Blunkall-Technologies/Olympus
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

back to compose

Browse Source
This commit is contained in:
Nathan
2024-11-21 20:32:36 -06:00
parent e127cd0c0a
commit 7f72059966
6 changed files with 217 additions and 218 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
system-config/services/containers/authentik-nix/default.nix
View File

@@ -5,20 +5,23 @@
default = false;
};
config = lib.mkIf config.sysconfig.opts.virtualization.authentik.enable (lib.mkMerge [
(import ./docker-compose.nix)
{
sops.templates."authentik.env" = {
content = ''
POSTGRES_DB=authentik-db
POSTGRES_USER=authentik-admin
POSTGRES_PASSWORD=${config.sops.placeholder."authentik/pass"}
AUTHENTIK_SECRET_KEY=${config.sops.placeholder."authentik/secret_key"}
'';
imports = [
./docker-compose.nix
];
path = "/ssd1/Authentik/.env";
};
}
]);
config = lib.mkIf config.sysconfig.opts.virtualization.authentik.enable {
sops.templates."authentik.env" = {
content = ''
POSTGRES_DB=authentik-db
POSTGRES_USER=authentik-admin
POSTGRES_PASSWORD=${config.sops.placeholder."authentik/pass"}
AUTHENTIK_SECRET_KEY=${config.sops.placeholder."authentik/secret_key"}
AUTHENTIK_POSTGRESQL__NAME=authentik-db
AUTHENTIK_POSTGRESQL__USER=authentik-admin
AUTHENTIK_POSTGRESQL__PASSWORD=${config.sops.placeholder."authentik/pass"}
'';
path = "/ssd1/Authentik/.env";
};
};
}

