WIP: authelia: Add SSO

configuration/default.nix

@@ -132,10 +132,7 @@
     sudo.execWheelOnly = true;
 
     pam = {
-      sshAgentAuth = {
+      enableSSHAgentAuth = true;
-        enable = true;
-        authorizedKeysFiles = ["/etc/ssh/authorized_keys.d/%u"];
-      };
       services.sudo.sshAgentAuth = true;
     };
   };

configuration/services/nextcloud.nix

@@ -3,9 +3,6 @@
   config,
   ...
 }: let
-  # Update pending on rewrite of nextcloud news, though there is an
-  # alpha to switch to if it becomes necessary:
-  # https://github.com/nextcloud/news/issues/2610
   nextcloud = pkgs.nextcloud27;
   hostName = "nextcloud.${config.services.nginx.domain}";
 in {
@@ -20,16 +17,15 @@ in {
     configureRedis = true;
 
     config = {
+      overwriteProtocol = "https";
+
       dbtype = "pgsql";
       dbhost = "/run/postgresql";
 
       adminuser = "tlater";
       adminpassFile = config.sops.secrets."nextcloud/tlater".path;
-    };
 
-    settings = {
+      defaultPhoneRegion = "AT";
-      default_phone_region = "AT";
-      overwriteprotocol = "https";
     };
 
     phpOptions = {
@@ -41,6 +37,8 @@ in {
     };
   };
 
+  services.redis.vmOverCommit = true;
+
   # Ensure that this service doesn't start before postgres is ready
   systemd.services.nextcloud-setup.after = ["postgresql.service"];
 

flake.lock

@@ -242,16 +242,16 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1718208800,
+        "lastModified": 1714272655,
-        "narHash": "sha256-US1tAChvPxT52RV8GksWZS415tTS7PV42KTc2PNDBmc=",
+        "narHash": "sha256-3/ghIWCve93ngkx5eNPdHIKJP/pMzSr5Wc4rNKE1wOc=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "cc54fb41d13736e92229c21627ea4f22199fee6b",
+        "rev": "12430e43bd9b81a6b4e79e64f87c624ade701eaf",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
-        "ref": "nixos-24.05",
+        "ref": "nixos-23.11",
         "repo": "nixpkgs",
         "type": "github"
       }

flake.nix

@@ -2,7 +2,7 @@
   description = "tlater.net host configuration";
 
   inputs = {
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-24.05";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-23.11";
     nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable";
     disko = {
       url = "github:nix-community/disko";