hacc/haccfiles
8
0
Fork 1
Code Issues 1 Pull requests Projects Releases Wiki Activity
haccfiles/hosts/hainich/services/wink.nix

92 lines
2.7 KiB
Nix
Raw Normal View History

Add wink (Wo ist meine Winkekatze?) for hacc-voc This adds an instance of wink for the hacc-voc to hainich. Unfortunately, neither the actual package nor the container itself look very nixy, and e.g. cannot be configured declaratively. On the other hand, it does not appear the wink *has* any kind of config, so I guess there's that. Wink itself runs in a nixos container, but I've exposed its database to /var/lib/wink-db on the host, just to make it easier to access. After deployment, we still need to migrate our current database to this instance by hand (i.e. take the current database, rename it "development.sqlite3", and move it into the wink-db directory). Any improvements to this mess are welcome.
2021-02-22 14:20:07 +00:00
# for documentation on how this container works, have a look at
# https://wiki.infra4future.de/books/voc-infra/page/wink-65b
{ pkgs, config, ...}:
{
containers.wink = {
autoStart = true;
privateNetwork = true;
hostAddress = "192.168.100.10";
localAddress = "192.168.100.11";
wink: oauth2_proxy half-working For the record: this is the last state before nftables broke yesterday. As far as I know, all that is missing from this to make the authentication for wink actually work is internet access for the container (as was also the case for hasenloch); the snippets for coredns and NAT copied from that container led to the aforementioned firewall problem — or at least they are the only thing I changed between deployments. Apart from that: this moves the proxy into the container, mostly to make keeping track of its state (esp. the secrets file) easier should we ever decide to move this somewhere else / delete the container, since that will just delete any additional state of the proxy with it.
2021-03-19 14:24:03 +00:00
Add wink (Wo ist meine Winkekatze?) for hacc-voc This adds an instance of wink for the hacc-voc to hainich. Unfortunately, neither the actual package nor the container itself look very nixy, and e.g. cannot be configured declaratively. On the other hand, it does not appear the wink *has* any kind of config, so I guess there's that. Wink itself runs in a nixos container, but I've exposed its database to /var/lib/wink-db on the host, just to make it easier to access. After deployment, we still need to migrate our current database to this instance by hand (i.e. take the current database, rename it "development.sqlite3", and move it into the wink-db directory). Any improvements to this mess are welcome.
2021-02-22 14:20:07 +00:00
config = {pkgs, config, ...}: {
wink: oauth2_proxy half-working For the record: this is the last state before nftables broke yesterday. As far as I know, all that is missing from this to make the authentication for wink actually work is internet access for the container (as was also the case for hasenloch); the snippets for coredns and NAT copied from that container led to the aforementioned firewall problem — or at least they are the only thing I changed between deployments. Apart from that: this moves the proxy into the container, mostly to make keeping track of its state (esp. the secrets file) easier should we ever decide to move this somewhere else / delete the container, since that will just delete any additional state of the proxy with it.
2021-03-19 14:24:03 +00:00
networking.firewall.allowedTCPPorts = [ 8000 ];
Add wink (Wo ist meine Winkekatze?) for hacc-voc This adds an instance of wink for the hacc-voc to hainich. Unfortunately, neither the actual package nor the container itself look very nixy, and e.g. cannot be configured declaratively. On the other hand, it does not appear the wink *has* any kind of config, so I guess there's that. Wink itself runs in a nixos container, but I've exposed its database to /var/lib/wink-db on the host, just to make it easier to access. After deployment, we still need to migrate our current database to this instance by hand (i.e. take the current database, rename it "development.sqlite3", and move it into the wink-db directory). Any improvements to this mess are welcome.
