64 lines
1.3 KiB
Nix
64 lines
1.3 KiB
Nix
{pkgs, config, lib, ...}: {
|
|
|
|
sops.secrets.postgres_keycloak = {
|
|
owner = config.systemd.services.keycloak.serviceConfig.User;
|
|
group = "keycloak";
|
|
};
|
|
|
|
users.users.keycloak = {
|
|
name = "keycloak";
|
|
isSystemUser = true;
|
|
group = "keycloak";
|
|
};
|
|
|
|
users.groups.keycloak = {
|
|
name = "keycloak";
|
|
members = [ "keycloak" ];
|
|
};
|
|
|
|
services = {
|
|
keycloak = {
|
|
enable = true;
|
|
|
|
settings = {
|
|
hostname = "keycloak.quitte.tassilo-tanneberger.de";
|
|
http-host = "127.0.0.1";
|
|
http-port = 8000;
|
|
https-port = 8001;
|
|
proxy = "edge";
|
|
};
|
|
|
|
database = {
|
|
username = "keycloak";
|
|
type = "postgresql";
|
|
passwordFile = config.sops.secrets.postgres_keycloak.path;
|
|
name = "keycloak";
|
|
host = "localhost";
|
|
createLocally = true;
|
|
};
|
|
};
|
|
postgresql = {
|
|
enable = true;
|
|
};
|
|
nginx = {
|
|
enable = true;
|
|
recommendedProxySettings = true;
|
|
virtualHosts = {
|
|
"${config.services.keycloak.settings.hostname}" = {
|
|
enableACME = true;
|
|
forceSSL = true;
|
|
http2 = true;
|
|
locations = {
|
|
"/" =
|
|
let
|
|
cfg = config.services.keycloak.settings;
|
|
in {
|
|
proxyPass = "http://${cfg.http-host}:${toString cfg.http-port}";
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
}
|