WIP: authelia: Add SSO

configuration/nginx.nix

@@ -49,6 +49,13 @@
   security.acme = {
     defaults.email = "tm@tlater.net";
     acceptTerms = true;
+
+    certs."tlater.net" = {
+      extraDomainNames = ["*.tlater.net"];
+      dnsProvider = "hetzner";
+      group = "nginx";
+      credentialFiles."HETZNER_API_KEY_FILE" = config.sops.secrets."hetzner-api".path;
+    };
   };
 
   services.backups.acme = {

configuration/services/afvalcalendar.nix

@@ -44,7 +44,7 @@
 
   services.nginx.virtualHosts."afvalcalendar.${config.services.nginx.domain}" = {
     forceSSL = true;
-    enableACME = true;
+    useACMEHost = "tlater.net";
     enableHSTS = true;
 
     root = "/srv/afvalcalendar";

configuration/services/conduit.nix

@@ -178,7 +178,7 @@ in {
   };
 
   services.nginx.virtualHosts."${domain}" = {
-    enableACME = true;
+    useACMEHost = "tlater.net";
 
     listen = [
       {

configuration/services/foundryvtt.nix

@@ -24,7 +24,7 @@ in {
     inherit (config.services.foundryvtt) port;
   in {
     forceSSL = true;
-    enableACME = true;
+    useACMEHost = "tlater.net";
     enableHSTS = true;
 
     locations."/" = {

configuration/services/gitea.nix

@@ -41,7 +41,7 @@ in {
     httpPort = config.services.forgejo.settings.server.HTTP_PORT;
   in {
     forceSSL = true;
-    enableACME = true;
+    useACMEHost = "tlater.net";
     enableHSTS = true;
 
     locations."/".proxyPass = "http://${httpAddress}:${toString httpPort}";

configuration/services/metrics/grafana.nix

@@ -38,7 +38,7 @@ in {
 
   services.nginx.virtualHosts."${domain}" = {
     forceSSL = true;
-    enableACME = true;
+    useACMEHost = "tlater.net";
     enableHSTS = true;
     enableAuthorization = true;
     locations."/".proxyPass = "http://localhost:${toString config.services.grafana.settings.server.http_port}";

configuration/services/nextcloud.nix

@@ -45,7 +45,7 @@ in {
   # Set up SSL
   services.nginx.virtualHosts."${hostName}" = {
     forceSSL = true;
-    enableACME = true;
+    useACMEHost = "tlater.net";
     # The upstream module already adds HSTS
   };
 

configuration/services/webserver.nix

@@ -16,7 +16,7 @@ in {
     serverAliases = ["www.${domain}"];
 
     forceSSL = true;
-    enableACME = true;
+    useACMEHost = "tlater.net";
     enableHSTS = true;
 
     locations."/".proxyPass = "http://${addr}:${toString port}";

configuration/sops.nix

@@ -34,6 +34,10 @@
       "heisenbridge/as-token" = {};
       "heisenbridge/hs-token" = {};
 
+      "hetzner-api" = {
+        owner = "acme";
+      };
+
       # Nextcloud
       "nextcloud/tlater" = {
         owner = "nextcloud";