overlays: add oidc-agent

modules/nixos/default.nix

@@ -9,5 +9,6 @@
     ./kanidm-client.nix
     ./ssh-tpm-agent.nix # FIXME: Waiting for upstream merge
     ./forgejo-actions-runner.nix
+    ./oidc-agent.nix
   ];
 }

modules/nixos/inbounds.nix

@@ -0,0 +1,126 @@
+{ config
+, lib
+, ... }:
+let
+  cfg = config.custom.sing-box-server;
+
+  secretFileType = lib.types.submodule {
+    _secret = lib.types.path;
+  };
+  singTls = {
+    enabled = true;
+    server_name = config.deployment.targetHost;
+    key_path = config.security.acme.certs.${config.deployment.targetHost}.directory + "/key.pem";
+    certificate_path = config.security.acme.certs.${config.deployment.targetHost}.directory + "/cert.pem";
+  };
+in 
+{
+  options = {
+    enable = lib.mkEnableOption "sing-box proxy server";
+    users = lib.types.listOf lib.types.submodule {
+      name = lib.mkOption {
+        type = lib.types.str;
+        default = "proxy";
+      };
+      password = lib.mkOption {
+        type = secretFileType;
+      };
+      uuid = lib.mkOption {
+        type = secretFileType;
+      };
+    };
+    wgOut = {
+      privKeyFile = lib.mkOption {
+        type = lib.types.path;
+      };
+      pubkey = lib.mkOption {
+        type = lib.types.str;
+        default = "bmXOC+F1FxEMF9dyiK2H5/1SUtzH0JuVo51h2wPfgyo=";
+      };
+    };
+    inbounds = {
+      trojan = {
+        enable = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+        };
+      };
+      tuic = {
+        enable = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+        };
+        ports = lib.mkOption {
+          type = lib.types.listOf lib.types.int;
+          default = lib.range 6311 6313;
+        };
+        directPorts = lib.mkOption {
+          type = lib.types.listOf lib.types.int;
+          default = [ 6314 ];
+        };
+      };
+    };
+  };
+  config = lib.mkIf cfg.enable {
+    services.sing-box = {
+      enable = true;
+      settings = {
+        dns = {
+          servers = [
+            {
+              address = "1.1.1.1";
+              detour = "wg-out";
+            }
+          ];
+        };
+        inbounds = [
+          # TODO: Trojan and tuic enable
+          {
+            tag = "trojan-in";
+            type = "trojan";
+            listen = "::";
+            listen_port = 8080;
+            users = map (u: removeAttrs u [ "uuid" ]) cfg.users;
+            tls = singTls;
+          }
+        ] ++ lib.forEach (cfg.tuic.ports ++ cfg.tuic.directPorts) (port: {
+            tag = "tuic-in" + toString port;
+            type = "tuic";
+            listen = "::";
+            listen_port = port;
+            congestion_control = "bbr";
+            users = cfg.users;
+            tls = singTls;
+          });
+        outbounds = [
+          {
+            type = "wireguard";
+            tag = "wg-out";
+            private_key = cfg.wgOut.privKeyFile;
+            local_address = [
+              "172.16.0.2/32"
+              "2606:4700:110:82ed:a443:3c62:6cbc:b59b/128"
+            ];
+            peers = [
+              { public_key= cfg.wgOut.pubkey;
+                allowed_ips = [ "0.0.0.0/0" "::/0" ];
+                server = "162.159.192.1";
+                server_port = 500;
+              }
+            ];
+          }
+          { type = "direct"; tag = "direct-out"; }
+          { type = "dns"; tag = "dns-out"; }
+        ];
+        route = {
+          rules = [
+            { outbound = "dns-out"; protocol = "dns"; }
+          ] ++ lib.forEach cfg.tuic.directPorts (port: {
+            inbound = "tuic-in" + toString port;
+            outbound = "direct-out";
+          });
+        };
+      };
+    };
+  };
+}

modules/nixos/oidc-agent.nix

@@ -0,0 +1,50 @@
+{ config, lib, pkgs, ... }:
+
+let
+  inherit (lib) mkIf mkEnableOption mkOption types;
+
+  cfg = config.programs.oidc-agent;
+  providerFormat = pkgs.formats.json {};
+in
+{
+  options.programs.oidc-agent = {
+    enable = mkEnableOption "OpenID Connect Agent";
+    package = mkOption {
+      type = types.package;
+      default = pkgs.oidc-agent;
+      description = ''
+        Which oidc-agent package to use
+      '';
+    };
+    providers = mkOption {
+      type = providerFormat.type;
+      default = {};
+      description = ''
+        Configuration of providers which contains a json array of json objects
+        each describing an issuer, see https://indigo-dc.gitbook.io/oidc-agent/configuration/issuers
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.user.services.oidc-agent = {
+      unitConfig = {
+        Description = "OpenID Connect Agent";
+        Documentation = "man:oidc-agent(1)";
+      };
+      serviceConfig = {
+        ExecStart = "${cfg.package}/bin/oidc-agent -d --log-stderr -a %t/oidc-agent";
+      };
+    };
+
+    # environment.etc."oidc-agent/config".source = "${pkgs.oidc-agent}/etc/oidc-agent/config";
+
+    # environment.etc."oidc-agent/issuer.config.d".source =
+    #   "${pkgs.oidc-agent}/etc/oidc-agent/issuer.config.d";
+
+    # environment.etc."oidc-agent/issuer.config".source =
+    #  providerFormat.generate "oidc-agent-issuer.config" cfg.providers;
+
+    environment.extraInit = ''export OIDC_SOCK="$XDG_RUNTIME_DIR/oidc-agent"'';
+  };
+}