nuc: add authentik-ldap

hosts/nuc/default.nix

@@ -15,7 +15,6 @@
       ./modules/seafile
       ./modules/torrent
       ./modules/vaultwarden
-      # ./modules/nginx
       ./modules/caddy
       ./modules/indexing
     ];

hosts/nuc/modules/authentik/default.nix

@@ -3,17 +3,19 @@ let
   domain = "auth.${config.networking.domain}";
 in
 {
-  age.secrets.authentik = {
-    file = ../../../../secrets/nuc/authentik.age;
+  age.secrets.authentik-core = {
+    file = ../../../../secrets/nuc/authentik/core.age;
+  };
+  age.secrets.authentik-ldap = {
+    file = ../../../../secrets/nuc/authentik/ldap.age;
   };
   services.authentik = {
     enable = true;
-    environmentFile = config.age.secrets.authentik.path;
-    # nginx = {
-    #   enable = true;
-    #   enableACME = true;
-    #   host = domain;
-    # };
+    environmentFile = config.age.secrets.authentik-core.path;
+  };
+  services.authentik-ldap = {
+    enable = true;
+    environmentFile = config.age.secrets.authentik-ldap.path;
   };
   services.caddy.virtualHosts."${domain}".extraConfig = ''
     reverse_proxy localhost:9000

hosts/nuc/modules/matrix/default.nix

@@ -74,7 +74,8 @@ in
 
         # element
         "${domainClient}".extraConfig = ''
-          root '${pkgs.element-web.override {
+          file_server browse
+          root * ${pkgs.element-web.override {
             conf = {
               default_server_config = {
                 inherit (clientConfig) "m.homeserver";
@@ -82,7 +83,7 @@ in
               };
               disable_3pid_login = true;
             };
-          }}'
+          }}
         '';
       };
     };

hosts/nuc/modules/nginx/default.nix

@@ -1,41 +0,0 @@
-{ pkgs, lib, config, ... }:
-{
-  # set default options for virtualHosts
-  options = with lib; {
-    services.nginx.virtualHosts = mkOption {
-      type = types.attrsOf (types.submodule
-        ({ name, ... }: {
-          # split up nginx access logs per vhost
-          enableACME = true;
-          forceSSL = true;
-          # enable http3 for all hosts
-          quic = true;
-          http3 = true;
-          extraConfig = ''
-            access_log /var/log/nginx/${name}_access.log;
-            error_log /var/log/nginx/${name}_error.log;
-            add_header Alt-Svc 'h3=":443"; ma=86400';
-          '';
-        })
-      );
-    };
-  };
-  config = {
-    networking.firewall.allowedTCPPorts = [ 80 443 ];
-    networking.firewall.allowedUDPPorts = [ 443 ];
-    services.nginx = {
-      enable = true;
-      package = pkgs.nginxQuic;
-      recommendedTlsSettings = true;
-      recommendedProxySettings = true;
-      recommendedGzipSettings = true;
-      recommendedOptimisation = true;
-    };
-    security.acme = {
-      acceptTerms = true;
-      defaults = {
-        email = "rouven@${config.networking.domain}";
-      };
-    };
-  };
-}

hosts/nuc/modules/seafile/default.nix

@@ -35,7 +35,7 @@ in
     redir /accounts/login /oauth/login
     reverse_proxy unix//run/seahub/gunicorn.sock
     route /media/* {
-      root '${pkgs.seahub}'
+      root * ${pkgs.seahub}
     }
 
     route /seafhttp/* {

secrets.nix

@@ -22,7 +22,8 @@ in
   "secrets/nuc/vaultwarden.age".publicKeys = [ rouven nuc ];
   "secrets/nuc/mullvad.age".publicKeys = [ rouven nuc ];
   "secrets/nuc/keycloak/db.age".publicKeys = [ rouven nuc ];
-  "secrets/nuc/authentik.age".publicKeys = [ rouven nuc ];
+  "secrets/nuc/authentik/core.age".publicKeys = [ rouven nuc ];
+  "secrets/nuc/authentik/ldap.age".publicKeys = [ rouven nuc ];
   "secrets/nuc/cache.age".publicKeys = [ rouven nuc ];
   "secrets/nuc/borg/passphrase.age".publicKeys = [ rouven nuc ];
   "secrets/nuc/borg/key.age".publicKeys = [ rouven nuc ];

secrets/nuc/authentik/ldap.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 uWbAHQ 3GSNWb2Oly++M5tvybIiDwr2yMJ/1OGDlfXMMsjFkkI
+yQpVNnYmv0SOtSy6K6KBuCPpOWJ1D//tWL4QkfbQqCI
+-> ssh-ed25519 2TRdXg Eme+V3YHksjnqGsbWILJWyiLyh2EqqZ2VbylKVa9TAY
+tJyYG2C6cykSUipTFzbAh5/UkUZ5KOsJjOeis/+sMks
+--- tEpEe7Vh4XVOFgAQHCx42pFcx7P2XV4LqFXVJsv/Ug8
+%Öºo$û"²øؽ0Ö—2š'¹nÍØHèÙ¶¿£l„Á‘õæ§7àjŽ	nôeˆ¾¥‰/¯-\?·Š3z«GóáꙬ"<22>r£Â*ÅÁЋ0‡¡Ð£ð;meÛ.Ù<>1@9¿’…šßê¿
®¾F!†«Û
…*%á>º,Ì<>æRèó)yjU´lœªFݨ
÷…ú1ÿ>‡V<>ó	p%š¸“çüiM*w»Ä›ß