modules: clean up

modules/nixos/common-settings/auth.nix

@@ -9,8 +9,6 @@ let
   inherit (lib)
     mkIf
     mkEnableOption
-    mkOption
-    types
     ;
 
   cfg = config.commonSettings.auth;
@@ -21,25 +19,43 @@ in
   };
 
   config = mkIf cfg.enable {
-    custom.kanidm-client = {
-      enable = true;
-      uri = "https://auth.xinyang.life";
-      asSSHAuth = {
-        enable = true;
-        allowedGroups = [ "linux_users" ];
+    services.kanidm = {
+      enableClient = true;
+      clientSettings = {
+        uri = "https://auth.xinyang.life";
+      };
+      enablePam = true;
+      unixSettings = {
+        pam_allowed_login_groups = [ "linux_users" ];
+        default_shell = "/bin/sh";
       };
-      sudoers = [ "xin@auth.xinyang.life" ];
     };
 
     services.openssh = {
+      enable = true;
+      authorizedKeysCommand = "/etc/ssh/auth %u";
+      authorizedKeysCommandUser = "kanidm-ssh-runner";
       settings = {
         PasswordAuthentication = false;
         KbdInteractiveAuthentication = false;
-        PermitRootLogin = "no";
-        GSSAPIAuthentication = "no";
-        KerberosAuthentication = "no";
+        PermitRootLogin = lib.mkForce "no";
       };
     };
+
+    environment.etc."ssh/auth" = {
+      mode = "0555";
+      text = ''
+        #!${pkgs.stdenv.shell}
+        ${pkgs.kanidm}/bin/kanidm_ssh_authorizedkeys $1
+      '';
+    };
+    users.groups.wheel.members = [ "xin@auth.xinyang.life" ];
+    users.groups.kanidm-ssh-runner = { };
+    users.users.kanidm-ssh-runner = {
+      isSystemUser = true;
+      group = "kanidm-ssh-runner";
+    };
+
     services.fail2ban.enable = true;
 
     security.sudo = {

modules/nixos/default.nix

@@ -8,9 +8,5 @@
     ./disk-partitions
     ./restic.nix
     ./monitor
-    ./kanidm-client.nix
-    # ./ssh-tpm-agent.nix # FIXME: Waiting for upstream merge
-    ./forgejo-actions-runner.nix
-    ./immich.nix
   ];
 }

modules/nixos/immich.nix

@@ -1,60 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  utils,
-  ...
-}:
-let
-  cfg = config.custom.immich;
-  upstreamCfg = config.services.immich;
-  settingsFormat = pkgs.formats.json { };
-  user = config.systemd.services.immich-server.serviceConfig.User;
-  group = config.systemd.services.immich-server.serviceConfig.Group;
-in
-{
-  options = {
-    custom.immich.jsonSettings = lib.mkOption {
-      type = lib.types.submodule {
-        freeformType = settingsFormat.type;
-      };
-      default = { };
-    };
-  };
-  config = {
-    /*
-      LoadCredential happens before preStart. We need to ensure the
-      configuration file exist, otherwise LoadCredential will fail.
-    */
-    systemd.tmpfiles.settings = lib.mkIf upstreamCfg.enable {
-      "10-etc-immich" = {
-        "/etc/immich" = {
-          d = {
-            inherit user group;
-            mode = "0700";
-          };
-        };
-        "/etc/immich/config.json" = {
-          "f+" = {
-            inherit user group;
-            mode = "0600";
-          };
-        };
-      };
-    };
-
-    systemd.services.immich-server = {
-      preStart = ''
-        umask 0077
-        ${utils.genJqSecretsReplacementSnippet cfg.jsonSettings "/etc/immich/config.json"}
-      '';
-      serviceConfig = {
-        LoadCredential = "config:/etc/immich/config.json";
-        Environment = "IMMICH_CONFIG_FILE=%d/config";
-      };
-    };
-
-    # https://github.com/NixOS/nixpkgs/pull/324127/files#r1723763510
-    services.immich.redis.host = "/run/redis-immich/redis.sock";
-  };
-}