feat(services): Added penpot service and relevant authelia config

This commit is contained in:
GaspardCulis 2024-10-21 10:48:54 +02:00
parent ab7af0d67b
commit 74510601b6
5 changed files with 159 additions and 2 deletions

View file

@ -6,6 +6,10 @@ authelia:
SMTP_ADDRESS: ENC[AES256_GCM,data:490uwbjW79yKqFChSo6EzDDwIgk=,iv:HW+VVKjruP5vmJqlYSg9yR1K4R/mMeZipUX9EzTKaKk=,tag:to7dLSW/LF88SjJJaj7f0A==,type:str]
SMTP_USERNAME: ENC[AES256_GCM,data:1/5bB6lUnwdayw==,iv:T7b8i0QvPTOCtZ5/03trKUcpN+vABAfPdSECQLuhlZE=,tag:vvUuKUEK0Rw4JpOnQpMhcg==,type:str]
SMTP_PASSWORD: ENC[AES256_GCM,data:cO2y3TQx/HJpjgseJt9ju9BvjZ2ZLUMf,iv:cWQDU2gtcml4zHlvtINW6k/6CwZtjxkDNWBiMguSijw=,tag:kA3PptaPHszw1FLwA9BTvQ==,type:str]
OIDC_HMAC_SECRET: ENC[AES256_GCM,data:AYVbbPVGqmx+ZOC6Y1xcHYZcz/aoTsv15v7FUL8MCU3+/VuEp0vE6pcxTxc=,iv:Pm/b1mEEgvfTKQr6FXibWAmcZGg9i+sxoqCQ+nD0aVE=,tag:6HaG0g6Rvf2lC9mzWpsHwg==,type:str]
#ENC[AES256_GCM,data:fCLX44MuqhAVHADGxHkVu53bnUSVKRzbUiucasqvu0gLbLOt1UWSyOTGhVUrgdjQC4QtemcqbTsVjBb0cvL7TA7EeYDKLg==,iv:cdhu+Vx/TfyDSsETHAfj3ZJSNRijr6pwW5Ca6uOVGLQ=,tag:2c3m2PmJ8hzU5XDk1eLJrw==,type:comment]
OIDC_JWKS_PRIVATE_KEY: ENC[AES256_GCM,data:jHGumhi77Hr8ZfR8zzNoSfKZvoc5RM35m+IzUybXtQANrT/JXCzWOOYI5cc9nRHJnKLEP80XvSEKzoFspMe1Xl28y1rJacPdx+HbvwEOP3JU+UxBRVjY7ptO/mtDaae7XWEDaEdna1ItqkXiJMkYc+XR0fb/UrD7x/DVNSUGamqTgNIi+oV3QzlVoLd3knVel/ujGaRNd/Dys7G1Ig7mDibH+8z4LTEiNdxJenYHAIFelJeiVWgFNtyT2Uljs9hjCtwJGwl+TmAykzggriTjenlLzmWgYt9kycxkR0hWRDS8zAzLbcloUy9wkNnDrxK9kLtr7G//eDC98UmupvVhDmJaZzgNQOHTVPsF0w7RQ6JRiu6tTbMVQN8g0pH11Zo9A8kJUgCKZWEuh9JbtvG2skrG5OVJVm2Hv0R/FIauypaXM+AXF49D+E0PGP6Os8azk2DDaTBTl8m+7x28VsZMxbwwZtmbPaAVXAyDoCYKa4Ac+LdE1QMv7biiTBOsd4G1iV3nE1b3KO/Jkhb8VS4rxfVbPtU6EOwrBXnZ+0RzK2dJakAkwvLeaUiRnVA8j2o+TKD7n8TPRhuVIfB4ru6LymttzLYveXju7tvN0HHkJL9OoIRFE8i82wSK6s6d1CVrJH1hJtwvZGemuaPRxG/bIJYEtRtsxZO2SPo1F7MLg4XrubaEuNFqJsQAmV2ip3XKsmzIz5yezz0YdgiyYj5i6mXQb4tO5Bmj0OxsmAv/loNHjREwnC5jECT8txKCqkV6V5y5DtLnRR7aZY6X+k84pfGXSi29xupEaU4/NCUM7T5rv8Gl076BSKAQnkwLW3PmtL4g3r/kU0woda0L4RHbgsPT6/kMe7Foxx5UtV4+kaJgA99nXIL2TaYlc9RZlVYOOhTxgT/ZBKdU8lF29sej4nMVQdc1NP2ujq2xG/fffZTHIyPV7W17NbjgRr17STpji1f1PSremU37kpk/hPeaj9F7fnuqNGPuh09EfpnXH3EKzu1gQamfvPNmH0rsglrtxoImaeok41Lrpa7/4CbS03fCwKfNLg7CGdJbUxl9v0hviB3vGj3dJm4DWRW/fAeaJVdxYsIOsRKZT4g32mjOiEcgH2JHOGTD/d64Z0TpvO57bYjBjSMO4oK59/XY8uD1PwqEsiigrAQW9Tww9711NBXlAqDPpgLou6SUrySq/ZnsUeZofpJPAt8VCmZAcGUxVrMTpvCTMkcp7dfrg2yuVqNcQGVtTeHNpX0GBLrlLTocsf7YU5RAoOzHBeT4PVRsKmupuT0zD1S6eBSTgRH7mR2gS5hR5XxbniIfHEXUC2mE6cydsdh7arD3M4mf9UzAoBs6w0pZyO7ztOGX4FaZf5rWE+lizGf2bfvZqXGTRX94h11gSt+VLQqRjb4b8h+ZVhKFwEiVxpFn6GmvuN4lIfK/7xfvwAisCUDAjbNaV5mFfeS7o8l9pclZ+mni86AFgNnMiAJaPKsoClBACabYCRdSxrtAWIsiM9pfQCeHHy6d18dJqLCOBB62IQ4iZJ7YtJF3dV2q6ZKmo9XQwA4YUpj93Qe9b6d7FPtOiBgySlUay5EwDXDteNMcH1hfbTOxMvau5JcePDsDkmH/fzLdBhszCECrsdQBDR+nSCsd8DLyKifyVdHhMd0YJU3oiCpMGIIYlDeLRmBwsXdY88xPhTlItko2bH38581uvPcrp03jXLD0IPPhAYxpjfSJQ33pGX7U0NMQgXH1W1+dqGFpDhX6o7e7lQ/uxXvi/DBz6zoORfSOs+TD0xi4ptkjbHu6xsH9Slrx0JsxyT5yWGBqlYd9QxwsOxbe6X5jZSgxPyRvUdLTGhs6BeZ8UO8/IAZaHQq3WRycnBsA1M0ZJ+HP86Xy9zKg5wCrKzIcoHLfylSBPiChOHvjhJP0C0gt4uSz2f/7hfeJ3JNfNp+yCWZ3VtgzatBkiegjC0V72/HwN9AeaGnoJJ6mC4D5wSoJ7y1bugtFSo9t3wIlA9UjtEPqi/O5C/liG3vCAXluE64J778PSQq1Bm7yztPvo0p460IwXmJ6p635gMVcAlCraBnKTBTwzz+hKIdj+Ok5NBvu0WG/zDXiIWHushIY4XneJC6qryqkBr3HMfYj/OkAkRX/hCbSnsZN8Fc69hyUzryu07up0/q9/R1uYKp6jbAHKONoPfEfip43v0FfP6ncQv9cDcvUE0W/z1TNkNNFDx8nEOtrAu+8fty1fQrj2w==,iv:YGEXMLWOoQ19cbftQU9/4kFNcWIqjnw2GgZIddBwbrc=,tag:og1Avj5ZcYblJWrE2q2Bcg==,type:str]
#ENC[AES256_GCM,data:gIGYsk5h40IBhtmRM4G/yA==,iv:6tdKmKcvTQH7STvVjPIpwmGS2TEzZjX25CBwRIF8fjY=,tag:9pO4w0Zw+5iNkxwWf5VJDw==,type:comment]
caddy:
ovh_endpoint: ENC[AES256_GCM,data:dTdfKCWE,iv:NnmdUyM9F8ujEIfEEl9WXGLY3zRpIy9BDeqs1frK+R0=,tag:1AblJqi2hKISXBqNdWybqQ==,type:str]
