @@ in binName = "mtls-generate"; package = config.pkgs.step-cli; extraPackages = with config.pkgs; [ coreutils step-cli systemd ]; - preHook = "mkdir -p ${config.certDir}"; + preHook = '' + mkdir -p "${config.certDir}" + chgrp "${config.certGroup}" "${config.certDir}" + chmod 0750 "${config.certDir}" + ''; args = [ "ca" "certificate" "${config.subject}" "${config.certFile}" "${config.keyFile}" @@ -25,7 +29,11 @@ in ++ lib.optionals config.overwrite [ "-f" ] ++ mkSANArgs config.SANs; postHook = '' + chgrp "${config.certGroup}" "${config.certFile}" "${config.keyFile}" + chmod 0640 "${config.certFile}" "${config.keyFile}" (umask 077; cat "${config.certFile}" "${config.keyFile}" > "${config.bundleFile}") + chgrp "${config.certGroup}" "${config.bundleFile}" + chmod 0640 "${config.bundleFile}" ''; }; }); @@ -45,7 +53,11 @@ in "${config.certFile}" "${config.keyFile}" ]; postHook = '' + chgrp "${config.certGroup}" "${config.certFile}" "${config.keyFile}" + chmod 0640 "${config.certFile}" "${config.keyFile}" (umask 077; cat "${config.certFile}" "${config.keyFile}" > "${config.bundleFile}") + chgrp "${config.certGroup}" "${config.bundleFile}" + chmod 0640 "${config.bundleFile}" ''; systemd = { diff --git a/modules/hosts/soteria/default.nix b/modules/hosts/soteria/default.nix index 74f04e8..1f024b4 100644 --- a/modules/hosts/soteria/default.nix +++ b/modules/hosts/soteria/default.nix @@ -3,9 +3,11 @@ let username = "john"; hostname = "soteria"; + forgejoDomain = "forgejo.john-stream.com"; ipv4 = "192.168.1.233"; ipv6 = "fded:fb16:653e:25da:be24:11ff:fe54:aa39"; - names = [ "${hostname}.john-stream.com" ipv4 ipv6 ]; + sshNames = [ "${hostname}.john-stream.com" ipv4 ipv6 ]; + mtlsNames = sshNames ++ [ forgejoDomain ]; in { flake.nixosConfigurations."${hostname}" = inputs.nixpkgs.lib.nixosSystem { @@ -42,19 +44,24 @@ in mtls = { enable = true; subject = hostname; - san = names; + san = mtlsNames; + certDir = "/etc/mtls"; # lifetime = "12h"; # renew.onCalendar = "*:3/15"; # renew.reloadUnits = [ "forgejo.service" "restic-rest-server.service" ]; # certReaders = [ config.services.forgejo.user "restic" ]; }; - # forgejo = { - # enable = true; - # root_url = "https://forgejo.john-stream.com"; - # https = true; - # port = 443; - # }; + forgejo = { + enable = true; + root_url = "https://forgejo.john-stream.com"; + https = true; + port = 443; + pocketId = { + enable = true; + discoveryUrl = "https://pocketid.john-stream.com/.well-known/openid-configuration"; + }; + }; # resticServer = { # enable = true; @@ -79,7 +86,7 @@ in provisioner = "admin"; host = { enable = true; - extraPrincipals = names; + extraPrincipals = sshNames; autoRenew = true; }; user.enable = true; diff --git a/modules/hosts/soteria/secrets.yaml b/modules/hosts/soteria/secrets.yaml index f53179f..4dce8b9 100644 --- a/modules/hosts/soteria/secrets.yaml +++ b/modules/hosts/soteria/secrets.yaml @@ -1,42 +1,45 @@ forgejo: - #ENC[AES256_GCM,data:/wtm0uXbiWFoGNWtlTzVuNxBR7CPm2FMB98t3AxSj5V5rltLvzF9BjgWoJCiX3ltzmU=,iv:xaZXbUIGJHxPrLRQzEQI7hgRgc0y061jIhoE3zlcMaA=,tag:fQGheCIdBKm6wE+vtj7g6A==,type:comment] - secret_key: ENC[AES256_GCM,data:/jcyeDcsryLqu9Q3VnNaENb71/Tl5JUr0zDzxt8L5UCtnJ/YHA6MKItrQ9ZHFv1XROtnSfZl9D5kKomeM8EVqA==,iv:HxMKAMVQ08gkq6SWENj0/d8i9PhcgPCp5eqbztj9bSg=,tag:nO2dFWT/vfgGc/9JIDZrGw==,type:str] - #ENC[AES256_GCM,data:TADqVsZwXpH/zfrXNclavH8Sv++jX081UjK/Mkys5x52gU5fU0ikk478EmwzeergsHpmxxon,iv:v9HsIsud+eiko7F0u622MBrTVDsIxlpqru0Viifvqow=,tag:FLgNTW0EcGhHT6iI9I6Bsg==,type:comment] - internal_token: ENC[AES256_GCM,data:7eZM+misgHZz1p6HH9VzCAPIIFjp2vT0kyc9B1KllE+x2URyrgs5IR9SZ+T5vNdMdnlNzF25pUhKzjbak8tVN554rYWp06SczzqhLyaoHKs8iGBohMqfJkoZxxIVSB7g7GC+/SAsb719,iv:XbBXqXh/PqjEcAj0qsajR7Ij56KGT/9Spdp5T549p9I=,tag:o4ONucOkIE2VJ6VjOlPb6w==,type:str] - #ENC[AES256_GCM,data:ZqwgnKjaolJtjcy287fnDOkb/oSLnBpfWfsTeVPwbIE8YLRSoPP4gbCnHJBLq+TJNNI=,iv:zTvw4ZS6C1ifUwOijNLuTfUQ3JM+5gj1X2f/s8MwWXc=,tag:Y1yKlL+jIRHVBulGlSErog==,type:comment] - jwt_secret: ENC[AES256_GCM,data:e59MlATOorsTIQjtTUKfX5Yo3CVsbbfuKczp1gh1m2D1kkZK3ORFztYpjg==,iv:JH3PVUmXToiThEKDkDJ8MGVMAPlIEgPSWhru+9WgNjk=,tag:FfDpaCPejpw6kGDkxJwDWw==,type:str] - lfs_jwt_secret: ENC[AES256_GCM,data:xi9PEKFUGRyc3YOg3JM3KrrENi9xsbeBjiz4R16SK5WDafoGFLazN6KRJQ==,iv:1IhPyQDwA8tZ22pfZJiU8TRTCLCHC/HAnKdmSGDfvcM=,tag:rLdREVSKBm67rt8ayN16Vw==,type:str] -restic_password: ENC[AES256_GCM,data:u7QOZXJkxVG4J75K5nphb2uJGdz6jbWuVSsKKu+41fshp7cVoRijtr/Cs02LjVse,iv:bt1W2FeBTG6ypBFYzMPXPIkYTSn0uHURY2ui6MRgYY8=,tag:DObAMws/zQcM+UKUe9EECA==,type:str] + #ENC[AES256_GCM,data:H3xdtb9TA/VStpOzLxboPTck0iasvAAS77hVFQOI1hmIwwYNYuRXTWb9N0M9kBEv/ho=,iv:PkLd3iHLzjnsPZtfQq/LJcwHQDm+gyxQJX/jWrpRmUw=,tag:qHtHvotCqr4IGs0vi5AOhw==,type:comment] + secret_key: