about summary refs log tree commit diff
path: root/modules/services/nginx/sso/default.nix
blob: 27ed7d6194e2843ae90a3125ee99ea4b5286e615 (plain) (blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
# I must override the module to allow having runtime secrets
{ config, lib, pkgs, utils, ... }:
let
  cfg = config.services.nginx.sso;
  pkg = lib.getBin cfg.package;
  confPath = "/var/lib/nginx-sso/config.json";
in {
  disabledModules = [ "services/security/nginx-sso.nix" ];
  options.services.nginx.sso = with lib; {
    enable = mkEnableOption "nginx-sso service";
    package = mkOption {
      type = types.package;
      default = pkgs.nginx-sso;
      defaultText = "pkgs.nginx-sso";
      description = ''
        The nginx-sso package that should be used.
      '';
    };
    configuration = mkOption {
      type = types.attrsOf types.unspecified;
      default = { };
      example = literalExample ''
        {
          listen = { addr = "127.0.0.1"; port = 8080; };
          providers.token.tokens = {
            myuser = "MyToken";
          };
          acl = {
            rule_sets = [
              {
                rules = [ { field = "x-application"; equals = "MyApp"; } ];
                allow = [ "myuser" ];
              }
            ];
          };
        }
      '';
      description = ''
        nginx-sso configuration
        (<link xlink:href="https://github.com/Luzifer/nginx-sso/wiki/Main-Configuration">documentation</link>)
        as a Nix attribute set.
      '';
    };
  };
  config = lib.mkIf cfg.enable {
    systemd.services.nginx-sso = {
      description = "Nginx SSO Backend";
      after = [ "network.target" ];
      wantedBy = [ "multi-user.target" ];
      serviceConfig = {
        StateDirectory = "nginx-sso";
        WorkingDirectory = "/var/lib/nginx-sso";
        # The files to be merged might not have the correct permissions
        ExecStartPre = "+${
            pkgs.writeScript "merge-nginx-sso-config" ''
              #!${pkgs.bash}/bin/bash
              rm -f '${confPath}'
              ${utils.genJqSecretsReplacementSnippet cfg.configuration confPath}
              # Fix permissions
              chown nginx-sso:nginx-sso ${confPath}
              chmod 0600 ${confPath}
            ''
          }";
        ExecStart = lib.mkForce ''
          ${pkg}/bin/nginx-sso \
            --config ${confPath} \
            --frontend-dir ${pkg}/share/frontend
        '';
        Restart = "always";
        User = "nginx-sso";
        Group = "nginx-sso";
      };
    };
    users.users.nginx-sso = {
      isSystemUser = true;
      group = "nginx-sso";
    };
    users.groups.nginx-sso = { };
  };
}