blob: 8e2025d51ebe9b38b9b240becd27e2818a0fa36d (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
|
{
config,
pkgs,
lib,
...
}:
{
sops.secrets = {
keycloak_bootstrap_password = {};
};
services.nginx = {
virtualHosts."keycloak.kjtsanaktsidis.id.au" = {
forceSSL = true;
enableACME = true;
locations = {
"/" = {
proxyPass = "http://127.0.0.1:${builtins.toString config.services.keycloak.settings.http-port}";
};
};
};
};
services.keycloak = {
enable = true;
database = {
type = "postgresql";
createLocally = false;
passwordFile = "/dev/null";
};
settings = lib.mkOverride 10 {
db = "postgres";
db-url = "jdbc:postgresql://localhost/keycloak?socketFactory=org.newsclub.net.unix.AFUNIXSocketFactory$FactoryArg&socketFactoryArg=/var/run/postgresql/.s.PGSQL.5432";
db-username = "keycloak";
http-host = "127.0.0.1";
http-port = 3256;
hostname = "https://keycloak.kjtsanaktsidis.id.au";
http-enabled = true;
proxy-headers = "xforwarded";
vault = "file";
vault-dir = "\${CREDENTIALS_DIRECTORY}";
bootstrap-admin-username = "admin";
bootstrap-admin-password = { _secret = config.sops.secrets.keycloak_bootstrap_password.path; };
};
plugins = [
"${pkgs.junixsocket-common}/share/java/junixsocket-common-${pkgs.junixsocket-common.version}.jar"
"${pkgs.junixsocket-native-common}/share/java/junixsocket-native-common-${pkgs.junixsocket-native-common.version}.jar"
];
};
services.postgresql = {
enable = true;
ensureUsers = [{
name = "keycloak";
ensureDBOwnership = true;
}];
ensureDatabases = [ "keycloak" ];
authentication = lib.mkAfter ''
#type database DBuser auth-method
local keycloak keycloak peer
'';
};
}
|