ovh_application_key: ENC[AES256_GCM,data:48HzVrSa35qUSkLO7sbUwg==,iv:QfTRXsfTlgeoJdRJIph39EBbLynRNxH4DkFuuC06IuE=,tag:m8lJPHEEpK24MKUou0MTpw==,type:str]
@ -13,6 +17,20 @@ caddy:
ovh_consumer_key: ENC[AES256_GCM,data:oFLHB7obwz3F59Vt8LRxpKaHBjEaoYCrKLKPoqVHz4M=,iv:rXxR2Nv3YaT2QubZUqIi60RxaHe9ZaIT9hLiogbPVFw=,tag:5m+xXEUbN+a2fHCf+EXf9A==,type:str]
garage:
RPC_SECRET: ENC[AES256_GCM,data:OJbIST1mtpqMNk+MKnGFy6+tXjc6aEOMIWnfs8QY9ozpxN2apAN7ZrjAAZc3J7ORUIhUQh8Vjkb1EhxdqGxERA==,iv:NhREhGE0wz3/0sdXUxuDqWaPdjeeQFau2OEVsqpV3F0=,tag:yGYd5txtVQzIOchh2L/XXQ==,type:str]
penpot:
SECRET_KEY: ENC[AES256_GCM,data:Ebeehmby3FBDOaTxwTWg9vKTsB+w8wpa6FdxcvvRTwDR07A0Ljk4WCaPmbPBArbwB14cMSuGeDGBrvNo1x8N+u3FeMMei+TGvgJGssZynxEN7+g5gTg=,iv:ZAa3n7CCyeeeAIv48JpIZmjFiyHiXLFK+Q0Wqf7utFY=,tag:6JZZ53jEM579vYhQG4X2Fw==,type:str]
OIDC_CLIENT_SECRET: ENC[AES256_GCM,data:+GrXq113byY5XqFDE1tF4n5xcrhIjg2KI39xgxY6hEcS3r6KcF6SAFmczoscMFPJccaTv7Pcr7zfzDxGT7zDuNyj324nzvff,iv:onZV3ESU4Kbvp9x9rfXuq17FlhaoE/4ZXIwH4/bOXPc=,tag:I02FFF54NDMyJuicdwy4TA==,type:str]
SMTP_HOST: ENC[AES256_GCM,data:uFrTj1OIjs+48AmcBhsCFdXEakg=,iv:lFcAjJAC3uIc8u5KNhyiH55oBriV3cnsZ9wRXDfNM0I=,tag:1SbyUxXiKmltinkxQS8SPg==,type:str]
SMTP_PORT: ENC[AES256_GCM,data:Lnh0,iv:gCLwzWrk6hMUZjL1RGi51dS2TULtCfYnlpAOJBVBen0=,tag:fv7lwt36JpKhRjXF41Wc8g==,type:str]
SMTP_USERNAME: ENC[AES256_GCM,data:g1NvuwN+tko/mg==,iv:kXUGrBHLmk8GmZPaaiafOqkKMFhcwIh9pAEFPp716QI=,tag:WkVt+jCjfadIcTrjE8QF5A==,type:str]
SMTP_PASSWORD: ENC[AES256_GCM,data:tl7hp0a4l8JLOSQQvJNRwF4DR+83FaKI,iv:vR0KiXjnkyO1pa+fxQ6ALoYN6IMFAk07qmMe5qgRB1E=,tag:/RmJIzgjDEBH9XNMol3IUg==,type:str]
POSTGRES_USER: ENC[AES256_GCM,data:Uk7czFf4,iv:2PGek4z7UJzvs6X4Jq8wx+HkUFYGtq0kVJd5ba3M24E=,tag:QysuNOULNHBPdheBH6CRDA==,type:str]
POSTGRES_PASSWORD: ENC[AES256_GCM,data:S/VKs3mMwgnlpiDLOrvMX0VLNdCseg==,iv:opj0KJq93DWljtnAmktpzAf1l9b9OCvEPAbTC06IEbQ=,tag:DkmgRJ1AodO/sEty3C6mxg==,type:str]
AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:1hXif1dLMVHTj7nvqExW6wzFP+1BTwRcqro=,iv:fXqD2fiVQa0DH7z4s70e7ggORppgqoccP+sD6eMQsvw=,tag:g18kahkiT2G9P0SBTB4HfQ==,type:str]
AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:n+0cr0tDAUAdOu65YOj+reTzF+EoRFVAZVg5172ZKYnjWBuBYjNgy6QyqqcPvZMkBBtybdUimjDgWD6mVmNDew==,iv:UwgB7PLaCoXN/qAA63u9Q8ERkhRaNRlOpSFqrUBUExg=,tag:ggs1ED4Ryb+4+O+7VG0rTQ==,type:str]
STORAGE_ASSETS_S3_REGION: ENC[AES256_GCM,data:oV4ucbPe,iv:zNsUsftybGcQdryAB+mN9Xb/rVWOLFlVixqRLLz8WIY=,tag:FiiSjLyuK89HK1GEE3BSUA==,type:str]
STORAGE_ASSETS_S3_ENDPOINT: ENC[AES256_GCM,data:mZjvBvNZC28jUYrK8e6HHixC4GU=,iv:mppmZn7nV/gckB3+GonwQQT5U14qg1FyEnQ92pGDSZI=,tag:rAePtPdd6o+EDC0MrAToKw==,type:str]
STORAGE_ASSETS_S3_BUCKET: ENC[AES256_GCM,data:nfcjtCQVWhdT1UUYPw==,iv:mF2Esw1GvWAjkabvDde63bAq4V5pXNhbhqsK1dkg5sg=,tag:uE6qKxKSJzYtHWxPMiK3Lw==,type:str]
shadowsocks:
password: ENC[AES256_GCM,data:IdAvKXKckwvZUetkYSFTIPxd8nrwm13Ngc3KVDSmiW3AE4Rhmjk2VHjdUyQ=,iv:LVeQcL7XIEQyMTsXpXIROGte2+Z9+7FpemfiwhA0Pw0=,tag:qt+8jgN5UqwMeCV+D3stEQ==,type:str]
wireguard:
@ -42,8 +60,8 @@ sops:
MFpMemF4MGg1bmVUeWV5N25LTUtyczQKss0x4zT1kyeRu+qenhrdbcPlU/p+yjVN
y3j4eGpnwgc2rxSL9vkrrkzx/atUqUkgGU/YstszUrP6XKbJ+9ydpQ==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2024-10-18T09:05:47Z"
mac: ENC[AES256_GCM,data:fF67+S0Zv2WCIeVlQ0E+Jtg8SrKX6IeV6NrI2YAug8oN80836Yx/X5vSEz8Gj9RbEPfZmEHqZF0ccFQvOZjdY4loXBNIVqLbGGH8CqrRHuzndu8AR6/pP5WZeHYxcfKOXH+GGfix34OSkELvyXHT5ih7xWeP2gwGFeEY7jI5qPI=,iv:JPQ3wfOTpmEvZUF99KP2rfLmxGtjwZDG3T12NXY5kIM=,tag:p1GkO+i3lJVa2UpnQwGf3w==,type:str]
lastmodified: "2024-10-21T07:59:44Z"
mac: ENC[AES256_GCM,data:CVwxPgx5y64xr5kHnXCmhUgghwvpa+/ulJjjHVr68EVVQp7phrIOES2oF18WF4+HFFJ64YHI9KbuOz2pTjC+7H1TDBzedtQ1azqHT/ADcnKtAdFALS6M3/CpoS8X+TFeU3P3uLEsUfR8UrPNhxm8dlH6m9A0jQMVW0Fqpsd7s0w=,iv:oVfpo0R0WY8pt8LkQv9LfqqsKcuCZNder+P6QiMyRMw=,tag:lbDls/D0f+QHRrkyaPVbww==,type:str]
pgp: []
unencrypted_suffix: _unencrypted
version: 3.9.0