ENC[AES256_GCM,data:h1TOZGnV4yBX/wFVlpyxP/KhtKbjqpvxWL7/bxONfoi3PQMtkQfwWbjd/FTC72XyCAHO/yDsCtHRQjPQcyeXmw==,iv:XgdO/i8FKBCYsRfFc5JAg+9yA3TbreIJw4J8p0xif0s=,tag:TgrJREyZuc7cdUcru1Qk0w==,type:str] + #ENC[AES256_GCM,data:43sjaBcdtJol6ySQKUuhZfSM4TvS6HLrjI/CLSlFcBfIYIe8UoPK6ZSsG7u3knVc58u8YreH,iv:aHaCmk5lr05PbXAKASPy22t88f//LOEVgSRzbZ6KKow=,tag:U3wsAmEwbaKUzjwdp6ekcg==,type:comment] + internal_token: ENC[AES256_GCM,data:tFzyCj02HXauxCqKFsZD0CB/W4FAxv4t0KSIZPPXV6a2N6PdDuL0W5+Wdd9O17E/Pa8mrourwjpqipON+FUNARp4bLsFp1bgBPeq52BLS1neSXC1YrxsO3W9/12Y5wpXI5mz7WwVJUvt,iv:uyxZlZ8vVnwkQBwNvPLgbeomyhx/lfSgi5xJyB2LLb8=,tag:oXfWY1wGL3NvlpfeGyIWxg==,type:str] + #ENC[AES256_GCM,data:8sFQ0j8jmDAmnl5FD6FFtHv6t34rFVu9O658hlGktKKFDpgXnj/IIaelvqSrsSlS6nA=,iv:HWYldmocbK/auGAXB/01zmC/vC58Z/2UYla6CFoaAL8=,tag:3dhcO0ip/w54Cf2pHwXqiQ==,type:comment] + jwt_secret: ENC[AES256_GCM,data:uIIHBk3m5DNHXRJ7pyg0Xvz1cxUFqfxUzFtBZGY59E4dPj9qHHe3RC7jEg==,iv:krZHjrU3QziSuHihpVLHaSIzHU5VZ1UUBeLBd3kWW3Y=,tag:3Z0UCV9+9nc+FU9vXFutbQ==,type:str] + lfs_jwt_secret: ENC[AES256_GCM,data:LGemlQqpCwy1HlQI3BfW6Qir8cjYgtpoyFkoKhYgGR5x+F3shCaiUNEwFA==,iv:3C3S4gUpk1szU/7Dg9RObpv3/DMpzCpFg3qyrfFMot0=,tag:dwIRfA6PoQo09+YEs6o8fg==,type:str] + pocket_id: + client_id: ENC[AES256_GCM,data:0aju1RTsGGpKRWHoBIydKUzijX5iHYWlAW/q5Ykam1WUs+py,iv:pkcZrlE1OZnEUZPnveWWkShA225tinm0eDIpmg1YbWY=,tag:vz168jIJzbJ7+DrZzn4BmA==,type:str] + client_secret: ENC[AES256_GCM,data:dXqdSqwc6aDmWOD3sYla0KWdk3CUQxLpKaQ0b5uozRI=,iv:N/LHumamZMqtqOdx3Mmj25zlsvYfriYahdxtd/goCAk=,tag:kYjcXzwrsnTN5pBGfDi1Yw==,type:str] +restic_password: ENC[AES256_GCM,data:4OOYu5+BabBtRkGjvXwIAxb+L5H3ADkqTWZFwSKIV0eOhRvNfBTlL7HBvvMCFXcP,iv:wBmht7AbnZwcKV3vBygrcuV02KoCStVn3AYt3iLOBpI=,tag:cMcCqwb6wPMm9ZKk59me4A==,type:str] sops: age: - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLM3NML2ozWExSTlY3ZXJH - ZEpaN1RIOWVjNXRRQTlLQVZKTUUvZnBxREd3Cmp6b29aRDlUdDFwMVhwS2thODNO - QzNWSVIrak1uMGRuUlBONkR2aW1nbXMKLS0tIDh2YmFaRXBvZ0Q2blhjTVphL3J3 - TkROaHdwWWN4YnkyczZLbDJYRTNrQTQKvHSXjP9EZkq9DrPZZHTIlFrPUhez6jZT - LJvkmQgKluer7+lWr8XuuqtQsvhtef1di82SBG6C6YK0zWIxrMjFkA== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVV2FrSURwdEozZ0l6MjRJ + VWU4YTVVMmN1OHNEWWJ1RmJrU1ltcFhGVW00CkFTWDRtYWtKSFRBcVRKZXZtUCtQ + Zi9pa21BcGJaMmJTa3Jab1VRUW5LVUUKLS0tIHlUY2d3OXVVTDY4UDhOamYrSnNW + R1orWGIwUFpPVnpQRUFuNm00OEZ5MWsKwH1QahhZWw4aUbAcST+fL2HefrJdKktD + G5sLmNPa3aEKx0Y3CSIvgww23iQYw31iXJS9sVcPyMVt99YP21KbvA== -----END