infra/services/netbox/default.nix
raito 3828721e4f services/netbox: enable OIDC via Lix SSO
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
2024-07-09 02:45:58 +02:00

81 lines
1.9 KiB
Nix

{
config,
lib,
pkgs,
...
}:
let
EnvironmentFile = [ config.age.secrets.netbox-environment.path ];
cfg = config.bagel.services.netbox;
inherit (lib) mkEnableOption mkOption mkIf types;
in
{
options.bagel.services.netbox = {
enable = mkEnableOption "Netbox";
domain = mkOption {
type = types.str;
};
};
config = mkIf cfg.enable {
age.secrets.netbox-environment.file = ../../secrets/netbox-environment.age;
services = {
netbox = {
enable = true;
package = pkgs.netbox_3_7;
secretKeyFile = "/dev/null";
listenAddress = "127.0.0.1";
settings = {
ALLOWED_HOSTS = [ cfg.domain ];
REMOTE_AUTH_BACKEND = "social_core.backends.open_id_connect.OpenIdConnectAuth";
};
extraConfig = lib.mkForce ''
from os import environ as env
SECRET_KEY = env["SECRET_KEY"]
SOCIAL_AUTH_OIDC_OIDC_ENDPOINT = env["NETBOX_OIDC_URL"]
SOCIAL_AUTH_OIDC_KEY = env["NETBOX_OIDC_KEY"]
SOCIAL_AUTH_OIDC_SECRET = env["NETBOX_OIDC_SECRET"]
'';
};
nginx = {
enable = true;
virtualHosts."${cfg.domain}" = {
enableACME = true;
forceSSL = true;
locations."/".proxyPass = "http://${config.services.netbox.listenAddress}:${builtins.toString config.services.netbox.port}";
locations."/static/".alias = "${config.services.netbox.dataDir}/static/";
};
};
};
systemd.services = {
netbox.serviceConfig = {
inherit EnvironmentFile;
TimeoutStartSec = 600;
};
netbox-housekeeping.serviceConfig = {
inherit EnvironmentFile;
};
netbox-rq.serviceConfig = {
inherit EnvironmentFile;
};
};
users.users.nginx.extraGroups = [ "netbox" ];
networking.firewall.allowedTCPPorts = [
443
80
];
};
}