View file

@ -19,6 +19,23 @@ session:
authelia_url: 'https://auth.gasdev.fr'
default_redirection_url: 'https://auth.gasdev.fr/authenticated'
identity_providers:
oidc:
jwks:
- key: {{ secret "/secrets/OIDC_JWKS_PRIVATE_KEY" | mindent 10 "|" | msquote }}
clients:
- client_id: 'penpot'
client_name: 'Penpot'
client_secret: $pbkdf2-sha512$310000$WuYHbHrVI3wMn/tZXwDTMA$WnS0VoR4jLNQnXjJUN46EfnC4QMdpdnNcYsGvSCpkbzguO4of.tCgAeLsfzLgWn9CSGMt20TZOQfc/7IbfwBHg
redirect_uris: 'https://penpot.gasdev.fr/api/auth/oauth/oidc/callback'
token_endpoint_auth_method: 'client_secret_post'
authorization_policy: 'one_factor'
scopes:
- 'email'
- 'openid'
- 'profile'
authentication_backend:
password_reset:
disable: false

View file

@ -4,6 +4,8 @@
sops.secrets."authelia/SESSION_SECRET".owner = "root";
sops.secrets."authelia/STORAGE_PASSWORD".owner = "root";
sops.secrets."authelia/STORAGE_ENCRYPTION_KEY".owner = "root";
sops.secrets."authelia/OIDC_HMAC_SECRET".owner = "root";
sops.secrets."authelia/OIDC_JWKS_PRIVATE_KEY".owner = "root";
services.caddy.virtualHosts."auth.gasdev.fr".extraConfig = ''
reverse_proxy http://127.0.0.1:9091
@ -20,6 +22,9 @@
# AUTHELIA_STORAGE_POSTGRES_PASSWORD_FILE = "/secrets/STORAGE_PASSWORD";
AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE = "/secrets/STORAGE_ENCRYPTION_KEY";
AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE = "/secrets/SMTP_PASSWORD";
AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET_FILE = "/secrets/OIDC_HMAC_SECRET";
X_AUTHELIA_CONFIG_FILTERS = "template";
};
volumes = [
"authelia-data:/data"

View file

@ -2,6 +2,7 @@
imports = [
./authelia
./garage
./penpot
./shadowsocks
./uptime-kuma
./wireguard