2021-02-22 14:20:07 +00:00
environment.systemPackages = [ pkgs.wink pkgs.v8 ];
systemd.services.wink = {
enable = true;
description = "Wo ist meine Winkekatze?";
wantedBy = [ "multi-user.target" ];
serviceConfig.type = "simple";
environment.HOME = "/var/lib/wink/home";
path = [ pkgs.wink pkgs.v8 ];
script = ''
mkdir -p /var/lib/wink/home
cd /var/lib/wink
cp -r ${pkgs.wink.outPath}/* .
if [ ! -f database.exists ]
then
rails-wrapped db:migrate db:seed RAILS_ENV=development
touch database.exists
fi
rails-wrapped server -b [::] -p 3000
'';
};
wink: oauth2_proxy half-working For the record: this is the last state before nftables broke yesterday. As far as I know, all that is missing from this to make the authentication for wink actually work is internet access for the container (as was also the case for hasenloch); the snippets for coredns and NAT copied from that container led to the aforementioned firewall problem — or at least they are the only thing I changed between deployments. Apart from that: this moves the proxy into the container, mostly to make keeping track of its state (esp. the secrets file) easier should we ever decide to move this somewhere else / delete the container, since that will just delete any additional state of the proxy with it.
2021-03-19 14:24:03 +00:00
services.oauth2_proxy =
let keycloakurl = "https://auth.infra4future.de/auth/realms/forfuture/protocol/openid-connect";
in {
enable = true;
#nginx.virtualHosts = [ "matrix.hacc.space" ];
upstream = "http://localhost:3000";
httpAddress = "http//0.0.0.0:8000";
email.domains = [ "*" ];
wink: add cookie domain in oauth2-proxy In theory, this should work without that option (by getting the correct domain from the nginx reverse proxy via IP header), but apparently it doesn't. Also, I moved wink to wink2.hacc.space
2021-03-22 22:46:24 +00:00
cookie.domain = "wink2.hacc.space";
wink: oauth2_proxy half-working For the record: this is the last state before nftables broke yesterday. As far as I know, all that is missing from this to make the authentication for wink actually work is internet access for the container (as was also the case for hasenloch); the snippets for coredns and NAT copied from that container led to the aforementioned firewall problem — or at least they are the only thing I changed between deployments. Apart from that: this moves the proxy into the container, mostly to make keeping track of its state (esp. the secrets file) easier should we ever decide to move this somewhere else / delete the container, since that will just delete any additional state of the proxy with it.
2021-03-19 14:24:03 +00:00
# for the keycloak side of the configuration, see the documentation at
# https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/oauth_provider#keycloak-auth-provider
provider = "keycloak";
clientID = "winktest"; # TODO
loginURL = "${keycloakurl}/auth";
redeemURL = "${keycloakurl}/token";
profileURL = "${keycloakurl}/userinfo";
validateURL = "${keycloakurl}/userinfo";
# must contain OAUTH2_PROXY_COOKIE_SECRET and OAUTH2_PROXY_CLIENT_SECRET
keyFile = "/var/lib/oauth2_proxy/secrets";
extraConfig = {
# log format (default would also log ip addresses / users)
auth-logging-format = "[{{.Timestamp}}] [{{.Status}}] {{.Message}}";
#allowed_group = "hacc";
};
};
wink: add nat and coredns to container This should let it talk to the outside network (i.e. the internet), and thereby enable the oauth2-proxy to redeem codes to authenticate clients.
2021-03-21 01:45:31 +00:00
services.coredns = {
enable = true;
config = ''
.:53 {
forward . 1.1.1.1
}
'';
};
Add wink (Wo ist meine Winkekatze?) for hacc-voc This adds an instance of wink for the hacc-voc to hainich. Unfortunately, neither the actual package nor the container itself look very nixy, and e.g. cannot be configured declaratively. On the other hand, it does not appear the wink *has* any kind of config, so I guess there's that. Wink itself runs in a nixos container, but I've exposed its database to /var/lib/wink-db on the host, just to make it easier to access. After deployment, we still need to migrate our current database to this instance by hand (i.e. take the current database, rename it "development.sqlite3", and move it into the wink-db directory). Any improvements to this mess are welcome.
2021-02-22 14:20:07 +00:00
};
};
wink: oauth2_proxy half-working For the record: this is the last state before nftables broke yesterday. As far as I know, all that is missing from this to make the authentication for wink actually work is internet access for the container (as was also the case for hasenloch); the snippets for coredns and NAT copied from that container led to the aforementioned firewall problem — or at least they are the only thing I changed between deployments. Apart from that: this moves the proxy into the container, mostly to make keeping track of its state (esp. the secrets file) easier should we ever decide to move this somewhere else / delete the container, since that will just delete any additional state of the proxy with it.