AGE ENCRYPTED FILE----- recipient: age1p4gyh5260ewp7t2ctzv5ewj4a06szl389fm4gzy6vltxhjj73ers87u33g - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwWThXZGtFSjFZVU1UWG9v - Wk9sVEVWemtVWTJ6TGlOd3ZhVUZBYnJ1OFFRClpFNmEwTG1PR0pQUFJuTTVVZGRD - bnpPdjZGVUJvS0NyWGJQbEV4cUlHZncKLS0tIDFNU1VxNjZYSks1OTMrblJPbDI1 - bHIrUnhsMWNhWVpVc3hCazlKTlV5YncKgR/AbgCE9JU8U8PH3ouYTZJOqL7rRODr - 5D2zT9pcTC3LQGZrhNtgjAi6IucU4yDAU7UhT3D7cZawwFTKVaoplw== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBReFNXY3c0UnZ3cGZnbnFO + K3dZS2w4S0UzeFE4YXg0V3BjbzNISm8xdWdZCkc4NUdBMktMbStSZkFtTFBHcGNQ + eDdlQXRXb3NKaUtLWXlqN0txOGxoMTgKLS0tIEZPV1BCWUFRaldIMDlSRXZzMmtN + aW14MnNtZVM0M0M0ajk2UElCWklhaVUKZewlYVMefFqC+ddzrgmAXVTiuBqhhxEL + Q3cUhxGk5DUhCn30ia/ztQIb79kVBrdhY6zA2bKcBdYH4HSzV+rNAA== -----END AGE ENCRYPTED FILE----- recipient: age1ykcs39e62pz3xu6cedg8ea685kv5d5qsrhgkndygzm8rx30xd5ys5t3qxt - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3K054SHE0V1RCYlRlTXJT - bXo4ZnE1cFozY3R2dmg5S1BacC9xb2oweWpBClJJVnkrSytFaG8xR1l4SU5FNGxi - UndnNzYwMUlXSjRYK3c3MzI4NmRVRVEKLS0tIFQ4NFdPeGI4LytWK0JPcUV4VjM2 - b1dtYWdFTTFQcW5PQml2OWs1Z0VZOFUKrDX7y3cU8KPRLKlO/HI/jdynqwO1TAS0 - WY4F0qFKmWwsJJjbnjdpYYP3O1/8RNeXjnUg8fGYY75sf7iAYWSe/w== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhbVRyNmN3WU5SbTNtbzZV + cGoybXo0dWtpRDNkR2drZTN0VFhoQ0REQ0ZvCkNSSm9hbmZDNUsxTjBGWm5QL3M2 + VElMSi8ybFRVM3hpNUlYdVAyME1RTUEKLS0tIGJVRis5WkRDRkxCVVdJVENlZ3Ru + aGw3cW51Vno4emFMckxqRTVGcGhoemcK4WBC2EZEx7hVlUQnsD4V5QH9peNjUoWE + XjCvw0twhPRi9uXd4HmHqlDpxdGMk0oFQ77O7h7Q3z2uqsJ2v8p/SA== -----END AGE ENCRYPTED FILE----- recipient: age1gvplss0ddmyf6vpjy363wu3n057vhm0j6n7tc94cxd8kadapypws5mtaj0 - lastmodified: "2026-04-04T23:18:43Z" - mac: ENC[AES256_GCM,data:qBgeli5lHb4pyA8nAADBuRBAaq8VbAIsFI37OZtgnbnoHW2crxo3YC+EknaIYnZpZ48kwVhQS5lGRjI6JsWWhTH3+LVAhTmS2Qj/pZTD/JDLK6XJGXS4U9nB7m9aGYyW8gFCy9/DfoJWGsS//+ZmUikKPfd5kMZgh1zGoYCIGug=,iv:h+2fA+bO2SMCNrEslP36x3BPRaIy25cU/DNX8CYSC6A=,tag:RvVyUZ4ONRaKaqGiT31eUQ==,type:str] + lastmodified: "2026-07-10T04:31:57Z" + mac: ENC[AES256_GCM,data:uytG0nhJ/Gp0KbOovD1SVXx0G27e12gMPwmpkU0lPW01cAXNe0rv4SjhHGP0FOR6vLimcPAmekVjVqiKxie8Zevo/Jf9ZRTkQ6ixWLvhH2NMHra4T5TWtUjfMdFM8tiilwcvjsXpqAoaJDZ0HHY5NYhXG/khobAwBRc26RtICVw=,iv:6gB28VE17+NoM/tR9lIlJoMPD91Aud+kH95Vo+fWLjs=,tag:QMUQPsCnr1TUsQE66GVBBg==,type:str] unencrypted_suffix: _unencrypted - version: 3.12.2 + version: 3.13.1