128
system-config/services/containers/authentik-nix/docker-compose.nix
View File

@@ -3,28 +3,17 @@
{
# Runtime
virtualisation.podman = {
virtualisation.docker = {
enable = true;
autoPrune.enable = true;
dockerCompat = true;
defaultNetwork.settings = {
# Required for container networking to be able to use names.
dns_enabled = true;
};
};
# Enable container name DNS for non-default Podman networks.
# https://github.com/NixOS/nixpkgs/issues/226365
networking.firewall.interfaces."podman+".allowedUDPPorts = [ 53 ];
virtualisation.oci-containers.backend = "podman";
virtualisation.oci-containers.backend = "docker";
# Containers
virtualisation.oci-containers.containers."authentik-postgresql" = {
image = "docker.io/library/postgres:16-alpine";
environmentFiles = [
"/ssd1/Authentik/.env"
];
environmentFiles = [ "/ssd1/Authentik/.env" ];
volumes = [
"authentik_database:/var/lib/postgresql/data:rw"
];
@@ -39,23 +28,26 @@
"--network=authentik_backend"
];
};
systemd.services."podman-authentik-postgresql" = {
systemd.services."docker-authentik-postgresql" = {
serviceConfig = {
Restart = lib.mkOverride 90 "always";
RestartMaxDelaySec = lib.mkOverride 90 "1m";
RestartSec = lib.mkOverride 90 "100ms";
RestartSteps = lib.mkOverride 90 9;
};
after = [
"podman-network-authentik_backend.service"
"podman-volume-authentik_database.service"
"docker-network-authentik_backend.service"
"docker-volume-authentik_database.service"
];
requires = [
"podman-network-authentik_backend.service"
"podman-volume-authentik_database.service"
"docker-network-authentik_backend.service"
"docker-volume-authentik_database.service"
];
partOf = [
"podman-compose-authentik-root.target"
"docker-compose-authentik-root.target"
];
wantedBy = [
"podman-compose-authentik-root.target"
"docker-compose-authentik-root.target"
];
};
virtualisation.oci-containers.containers."authentik-redis" = {
@@ -75,36 +67,35 @@
"--network=authentik_backend"
];
};
systemd.services."podman-authentik-redis" = {
systemd.services."docker-authentik-redis" = {
serviceConfig = {
Restart = lib.mkOverride 90 "always";
RestartMaxDelaySec = lib.mkOverride 90 "1m";
RestartSec = lib.mkOverride 90 "100ms";
RestartSteps = lib.mkOverride 90 9;
};
after = [
"podman-network-authentik_backend.service"
"podman-volume-authentik_redis.service"
"docker-network-authentik_backend.service"
"docker-volume-authentik_redis.service"
];
requires = [
"podman-network-authentik_backend.service"
"podman-volume-authentik_redis.service"
"docker-network-authentik_backend.service"
"docker-volume-authentik_redis.service"
];
partOf = [
"podman-compose-authentik-root.target"
"docker-compose-authentik-root.target"
];
wantedBy = [
"podman-compose-authentik-root.target"
"docker-compose-authentik-root.target"
];
};
virtualisation.oci-containers.containers."authentik-server" = {
image = "ghcr.io/goauthentik/server:2024.10.2";
image = "ghcr.io/goauthentik/server:2024.10.4";
environment = {
"AUTHENTIK_ERROR_REPORTING__ENABLED" = "true";
"AUTHENTIK_POSTGRESQL__HOST" = "postgresql";
"AUTHENTIK_POSTGRESQL__NAME" = "";
"AUTHENTIK_POSTGRESQL__PASSWORD" = "";
"AUTHENTIK_POSTGRESQL__USER" = "";
"AUTHENTIK_REDIS__HOST" = "redis";
"AUTHENTIK_SECRET_KEY" = "";
};
environmentFiles = [ "/ssd1/Authentik/.env" ];
volumes = [
"/ssd1/Authentik/custom-templates:/templates:rw"
"/ssd1/Authentik/media:/media:rw"
@@ -124,34 +115,34 @@
"--network=authentik_backend"
];
};
systemd.services."podman-authentik-server" = {
systemd.services."docker-authentik-server" = {
serviceConfig = {
Restart = lib.mkOverride 90 "always";
RestartMaxDelaySec = lib.mkOverride 90 "1m";
RestartSec = lib.mkOverride 90 "100ms";
RestartSteps = lib.mkOverride 90 9;
};
after = [
"podman-network-authentik_backend.service"
"docker-network-authentik_backend.service"
];
requires = [
"podman-network-authentik_backend.service"
"docker-network-authentik_backend.service"
];
partOf = [
"podman-compose-authentik-root.target"
"docker-compose-authentik-root.target"
];
wantedBy = [
"podman-compose-authentik-root.target"
"docker-compose-authentik-root.target"
];
};
virtualisation.oci-containers.containers."authentik-worker" = {
image = "ghcr.io/goauthentik/server:2024.10.2";
image = "ghcr.io/goauthentik/server:2024.10.4";
environment = {
"AUTHENTIK_ERROR_REPORTING__ENABLED" = "true";
"AUTHENTIK_POSTGRESQL__HOST" = "postgresql";
"AUTHENTIK_POSTGRESQL__NAME" = "";
"AUTHENTIK_POSTGRESQL__PASSWORD" = "";
"AUTHENTIK_POSTGRESQL__USER" = "";
"AUTHENTIK_REDIS__HOST" = "redis";
"AUTHENTIK_SECRET_KEY" = "";
};
environmentFiles = [ "/ssd1/Authentik/.env" ];
volumes = [
"/ssd1/Authentik/certs:/certs:rw"
"/ssd1/Authentik/custom-templates:/templates:rw"
@@ -170,69 +161,72 @@
"--network=authentik_backend"
];
};
systemd.services."podman-authentik-worker" = {
systemd.services."docker-authentik-worker" = {
serviceConfig = {
Restart = lib.mkOverride 90 "always";
RestartMaxDelaySec = lib.mkOverride 90 "1m";
RestartSec = lib.mkOverride 90 "100ms";
RestartSteps = lib.mkOverride 90 9;
};
after = [
"podman-network-authentik_backend.service"
"docker-network-authentik_backend.service"
];
requires = [
"podman-network-authentik_backend.service"
"docker-network-authentik_backend.service"
];
partOf = [
"podman-compose-authentik-root.target"
"docker-compose-authentik-root.target"
];
wantedBy = [
"podman-compose-authentik-root.target"
"docker-compose-authentik-root.target"
];
};
# Networks
systemd.services."podman-network-authentik_backend" = {
path = [ pkgs.podman ];
systemd.services."docker-network-authentik_backend" = {
path = [ pkgs.docker ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
ExecStop = "podman network rm -f authentik_backend";
ExecStop = "docker network rm -f authentik_backend";
};
script = ''
podman network inspect authentik_backend || podman network create authentik_backend
docker network inspect authentik_backend || docker network create authentik_backend
'';
partOf = [ "podman-compose-authentik-root.target" ];
wantedBy = [ "podman-compose-authentik-root.target" ];
partOf = [ "docker-compose-authentik-root.target" ];
wantedBy = [ "docker-compose-authentik-root.target" ];
};
# Volumes
systemd.services."podman-volume-authentik_database" = {
path = [ pkgs.podman ];
systemd.services."docker-volume-authentik_database" = {
path = [ pkgs.docker ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
};
script = ''
podman volume inspect authentik_database || podman volume create authentik_database --driver=local
docker volume inspect authentik_database || docker volume create authentik_database --driver=local
'';
partOf = [ "podman-compose-authentik-root.target" ];
wantedBy = [ "podman-compose-authentik-root.target" ];
partOf = [ "docker-compose-authentik-root.target" ];
wantedBy = [ "docker-compose-authentik-root.target" ];
};
systemd.services."podman-volume-authentik_redis" = {
path = [ pkgs.podman ];
systemd.services."docker-volume-authentik_redis" = {
path = [ pkgs.docker ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
};
script = ''
podman volume inspect authentik_redis || podman volume create authentik_redis --driver=local
docker volume inspect authentik_redis || docker volume create authentik_redis --driver=local
'';
partOf = [ "podman-compose-authentik-root.target" ];
wantedBy = [ "podman-compose-authentik-root.target" ];
partOf = [ "docker-compose-authentik-root.target" ];
wantedBy = [ "docker-compose-authentik-root.target" ];
};
# Root service
# When started, this will automatically create all resources and start
# the containers. When stopped, this will teardown all resources.
systemd.targets."podman-compose-authentik-root" = {
systemd.targets."docker-compose-authentik-root" = {
unitConfig = {
Description = "Root target generated by compose2nix.";
};