nixos/hosts/web.social-grow.tech/modules/authelia/default.nix

{ config, lib, ... }:
let
  domain = config.networking.domain;
  components = lib.strings.splitString "." domain;
  dcComponents = map (x: "dc=" + x) components;
  ldapPath = builtins.concatStringsSep "," dcComponents;
in {
  sops.secrets.authelia-jwt-secret = {
    owner = "authelia-main";
  };
  sops.secrets.authelia-backend-ldap-password = {
    owner = "authelia-main";
  };
  sops.secrets.authelia-storage-encryption-key = {
    owner = "authelia-main";
  };
  sops.secrets.authelia-session-secret = {
    owner = "authelia-main";
  };
  sops.secrets.authelia-identity-providers-oidc-hmac-secret = {
    owner = "authelia-main";
  };
  sops.secrets.authelia-identity-providers-oidc-issuer-certificate-chain = {
    owner = "authelia-main";
  };
  sops.secrets.authelia-identity-providers-oidc-issuer-private-key = {
    owner = "authelia-main";
  };

  services.authelia.instances.main = {
    enable = true;
    secrets = {
      jwtSecretFile = config.sops.secrets.authelia-jwt-secret.path;
      storageEncryptionKeyFile = config.sops.secrets.authelia-storage-encryption-key.path;
      sessionSecretFile = config.sops.secrets.authelia-session-secret.path;
      oidcHmacSecretFile = config.sops.secrets.authelia-identity-providers-oidc-hmac-secret.path;
      oidcIssuerPrivateKeyFile = config.sops.secrets.authelia-identity-providers-oidc-issuer-private-key.path;
    };
    environmentVariables = {
      "AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PASSWORD_FILE" = config.sops.secrets.authelia-backend-ldap-password.path;
      "AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE" = config.sops.secrets.authelia-backend-ldap-password.path;
    };
    settings = {
      theme = "dark";
      default_redirection_url = "https://${domain}";
  
      server = {
        host = "127.0.0.1";
        port = 9091;
      };
  
      # log = {
      #   level = "debug";
      #   format = "text";
      # };
  
      authentication_backend = {
        ldap = {
          url = "ldaps://ldap.${domain}";
          base_dn = ldapPath;
          additional_users_dn = "OU=users";
          users_filter = "(&({username_attribute}={input})(objectClass=person))";
          username_attribute = "mail";
          mail_attribute = "mail";
          display_name_attribute = "cn";
          additional_groups_dn = "OU=groups";
          groups_filter = "(&(member={dn})(objectClass=groupOfNames))";
          group_name_attribute = "cn";
          permit_referrals = false;
          permit_unauthenticated_bind = false;
          user = "cn=authelia,ou=system,ou=users,${ldapPath}";
        };
      };

      webauthn = {
        disable = false;
        display_name = "Authelia";
        attestation_conveyance_preference = "indirect";
        user_verification = "preferred";
        timeout = "60s";
      };

      totp = {
        disable = false;
        issuer = "auth.${domain}";
        algorithm = "sha1";
        digits = 6;
        period = 30;
        skew = 1;
        secret_size = 32;
      };
  
      access_control = {
        default_policy = "deny";
        rules = [
          {
            domain = ["auth.${domain}"];
            policy = "bypass";
          }
          {
            domain = ["*.${domain}"];
            policy = "two_factor";
          }
        ];
      };
  
      session = {
        name = "authelia_session";
        expiration = "12h";
        inactivity = "45m";
        remember_me_duration = "1M";
        domain = domain;
        # todo: enable with 4.38
        # cookies = [
        #   {
        #     domain = "${domain}";
        #   }
        # ];
      };
  
      regulation = {
        max_retries = 3;
        find_time = "5m";
        ban_time = "15m";
      };
  
      storage = {
        # mysql = {
        #   host = "/run/mysqld/mysqld.sock'";
        #   port = 3306;
        #   database = "authelia_main";
        #   username = "authelia_main";
        #   password = "socket_auth";
        #   timeout = "5s";
        # };
        local = {
          path = "/var/lib/authelia-main/db.sqlite3";
        };
      };
  
      notifier = {
        disable_startup_check = false;
        smtp = {
          host = "mail.${domain}";
          port = 25;
          username = "authelia@${domain}";
          sender = "Authelia <authelia@${domain}>";
        };
      };
      identity_providers = {
        oidc = {
          ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
          ## See: https://www.authelia.com/c/oidc
          # authorization_policies = {
          #   support = {
          #     default_policy = "deny";
          #     rules = [
          #       {
          #         policy = "two_factor";
          #         subject = "group:support"; # Deny access to users of services group
          #       }
          #       {
          #         policy = "two_factor";
          #         subject = "group:admin"; # Deny access to users of services group
          #       }
          #     ];
          #   };
          # };
          clients = [
            {
              id = "nextcloud";
              description = "Nextcloud";
              secret = "$pbkdf2-sha512$310000$P/kCFCL7FPwrZORA7KLIcg$HfC4qdmCJclSICHBjCltyT2Q1B4hiq.h75U1V1pfM4UbUu9kqll100I4/tdxjCBcPDePPXq8OFTQedNLsp.feA";
              public = false;
              authorization_policy = "one_factor";
              redirect_uris = [ 
                "https://cloud.${domain}/apps/oidc_login/oidc"
              ];
              pre_configured_consent_duration = "1y";
              scopes = [
                "openid"
                "profile"
                "email"
                "groups"
              ];
              userinfo_signing_algorithm = "none";
            }
          ];
        };
      };
    };
  };
  services.nginx.virtualHosts."auth.${domain}" = {
    enableACME = true;
    forceSSL = true;
    acmeRoot = null;

    locations."/api/verify" = {
      proxyPass = "http://127.0.0.1:9091";
      proxyWebsockets = true;

      extraConfig = ''
        allow 127.0.0.1;
        allow 49.12.244.139;
        allow 77.119.230.30;
        deny all;
      '';
    };

    locations."/" = {
      proxyPass = "http://127.0.0.1:9091";
      proxyWebsockets = true;

      extraConfig = ''
        client_body_buffer_size 128k;

        #Timeout if the real server is dead
        proxy_next_upstream error timeout invalid_header http_500 http_502     http_503;

        # Advanced Proxy Config
        send_timeout 5m;
        proxy_read_timeout 360;
        proxy_send_timeout 360;
        proxy_connect_timeout 360;

        # Basic Proxy Config
        proxy_set_header Host $host;
        proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $http_host;
        proxy_set_header X-Forwarded-Uri $request_uri;
        proxy_set_header X-Forwarded-Ssl on;
        proxy_redirect  http://  $scheme://;
        proxy_set_header Connection "";
        proxy_cache_bypass $cookie_session;
        proxy_no_cache $cookie_session;
        proxy_buffers 64 256k;

        # If behind reverse proxy, forwards the correct IP
        set_real_ip_from 10.0.0.0/8;
        set_real_ip_from 172.0.0.0/8;
        set_real_ip_from 192.168.0.0/16;
        set_real_ip_from fc00::/7;
        real_ip_header X-Forwarded-For;
        real_ip_recursive on;
      '';
    };
  };
}