2021-03-19 14:24:03 +00:00
wink: add cookie domain in oauth2-proxy In theory, this should work without that option (by getting the correct domain from the nginx reverse proxy via IP header), but apparently it doesn't. Also, I moved wink to wink2.hacc.space
2021-03-22 22:46:24 +00:00
services.nginx.virtualHosts."wink2.hacc.space" = {
wink: oauth2_proxy half-working For the record: this is the last state before nftables broke yesterday. As far as I know, all that is missing from this to make the authentication for wink actually work is internet access for the container (as was also the case for hasenloch); the snippets for coredns and NAT copied from that container led to the aforementioned firewall problem — or at least they are the only thing I changed between deployments. Apart from that: this moves the proxy into the container, mostly to make keeping track of its state (esp. the secrets file) easier should we ever decide to move this somewhere else / delete the container, since that will just delete any additional state of the proxy with it.
2021-03-19 14:24:03 +00:00
locations."/".proxyPass = "http://${config.containers.wink.localAddress}:8000";
Add wink (Wo ist meine Winkekatze?) for hacc-voc This adds an instance of wink for the hacc-voc to hainich. Unfortunately, neither the actual package nor the container itself look very nixy, and e.g. cannot be configured declaratively. On the other hand, it does not appear the wink *has* any kind of config, so I guess there's that. Wink itself runs in a nixos container, but I've exposed its database to /var/lib/wink-db on the host, just to make it easier to access. After deployment, we still need to migrate our current database to this instance by hand (i.e. take the current database, rename it "development.sqlite3", and move it into the wink-db directory). Any improvements to this mess are welcome.
2021-02-22 14:20:07 +00:00
forceSSL = true;
enableACME = true;
};
wink: init oauth2-proxy configuration. Since there was a desire for some kind of authentication in front of wink, here is a barebones config using oauth2-proxy. It is as yet untested, since I didn't want to deploy things right now / fiddle with the keycloak settings. See the comments in the documentation for what must still be done to make this work. I acknowledge that I said I wouldn't do this, but no one else seems to care.
2021-03-13 13:54:12 +00:00
wink: add nat and coredns to container This should let it talk to the outside network (i.e. the internet), and thereby enable the oauth2-proxy to redeem codes to authenticate clients.
2021-03-21 01:45:31 +00:00
networking.nat.enable = true;
networking.nat.internalInterfaces = ["ve-wink"];
networking.nat.externalInterface = "enp6s0";
wink: oauth2_proxy half-working For the record: this is the last state before nftables broke yesterday. As far as I know, all that is missing from this to make the authentication for wink actually work is internet access for the container (as was also the case for hasenloch); the snippets for coredns and NAT copied from that container led to the aforementioned firewall problem — or at least they are the only thing I changed between deployments. Apart from that: this moves the proxy into the container, mostly to make keeping track of its state (esp. the secrets file) easier should we ever decide to move this somewhere else / delete the container, since that will just delete any additional state of the proxy with it.
2021-03-19 14:24:03 +00:00
wink: init oauth2-proxy configuration. Since there was a desire for some kind of authentication in front of wink, here is a barebones config using oauth2-proxy. It is as yet untested, since I didn't want to deploy things right now / fiddle with the keycloak settings. See the comments in the documentation for what must still be done to make this work. I acknowledge that I said I wouldn't do this, but no one else seems to care.
2021-03-13 13:54:12 +00:00
Add wink (Wo ist meine Winkekatze?) for hacc-voc This adds an instance of wink for the hacc-voc to hainich. Unfortunately, neither the actual package nor the container itself look very nixy, and e.g. cannot be configured declaratively. On the other hand, it does not appear the wink *has* any kind of config, so I guess there's that. Wink itself runs in a nixos container, but I've exposed its database to /var/lib/wink-db on the host, just to make it easier to access. After deployment, we still need to migrate our current database to this instance by hand (i.e. take the current database, rename it "development.sqlite3", and move it into the wink-db directory). Any improvements to this mess are welcome.
2021-02-22 14:20:07 +00:00
}
Reference in a new issue Copy permalink