diff --git a/secrets/OVHCloud.yaml b/secrets/OVHCloud.yaml index 10895c1..28e065a 100644 --- a/secrets/OVHCloud.yaml +++ b/secrets/OVHCloud.yaml @@ -6,6 +6,10 @@ authelia: SMTP_ADDRESS: ENC[AES256_GCM,data:490uwbjW79yKqFChSo6EzDDwIgk=,iv:HW+VVKjruP5vmJqlYSg9yR1K4R/mMeZipUX9EzTKaKk=,tag:to7dLSW/LF88SjJJaj7f0A==,type:str] SMTP_USERNAME: ENC[AES256_GCM,data:1/5bB6lUnwdayw==,iv:T7b8i0QvPTOCtZ5/03trKUcpN+vABAfPdSECQLuhlZE=,tag:vvUuKUEK0Rw4JpOnQpMhcg==,type:str] SMTP_PASSWORD: ENC[AES256_GCM,data:cO2y3TQx/HJpjgseJt9ju9BvjZ2ZLUMf,iv:cWQDU2gtcml4zHlvtINW6k/6CwZtjxkDNWBiMguSijw=,tag:kA3PptaPHszw1FLwA9BTvQ==,type:str] + OIDC_HMAC_SECRET: ENC[AES256_GCM,data:AYVbbPVGqmx+ZOC6Y1xcHYZcz/aoTsv15v7FUL8MCU3+/VuEp0vE6pcxTxc=,iv:Pm/b1mEEgvfTKQr6FXibWAmcZGg9i+sxoqCQ+nD0aVE=,tag:6HaG0g6Rvf2lC9mzWpsHwg==,type:str] + #ENC[AES256_GCM,data:fCLX44MuqhAVHADGxHkVu53bnUSVKRzbUiucasqvu0gLbLOt1UWSyOTGhVUrgdjQC4QtemcqbTsVjBb0cvL7TA7EeYDKLg==,iv:cdhu+Vx/TfyDSsETHAfj3ZJSNRijr6pwW5Ca6uOVGLQ=,tag:2c3m2PmJ8hzU5XDk1eLJrw==,type:comment] + OIDC_JWKS_PRIVATE_KEY: ENC[AES256_GCM,data:jHGumhi77Hr8ZfR8zzNoSfKZvoc5RM35m+IzUybXtQANrT/JXCzWOOYI5cc9nRHJnKLEP80XvSEKzoFspMe1Xl28y1rJacPdx+HbvwEOP3JU+UxBRVjY7ptO/mtDaae7XWEDaEdna1ItqkXiJMkYc+XR0fb/UrD7x/DVNSUGamqTgNIi+oV3QzlVoLd3knVel/ujGaRNd/Dys7G1Ig7mDibH+8z4LTEiNdxJenYHAIFelJeiVWgFNtyT2Uljs9hjCtwJGwl+TmAykzggriTjenlLzmWgYt9kycxkR0hWRDS8zAzLbcloUy9wkNnDrxK9kLtr7G//eDC98UmupvVhDmJaZzgNQOHTVPsF0w7RQ6JRiu6tTbMVQN8g0pH11Zo9A8kJUgCKZWEuh9JbtvG2skrG5OVJVm2Hv0R/FIauypaXM+AXF49D+E0PGP6Os8azk2DDaTBTl8m+7x28VsZMxbwwZtmbPaAVXAyDoCYKa4Ac+LdE1QMv7biiTBOsd4G1iV3nE1b3KO/Jkhb8VS4rxfVbPtU6EOwrBXnZ+0RzK2dJakAkwvLeaUiRnVA8j2o+TKD7n8TPRhuVIfB4ru6LymttzLYveXju7tvN0HHkJL9OoIRFE8i82wSK6s6d1CVrJH1hJtwvZGemuaPRxG/bIJYEtRtsxZO2SPo1F7MLg4XrubaEuNFqJsQAmV2ip3XKsmzIz5yezz0YdgiyYj5i6mXQb4tO5Bmj0OxsmAv/loNHjREwnC5jECT8txKCqkV6V5y5DtLnRR7aZY6X+k84pfGXSi29xupEaU4/NCUM7T5rv8Gl076BSKAQnkwLW3PmtL4g3r/kU0woda0L4RHbgsPT6/kMe7Foxx5UtV4+kaJgA99nXIL2TaYlc9RZlVYOOhTxgT/ZBKdU8lF29sej4nMVQdc1NP2ujq2xG/fffZTHIyPV7W17NbjgRr17STpji1f1PSremU37kpk/hPeaj9F7fnuqNGPuh09EfpnXH3EKzu1gQamfvPNmH0rsglrtxoImaeok41Lrpa7/4CbS03fCwKfNLg7CGdJbUxl9v0hviB3vGj3dJm4DWRW/fAeaJVdxYsIOsRKZT4g32mjOiEcgH2JHOGTD/d64Z0TpvO57bYjBjSMO4oK59/XY8uD1PwqEsiigrAQW9Tww9711NBXlAqDPpgLou6SUrySq/ZnsUeZofpJPAt8VCmZAcGUxVrMTpvCTMkcp7dfrg2yuVqNcQGVtTeHNpX0GBLrlLTocsf7YU5RAoOzHBeT4PVRsKmupuT0zD1S6eBSTgRH7mR2gS5hR5XxbniIfHEXUC2mE6cydsdh7arD3M4mf9UzAoBs6w0pZyO7ztOGX4FaZf5rWE+lizGf2bfvZqXGTRX94h11gSt+VLQqRjb4b8h+ZVhKFwEiVxpFn6GmvuN4lIfK/7xfvwAisCUDAjbNaV5mFfeS7o8l9pclZ+mni86AFgNnMiAJaPKsoClBACabYCRdSxrtAWIsiM9pfQCeHHy6d18dJqLCOBB62IQ4iZJ7YtJF3dV2q6ZKmo9XQwA4YUpj93Qe9b6d7FPtOiBgySlUay5EwDXDteNMcH1hfbTOxMvau5JcePDsDkmH/fzLdBhszCECrsdQBDR+nSCsd8DLyKifyVdHhMd0YJU3oiCpMGIIYlDeLRmBwsXdY88xPhTlItko2bH38581uvPcrp03jXLD0IPPhAYxpjfSJQ33pGX7U0NMQgXH1W1+dqGFpDhX6o7e7lQ/uxXvi/DBz6zoORfSOs+TD0xi4ptkjbHu6xsH9Slrx0JsxyT5yWGBqlYd9QxwsOxbe6X5jZSgxPyRvUdLTGhs6BeZ8UO8/IAZaHQq3WRycnBsA1M0ZJ+HP86Xy9zKg5wCrKzIcoHLfylSBPiChOHvjhJP0C0gt4uSz2f/7hfeJ3JNfNp+yCWZ3VtgzatBkiegjC0V72/HwN9AeaGnoJJ6mC4D5wSoJ7y1bugtFSo9t3wIlA9UjtEPqi/O5C/liG3vCAXluE64J778PSQq1Bm7yztPvo0p460IwXmJ6p635gMVcAlCraBnKTBTwzz+hKIdj+Ok5NBvu0WG/zDXiIWHushIY4XneJC6qryqkBr3HMfYj/OkAkRX/hCbSnsZN8Fc69hyUzryu07up0/q9/R1uYKp6jbAHKONoPfEfip43v0FfP6ncQv9cDcvUE0W/z1TNkNNFDx8nEOtrAu+8fty1fQrj2w==,iv:YGEXMLWOoQ19cbftQU9/4kFNcWIqjnw2GgZIddBwbrc=,tag:og1Avj5ZcYblJWrE2q2Bcg==,type:str] + #ENC[AES256_GCM,data:gIGYsk5h40IBhtmRM4G/yA==,iv:6tdKmKcvTQH7STvVjPIpwmGS2TEzZjX25CBwRIF8fjY=,tag:9pO4w0Zw+5iNkxwWf5VJDw==,type:comment] caddy: ovh_endpoint: ENC[AES256_GCM,data:dTdfKCWE,iv:NnmdUyM9F8ujEIfEEl9WXGLY3zRpIy9BDeqs1frK+R0=,tag:1AblJqi2hKISXBqNdWybqQ==,type:str] ovh_application_key: ENC[AES256_GCM,data:48HzVrSa35qUSkLO7sbUwg==,iv:QfTRXsfTlgeoJdRJIph39EBbLynRNxH4DkFuuC06IuE=,tag:m8lJPHEEpK24MKUou0MTpw==,type:str] @@ -13,6 +17,20 @@ caddy: ovh_consumer_key: ENC[AES256_GCM,data:oFLHB7obwz3F59Vt8LRxpKaHBjEaoYCrKLKPoqVHz4M=,iv:rXxR2Nv3YaT2QubZUqIi60RxaHe9ZaIT9hLiogbPVFw=,tag:5m+xXEUbN+a2fHCf+EXf9A==,type:str] garage: RPC_SECRET: ENC[AES256_GCM,data:OJbIST1mtpqMNk+MKnGFy6+tXjc6aEOMIWnfs8QY9ozpxN2apAN7ZrjAAZc3J7ORUIhUQh8Vjkb1EhxdqGxERA==,iv:NhREhGE0wz3/0sdXUxuDqWaPdjeeQFau2OEVsqpV3F0=,tag:yGYd5txtVQzIOchh2L/XXQ==,type:str] +penpot: + SECRET_KEY: ENC[AES256_GCM,data:Ebeehmby3FBDOaTxwTWg9vKTsB+w8wpa6FdxcvvRTwDR07A0Ljk4WCaPmbPBArbwB14cMSuGeDGBrvNo1x8N+u3FeMMei+TGvgJGssZynxEN7+g5gTg=,iv:ZAa3n7CCyeeeAIv48JpIZmjFiyHiXLFK+Q0Wqf7utFY=,tag:6JZZ53jEM579vYhQG4X2Fw==,type:str] + OIDC_CLIENT_SECRET: ENC[AES256_GCM,data:+GrXq113byY5XqFDE1tF4n5xcrhIjg2KI39xgxY6hEcS3r6KcF6SAFmczoscMFPJccaTv7Pcr7zfzDxGT7zDuNyj324nzvff,iv:onZV3ESU4Kbvp9x9rfXuq17FlhaoE/4ZXIwH4/bOXPc=,tag:I02FFF54NDMyJuicdwy4TA==,type:str] + SMTP_HOST: ENC[AES256_GCM,data:uFrTj1OIjs+48AmcBhsCFdXEakg=,iv:lFcAjJAC3uIc8u5KNhyiH55oBriV3cnsZ9wRXDfNM0I=,tag:1SbyUxXiKmltinkxQS8SPg==,type:str] + SMTP_PORT: ENC[AES256_GCM,data:Lnh0,iv:gCLwzWrk6hMUZjL1RGi51dS2TULtCfYnlpAOJBVBen0=,tag:fv7lwt36JpKhRjXF41Wc8g==,type:str] + SMTP_USERNAME: ENC[AES256_GCM,data:g1NvuwN+tko/mg==,iv:kXUGrBHLmk8GmZPaaiafOqkKMFhcwIh9pAEFPp716QI=,tag:WkVt+jCjfadIcTrjE8QF5A==,type:str] + SMTP_PASSWORD: ENC[AES256_GCM,data:tl7hp0a4l8JLOSQQvJNRwF4DR+83FaKI,iv:vR0KiXjnkyO1pa+fxQ6ALoYN6IMFAk07qmMe5qgRB1E=,tag:/RmJIzgjDEBH9XNMol3IUg==,type:str] + POSTGRES_USER: ENC[AES256_GCM,data:Uk7czFf4,iv:2PGek4z7UJzvs6X4Jq8wx+HkUFYGtq0kVJd5ba3M24E=,tag:QysuNOULNHBPdheBH6CRDA==,type:str] + POSTGRES_PASSWORD: ENC[AES256_GCM,data:S/VKs3mMwgnlpiDLOrvMX0VLNdCseg==,iv:opj0KJq93DWljtnAmktpzAf1l9b9OCvEPAbTC06IEbQ=,tag:DkmgRJ1AodO/sEty3C6mxg==,type:str] + AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:1hXif1dLMVHTj7nvqExW6wzFP+1BTwRcqro=,iv:fXqD2fiVQa0DH7z4s70e7ggORppgqoccP+sD6eMQsvw=,tag:g18kahkiT2G9P0SBTB4HfQ==,type:str] + AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:n+0cr0tDAUAdOu65YOj+reTzF+EoRFVAZVg5172ZKYnjWBuBYjNgy6QyqqcPvZMkBBtybdUimjDgWD6mVmNDew==,iv:UwgB7PLaCoXN/qAA63u9Q8ERkhRaNRlOpSFqrUBUExg=,tag:ggs1ED4Ryb+4+O+7VG0rTQ==,type:str] + STORAGE_ASSETS_S3_REGION: ENC[AES256_GCM,data:oV4ucbPe,iv:zNsUsftybGcQdryAB+mN9Xb/rVWOLFlVixqRLLz8WIY=,tag:FiiSjLyuK89HK1GEE3BSUA==,type:str] + STORAGE_ASSETS_S3_ENDPOINT: ENC[AES256_GCM,data:mZjvBvNZC28jUYrK8e6HHixC4GU=,iv:mppmZn7nV/gckB3+GonwQQT5U14qg1FyEnQ92pGDSZI=,tag:rAePtPdd6o+EDC0MrAToKw==,type:str] + STORAGE_ASSETS_S3_BUCKET: ENC[AES256_GCM,data:nfcjtCQVWhdT1UUYPw==,iv:mF2Esw1GvWAjkabvDde63bAq4V5pXNhbhqsK1dkg5sg=,tag:uE6qKxKSJzYtHWxPMiK3Lw==,type:str] shadowsocks: password: ENC[AES256_GCM,data:IdAvKXKckwvZUetkYSFTIPxd8nrwm13Ngc3KVDSmiW3AE4Rhmjk2VHjdUyQ=,iv:LVeQcL7XIEQyMTsXpXIROGte2+Z9+7FpemfiwhA0Pw0=,tag:qt+8jgN5UqwMeCV+D3stEQ==,type:str] wireguard: @@ -42,8 +60,8 @@ sops: MFpMemF4MGg1bmVUeWV5N25LTUtyczQKss0x4zT1kyeRu+qenhrdbcPlU/p+yjVN y3j4eGpnwgc2rxSL9vkrrkzx/atUqUkgGU/YstszUrP6XKbJ+9ydpQ== -----END AGE ENCRYPTED FILE----- - lastmodified: "2024-10-18T09:05:47Z" - mac: ENC[AES256_GCM,data:fF67+S0Zv2WCIeVlQ0E+Jtg8SrKX6IeV6NrI2YAug8oN80836Yx/X5vSEz8Gj9RbEPfZmEHqZF0ccFQvOZjdY4loXBNIVqLbGGH8CqrRHuzndu8AR6/pP5WZeHYxcfKOXH+GGfix34OSkELvyXHT5ih7xWeP2gwGFeEY7jI5qPI=,iv:JPQ3wfOTpmEvZUF99KP2rfLmxGtjwZDG3T12NXY5kIM=,tag:p1GkO+i3lJVa2UpnQwGf3w==,type:str] + lastmodified: "2024-10-21T07:59:44Z" + mac: ENC[AES256_GCM,data:CVwxPgx5y64xr5kHnXCmhUgghwvpa+/ulJjjHVr68EVVQp7phrIOES2oF18WF4+HFFJ64YHI9KbuOz2pTjC+7H1TDBzedtQ1azqHT/ADcnKtAdFALS6M3/CpoS8X+TFeU3P3uLEsUfR8UrPNhxm8dlH6m9A0jQMVW0Fqpsd7s0w=,iv:oVfpo0R0WY8pt8LkQv9LfqqsKcuCZNder+P6QiMyRMw=,tag:lbDls/D0f+QHRrkyaPVbww==,type:str] pgp: [] unencrypted_suffix: _unencrypted version: 3.9.0 diff --git a/services/authelia/configuration.yml b/services/authelia/configuration.yml index 627c7ce..fa18c18 100644 --- a/services/authelia/configuration.yml +++ b/services/authelia/configuration.yml @@ -19,6 +19,23 @@ session: authelia_url: 'https://auth.gasdev.fr' default_redirection_url: 'https://auth.gasdev.fr/authenticated' +identity_providers: + oidc: + jwks: + - key: {{ secret "/secrets/OIDC_JWKS_PRIVATE_KEY" | mindent 10 "|" | msquote }} + clients: + - client_id: 'penpot' + client_name: 'Penpot' + client_secret: $pbkdf2-sha512$310000$WuYHbHrVI3wMn/tZXwDTMA$WnS0VoR4jLNQnXjJUN46EfnC4QMdpdnNcYsGvSCpkbzguO4of.tCgAeLsfzLgWn9CSGMt20TZOQfc/7IbfwBHg + redirect_uris: 'https://penpot.gasdev.fr/api/auth/oauth/oidc/callback' + token_endpoint_auth_method: 'client_secret_post' + authorization_policy: 'one_factor' + scopes: + - 'email' + - 'openid' + - 'profile' + + authentication_backend: password_reset: disable: false diff --git a/services/authelia/default.nix b/services/authelia/default.nix index ea7ea78..e50d385 100644 --- a/services/authelia/default.nix +++ b/services/authelia/default.nix @@ -4,6 +4,8 @@ sops.secrets."authelia/SESSION_SECRET".owner = "root"; sops.secrets."authelia/STORAGE_PASSWORD".owner = "root"; sops.secrets."authelia/STORAGE_ENCRYPTION_KEY".owner = "root"; + sops.secrets."authelia/OIDC_HMAC_SECRET".owner = "root"; + sops.secrets."authelia/OIDC_JWKS_PRIVATE_KEY".owner = "root"; services.caddy.virtualHosts."auth.gasdev.fr".extraConfig = '' reverse_proxy http://127.0.0.1:9091 @@ -20,6 +22,9 @@ # AUTHELIA_STORAGE_POSTGRES_PASSWORD_FILE = "/secrets/STORAGE_PASSWORD"; AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE = "/secrets/STORAGE_ENCRYPTION_KEY"; AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE = "/secrets/SMTP_PASSWORD"; + AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET_FILE = "/secrets/OIDC_HMAC_SECRET"; + + X_AUTHELIA_CONFIG_FILTERS = "template"; }; volumes = [ "authelia-data:/data" diff --git a/services/default.nix b/services/default.nix index 6387c96..2234a8e 100644 --- a/services/default.nix +++ b/services/default.nix @@ -2,6 +2,7 @@ imports = [ ./authelia ./garage + ./penpot ./shadowsocks ./uptime-kuma ./wireguard diff --git a/services/penpot/default.nix b/services/penpot/default.nix new file mode 100644 index 0000000..208771f --- /dev/null +++ b/services/penpot/default.nix @@ -0,0 +1,116 @@ +{config, ...}: { + services.caddy.virtualHosts."penpot.gasdev.fr".extraConfig = '' + reverse_proxy http://127.0.0.1:9001 + ''; + + sops.secrets."penpot/SECRET_KEY".owner = "root"; + sops.secrets."penpot/OIDC_CLIENT_SECRET".owner = "root"; + sops.secrets."penpot/SMTP_HOST".owner = "root"; + sops.secrets."penpot/SMTP_PORT".owner = "root"; + sops.secrets."penpot/SMTP_USERNAME".owner = "root"; + sops.secrets."penpot/SMTP_PASSWORD".owner = "root"; + sops.secrets."penpot/POSTGRES_USER".owner = "root"; + sops.secrets."penpot/POSTGRES_PASSWORD".owner = "root"; + sops.secrets."penpot/AWS_ACCESS_KEY_ID".owner = "root"; + sops.secrets."penpot/AWS_SECRET_ACCESS_KEY".owner = "root"; + sops.secrets."penpot/STORAGE_ASSETS_S3_REGION".owner = "root"; + sops.secrets."penpot/STORAGE_ASSETS_S3_ENDPOINT".owner = "root"; + sops.secrets."penpot/STORAGE_ASSETS_S3_BUCKET".owner = "root"; + sops.templates."penpot.env" = { + content = '' + PENPOT_SECRET_KEY=${config.sops.placeholder."penpot/SECRET_KEY"} + PENPOT_OIDC_CLIENT_SECRET=${config.sops.placeholder."penpot/OIDC_CLIENT_SECRET"} + # SMTP + PENPOT_SMTP_HOST=${config.sops.placeholder."penpot/SMTP_HOST"} + PENPOT_SMTP_PORT=${config.sops.placeholder."penpot/SMTP_PORT"} + PENPOT_SMTP_USERNAME=${config.sops.placeholder."penpot/SMTP_USERNAME"} + PENPOT_SMTP_PASSWORD=${config.sops.placeholder."penpot/SMTP_PASSWORD"} + # Database + PENPOT_DATABASE_USERNAME=${config.sops.placeholder."penpot/POSTGRES_USER"} + PENPOT_DATABASE_PASSWORD=${config.sops.placeholder."penpot/POSTGRES_PASSWORD"} + POSTGRES_USER=${config.sops.placeholder."penpot/POSTGRES_USER"} + POSTGRES_PASSWORD=${config.sops.placeholder."penpot/POSTGRES_PASSWORD"} + # Storage + AWS_ACCESS_KEY_ID=${config.sops.placeholder."penpot/AWS_ACCESS_KEY_ID"} + AWS_SECRET_ACCESS_KEY=${config.sops.placeholder."penpot/AWS_SECRET_ACCESS_KEY"} + PENPOT_STORAGE_ASSETS_S3_REGION=${config.sops.placeholder."penpot/STORAGE_ASSETS_S3_REGION"} + PENPOT_STORAGE_ASSETS_S3_BUCKET=${config.sops.placeholder."penpot/STORAGE_ASSETS_S3_BUCKET"} + PENPOT_STORAGE_ASSETS_S3_ENDPOINT=${config.sops.placeholder."penpot/STORAGE_ASSETS_S3_ENDPOINT"} + ''; + owner = "root"; + }; + + virtualisation.oci-containers.containers = { + penpot-frontend = { + image = "docker.io/penpotapp/frontend:latest"; + autoStart = true; + ports = ["127.0.0.1:9001:80"]; + volumes = [ + "penpot_assets:/opt/data/assets" + ]; + environment = { + PENPOT_FLAGS = "disable-login-with-password disable-registration enable-login-with-oidc"; + }; + dependsOn = [ + "penpot-backend" + "penpot-exporter" + ]; + }; + penpot-backend = { + image = "docker.io/penpotapp/backend:latest"; + autoStart = true; + volumes = [ + "penpot_assets:/opt/data/assets" + ]; + environment = { + PENPOT_FLAGS = "disable-login-with-password enable-login-with-oidc enable-oidc-registration enable-smtp"; + # Auth + PENPOT_OIDC_CLIENT_ID = "penpot"; + PENPOT_OIDC_BASE_URI = "https://auth.gasdev.fr"; + PENPOT_PUBLIC_URI = "https://penpot.gasdev.fr"; + # DB + PENPOT_DATABASE_URI = "postgresql://penpot-postgres/penpot"; + PENPOT_REDIS_URI = "redis://penpot-redis/0"; + # Storage + PENPOT_ASSETS_STORAGE_BACKEND = "assets-s3"; + # SMTP + PENPOT_SMTP_DEFAULT_FROM = "no-reply@gasdev.fr"; + PENPOT_SMTP_DEFAULT_REPLY_TO = "no-reply@gasdev.fr"; + PENPOT_SMTP_SSL = "true"; + PENPOT_SMTP_TLS = "true"; + # Other + PENPOT_TELEMETRY_ENABLED = "false"; + }; + environmentFiles = [ + config.sops.templates."penpot.env".path + ]; + dependsOn = [ + "penpot-postgres" + "penpot-redis" + ]; + }; + penpot-exporter = { + image = "docker.io/penpotapp/exporter:latest"; + autoStart = true; + environment = { + PENPOT_PUBLIC_URI = "http://penpot-frontend"; + PENPOT_REDIS_URI = "redis://penpot-redis/0"; + }; + }; + penpot-postgres = { + image = "docker.io/postgres:15"; + autoStart = true; + environment = { + POSTGRES_INITDB_ARGS = "--data-checksums"; + POSTGRES_DB = "penpot"; + }; + environmentFiles = [ + config.sops.templates."penpot.env".path + ]; + }; + penpot-redis = { + image = "docker.io/redis:7"; + autoStart = true; + }; + }; +}