116
services/penpot/default.nix Normal file
View file

@ -0,0 +1,116 @@
{config, ...}: {
services.caddy.virtualHosts."penpot.gasdev.fr".extraConfig = ''
reverse_proxy http://127.0.0.1:9001
'';
sops.secrets."penpot/SECRET_KEY".owner = "root";
sops.secrets."penpot/OIDC_CLIENT_SECRET".owner = "root";
sops.secrets."penpot/SMTP_HOST".owner = "root";
sops.secrets."penpot/SMTP_PORT".owner = "root";
sops.secrets."penpot/SMTP_USERNAME".owner = "root";
sops.secrets."penpot/SMTP_PASSWORD".owner = "root";
sops.secrets."penpot/POSTGRES_USER".owner = "root";
sops.secrets."penpot/POSTGRES_PASSWORD".owner = "root";
sops.secrets."penpot/AWS_ACCESS_KEY_ID".owner = "root";
sops.secrets."penpot/AWS_SECRET_ACCESS_KEY".owner = "root";
sops.secrets."penpot/STORAGE_ASSETS_S3_REGION".owner = "root";
sops.secrets."penpot/STORAGE_ASSETS_S3_ENDPOINT".owner = "root";
sops.secrets."penpot/STORAGE_ASSETS_S3_BUCKET".owner = "root";
sops.templates."penpot.env" = {
content = ''
PENPOT_SECRET_KEY=${config.sops.placeholder."penpot/SECRET_KEY"}
PENPOT_OIDC_CLIENT_SECRET=${config.sops.placeholder."penpot/OIDC_CLIENT_SECRET"}
# SMTP
PENPOT_SMTP_HOST=${config.sops.placeholder."penpot/SMTP_HOST"}
PENPOT_SMTP_PORT=${config.sops.placeholder."penpot/SMTP_PORT"}
PENPOT_SMTP_USERNAME=${config.sops.placeholder."penpot/SMTP_USERNAME"}
PENPOT_SMTP_PASSWORD=${config.sops.placeholder."penpot/SMTP_PASSWORD"}
# Database
PENPOT_DATABASE_USERNAME=${config.sops.placeholder."penpot/POSTGRES_USER"}
PENPOT_DATABASE_PASSWORD=${config.sops.placeholder."penpot/POSTGRES_PASSWORD"}
POSTGRES_USER=${config.sops.placeholder."penpot/POSTGRES_USER"}
POSTGRES_PASSWORD=${config.sops.placeholder."penpot/POSTGRES_PASSWORD"}
# Storage
AWS_ACCESS_KEY_ID=${config.sops.placeholder."penpot/AWS_ACCESS_KEY_ID"}
AWS_SECRET_ACCESS_KEY=${config.sops.placeholder."penpot/AWS_SECRET_ACCESS_KEY"}
PENPOT_STORAGE_ASSETS_S3_REGION=${config.sops.placeholder."penpot/STORAGE_ASSETS_S3_REGION"}
PENPOT_STORAGE_ASSETS_S3_BUCKET=${config.sops.placeholder."penpot/STORAGE_ASSETS_S3_BUCKET"}
PENPOT_STORAGE_ASSETS_S3_ENDPOINT=${config.sops.placeholder."penpot/STORAGE_ASSETS_S3_ENDPOINT"}
'';
owner = "root";
};
virtualisation.oci-containers.containers = {
penpot-frontend = {
image = "docker.io/penpotapp/frontend:latest";
autoStart = true;
ports = ["127.0.0.1:9001:80"];
volumes = [
"penpot_assets:/opt/data/assets"
];
environment = {
PENPOT_FLAGS = "disable-login-with-password disable-registration enable-login-with-oidc";
};
dependsOn = [
"penpot-backend"
"penpot-exporter"
];
};
penpot-backend = {
image = "docker.io/penpotapp/backend:latest";
autoStart = true;
volumes = [
"penpot_assets:/opt/data/assets"
];
environment = {
PENPOT_FLAGS = "disable-login-with-password enable-login-with-oidc enable-oidc-registration enable-smtp";
# Auth
PENPOT_OIDC_CLIENT_ID = "penpot";
PENPOT_OIDC_BASE_URI = "https://auth.gasdev.fr";
PENPOT_PUBLIC_URI = "https://penpot.gasdev.fr";
# DB
PENPOT_DATABASE_URI = "postgresql://penpot-postgres/penpot";
PENPOT_REDIS_URI = "redis://penpot-redis/0";
# Storage
PENPOT_ASSETS_STORAGE_BACKEND = "assets-s3";
# SMTP
PENPOT_SMTP_DEFAULT_FROM = "no-reply@gasdev.fr";
PENPOT_SMTP_DEFAULT_REPLY_TO = "no-reply@gasdev.fr";
PENPOT_SMTP_SSL = "true";
PENPOT_SMTP_TLS = "true";
# Other
PENPOT_TELEMETRY_ENABLED = "false";
};
environmentFiles = [
config.sops.templates."penpot.env".path
];
dependsOn = [
"penpot-postgres"
"penpot-redis"
];
};
penpot-exporter = {
image = "docker.io/penpotapp/exporter:latest";
autoStart = true;
environment = {
PENPOT_PUBLIC_URI = "http://penpot-frontend";
PENPOT_REDIS_URI = "redis://penpot-redis/0";
};
};
penpot-postgres = {
image = "docker.io/postgres:15";
autoStart = true;
environment = {
POSTGRES_INITDB_ARGS = "--data-checksums";
POSTGRES_DB = "penpot";
};
environmentFiles = [
config.sops.templates."penpot.env".path
];
};
penpot-redis = {
image = "docker.io/redis:7";
autoStart = true;
};
};
}