jsw/NiksOS
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

zitadel #2

Merged
jsw merged 14 commits from zitadel into master 2025-07-24 21:45:32 +00:00
Conversation 0 Commits 14 Files changed 11 +39 -9
2 changed files with 39 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files
Showing only changes of commit 87bef5a352 - Show all commits

8
system/server/immich.nix
View file

@ -9,12 +9,14 @@
cfg = config.niksos.server; cfg = config.niksos.server;
oidcSubstitute = "*@#OPENIDCLIENTSECRET#@*"; oidcSubstitute = "*@#OPENIDCLIENTSECRET#@*";
config-dir = "/run/immich-conf"; config-dir = "/run/immich-conf";
url = "photos.jsw.tf";
httpsUrl = "https://" + url;
in { in {
config = config =
mkIf cfg mkIf cfg
{ {
users.users.${config.services.immich.user}.extraGroups = ["video" "render"]; users.users.${config.services.immich.user}.extraGroups = ["video" "render"];
services.caddy.virtualHosts."photos.jsw.tf".extraConfig = '' services.caddy.virtualHosts.${url}.extraConfig = ''
reverse_proxy localhost:9002 reverse_proxy localhost:9002
''; '';
@ -29,7 +31,7 @@ in {
#NOTE: immich doesn't support variables in their config file, so we have to subsitute ourselfs.. #NOTE: immich doesn't support variables in their config file, so we have to subsitute ourselfs..
environment.IMMICH_CONFIG_FILE = mkForce "${config-dir}/immich.json"; environment.IMMICH_CONFIG_FILE = mkForce "${config-dir}/immich.json";
settings = { settings = {
server.externalDomain = "https://photos.jsw.tf"; server.externalDomain = httpsUrl;
oauth = { oauth = {
enabled = true; enabled = true;
autoLaunch = true; autoLaunch = true;
@ -38,6 +40,8 @@ in {
clientId = "329735769805619570"; clientId = "329735769805619570";
clientSecret = oidcSubstitute; clientSecret = oidcSubstitute;
issuerUrl = "https://${config.services.zitadel.settings.ExternalDomain}/.well-known/openid-configuration"; issuerUrl = "https://${config.services.zitadel.settings.ExternalDomain}/.well-known/openid-configuration";
mobileRedirectUri = "${httpsUrl}/api/oauth/mobile-redirect";
mobileOverrideEnabled = true;
}; };
passwordLogin.enabled = false; passwordLogin.enabled = false;
ffmpeg = { ffmpeg = {

40
system/server/seafile.nix
View file

@ -3,25 +3,52 @@
inputs, inputs,
pkgs, pkgs,
... ...
}: { }: let
url = "files.jsw.tf";
httpsUrl = "https://" + url;
authUrl = config.services.zitadel.settings.ExternalDomain;
httpsAuthUrl = "https://" + authUrl;
oidcSubstitute = "*@#OPENIDCLIENTSECRET#@*";
config-dir = "/run/immich-conf";
in {
services.seafile = { services.seafile = {
enable = config.niksos.server; enable = config.niksos.server;
seahubPackage = inputs.nixpkgs-stable.legacyPackages.${pkgs.system}.seahub; seahubPackage = inputs.nixpkgs-stable.legacyPackages.${pkgs.system}.seahub;
adminEmail = "jurnwubben@gmail.com"; adminEmail = "jsw@jsw.tf";
initialAdminPassword = "ChangeMeTheFuckNow!"; initialAdminPassword = "ChangeMeTheFuckNow!";
gc.enable = true; gc.enable = true;
ccnetSettings.General.SERVICE_URL = "https://files.jsw.tf"; ccnetSettings.General.SERVICE_URL = httpsUrl;
seahubExtraConf = '' seahubExtraConf = ''
ALLOWED_HOSTS = ['.files.jsw.tf'] ALLOWED_HOSTS = ['.${url}']
CSRF_COOKIE_SECURE = True CSRF_COOKIE_SECURE = True
CSRF_COOKIE_SAMESITE = 'Strict' CSRF_COOKIE_SAMESITE = 'Strict'
CSRF_TRUSTED_ORIGINS = ['https://files.jsw.tf', 'https://www.files.jsw.tf'] CSRF_TRUSTED_ORIGINS = ['${httpsUrl}']
SITE_NAME = "JSW Cloud" SITE_NAME = "JSW Cloud"
SITE_TITLE = "JSW Cloud" SITE_TITLE = "JSW Cloud"
ENABLE_OAUTH = True
OAUTH_CREATE_UNKNOWN_USER = True
OAUTH_ACTIVATE_USER_AFTER_CREATION = True
OAUTH_ENABLE_INSECURE_TRANSPORT = False
OAUTH_CLIENT_ID = "329743411726844274"
OAUTH_CLIENT_SECRET = "${oidcSubstitute}"
OAUTH_REDIRECT_URL = '${httpsUrl}/oauth/callback/'
OAUTH_PROVIDER_DOMAIN = '${authUrl}'
OAUTH_PROVIDER = 'JSW Auth'
OAUTH_AUTHORIZATION_URL = '${httpsAuthUrl}/oauth/v2/authorize'
OAUTH_TOKEN_URL = '${httpsAuthUrl}/oauth/v2/token'
OAUTH_USER_INFO_URL = '${httpsAuthUrl}/oidc/v1/userinfo'
OAUTH_SCOPE = ["user",]
OAUTH_ATTRIBUTE_MAP = {
"id": (True, "email"),
"name": (False, "name"),
"email": (False, "contact_email"),
"uid": (True, "uid"),
}
''; '';
seafileSettings = { seafileSettings = {
quota.default = 30; quota.default = 30;
@ -35,8 +62,7 @@
}; };
}; };
services.caddy.virtualHosts."files.jsw.tf" = { services.caddy.virtualHosts.${url} = {
# serverAliases = ["www.share.jsw.tf"];
extraConfig = '' extraConfig = ''
handle_path /seafhttp/* { handle_path /seafhttp/* {
reverse_proxy * unix//run/seafile/server.sock reverse_proxy * unix//run/seafile/server.sock