char/topaz-flake

git clone https://git.t4t.associates/char/topaz-flake

Charlotte Sommove secrets to /var/lib/secrets39a1928

main
branchesmainall refs →
1.2 KiB48 linesraw
1{ pkgs, ... }:
2{
3  services.pocket-id = {
4    enable = true;
5    package = pkgs.pocket-id.overrideAttrs (old: {
6      patches = (old.patches or [ ]) ++ [
7        ./patches/pocket-id-oidc-email-domain-rewrites.patch
8      ];
9    });
10    environmentFile = "/var/lib/secrets/pocket-id.env";
11    settings = {
12      APP_URL = "https://id.t4t.associates";
13      PORT = 1411;
14      TRUST_PROXY = true;
15    };
16  };
17
18  services.nginx.virtualHosts = {
19    "id.t4t.associates" = {
20      forceSSL = true;
21      enableACME = true;
22
23      locations."/" = {
24        proxyPass = "http://127.0.0.1:1411";
25        proxyWebsockets = true;
26        extraConfig = ''
27          proxy_set_header Host $host;
28          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
29          proxy_set_header X-Forwarded-Proto $scheme;
30        '';
31      };
32    };
33
34    "ts.t4t.associates" = {
35      forceSSL = true;
36      enableACME = true;
37
38      locations."= /.well-known/webfinger".extraConfig = ''
39        default_type application/json;
40        return 200 '{"subject":"$arg_resource","links":[{"rel":"http://openid.net/specs/connect/1.0/issuer","href":"https://id.t4t.associates"}]}';
41      '';
42
43      locations."/".extraConfig = ''
44        return 404;
45      '';
46    };
47  };
48}