xin/nixos-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

auth: switch domain

Browse source
This commit is contained in:
xinyangli 2025-02-14 14:33:02 +08:00
parent 2e2968360c
commit 35b19d67d7
Signed by: xin
SSH key fingerprint: SHA256:UU5pRTl7NiLFJbWJZa+snLylZSXIz5rgHmwjzv8v4oE
2 changed files with 6 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
machines/calcite/configuration.nix
View file

@ -6,6 +6,7 @@
}: }:
let let
inherit (lib) mkForce getExe; inherit (lib) mkForce getExe;
inherit (config.my-lib.settings) idpUrl;
in in
{ {
imports = [ imports = [
@ -223,7 +224,7 @@ in
services.kanidm = { services.kanidm = {
enableClient = true; enableClient = true;
clientSettings = { clientSettings = {
uri = "https://auth.xinyang.life"; uri = "https://${idpUrl}";
}; };
}; };

9
modules/nixos/common-settings/auth.nix
View file

@ -2,7 +2,6 @@
config, config,
lib, lib,
pkgs, pkgs,
my-lib,
... ...
}: }:
@ -12,7 +11,7 @@ let
mkEnableOption mkEnableOption
; ;
inherit (my-lib) idpUrl; inherit (config.my-lib.settings) idpUrl;
cfg = config.commonSettings.auth; cfg = config.commonSettings.auth;
in in
@ -25,7 +24,7 @@ in
services.kanidm = { services.kanidm = {
enableClient = true; enableClient = true;
clientSettings = { clientSettings = {
uri = "https://auth.xinyang.life"; uri = "https://${idpUrl}";
}; };
enablePam = true; enablePam = true;
unixSettings = { unixSettings = {
@ -48,11 +47,11 @@ in
environment.etc."ssh/auth" = { environment.etc."ssh/auth" = {
mode = "0555"; mode = "0555";
text = '' text = ''
#!${pkgs.stdenv.shell} #!/bin/sh
${pkgs.kanidm}/bin/kanidm_ssh_authorizedkeys $1 ${pkgs.kanidm}/bin/kanidm_ssh_authorizedkeys $1
''; '';
}; };
users.groups.wheel.members = [ "xin@auth.xinyang.life" ]; users.groups.wheel.members = [ "xin@${idpUrl}" ];
users.groups.kanidm-ssh-runner = { }; users.groups.kanidm-ssh-runner = { };
users.users.kanidm-ssh-runner = { users.users.kanidm-ssh-runner = {
isSystemUser = true; isSystemUser = true;