rope/nixos
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

authelia: household group; guildhall invite links

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
rope 2026-10-18 14:11:16 +01:00
parent 791a3bdf34
commit 782a1c96a6
6 changed files with 502 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

40
services/authelia.nix
View file

@ -1,8 +1,28 @@
# services/authelia.nix — Native Authelia SSO
# Secrets live in /var/secrets/authelia (root:authelia-main, 640) — see readme.
#
# Users live in /var/lib/authelia-users so guildhall-join (services/
# guildhall-join.nix) can add invited players; Authelia only reads it and
# reloads on change. Groups decide reach: `household` gets the shared home
# sites, `guildhall` gets the game and nothing else.
{ config, lib, pkgs, ... }:
let
admin = [ "user:fred" ];
household = [ "group:household" ];
usersDir = "/var/lib/authelia-users";
usersFile = "${usersDir}/users_database.yml";
# One-time move out of Authelia's private state dir, then the same
# ownership on every start: guildhall-join writes, authelia-users reads.
prepareUsers = pkgs.writeShellScript "authelia-users-prepare" ''
set -eu
${pkgs.coreutils}/bin/install -d -m 0750 -o guildhall-join -g authelia-users ${usersDir}
if [ ! -e ${usersFile} ]; then
${pkgs.coreutils}/bin/cp /var/lib/authelia-main/users_database.yml ${usersFile}
fi
${pkgs.coreutils}/bin/chown guildhall-join:authelia-users ${usersFile}
${pkgs.coreutils}/bin/chmod 0640 ${usersFile}
'';
in
{
config = lib.mkIf (config.networking.hostName == "FredOS-Mediaserver") {
@ -25,15 +45,18 @@ in
format = "text";
};
authentication_backend.file.path = "/var/lib/authelia-main/users_database.yml";
authentication_backend.file = {
path = usersFile;
watch = true;
};
access_control = {
default_policy = "deny";
# Admin tools are fred-only (`admin`); any other account, i.e. kayla,
# only reaches the shared household sites.
# Admin tools are fred-only (`admin`), the shared home sites need
# the household group, and invited players only reach the game.
rules = [
{ domain = "frigate.nordhammer.it"; policy = "one_factor"; }
{ domain = "camera.nordhammer.it"; policy = "one_factor"; }
{ domain = "frigate.nordhammer.it"; policy = "one_factor"; subject = household; }
{ domain = "camera.nordhammer.it"; policy = "one_factor"; subject = household; }
# { domain = "7dtd.nordhammer.it"; policy = "one_factor"; } # 7DTD disabled
{ domain = "adguard.nordhammer.it"; policy = "one_factor"; subject = admin; }
{ domain = "router.nordhammer.it"; policy = "one_factor"; subject = admin; }
@ -46,9 +69,9 @@ in
{ domain = "shelfarr.nordhammer.it"; policy = "one_factor"; subject = admin; }
{ domain = "sabnzbd.nordhammer.it"; policy = "one_factor"; subject = admin; }
{ domain = "code.nordhammer.it"; policy = "one_factor"; subject = admin; }
{ domain = "reddit.nordhammer.it"; policy = "one_factor"; }
{ domain = "reddit.nordhammer.it"; policy = "one_factor"; subject = household; }
{ domain = "panel.nordhammer.it"; policy = "one_factor"; subject = admin; }
{ domain = "stardew.nordhammer.it"; policy = "one_factor"; }
{ domain = "stardew.nordhammer.it"; policy = "one_factor"; subject = household; }
{ domain = "guildhall.nordhammer.it"; policy = "one_factor"; }
# Health data: only the two people the app knows about.
{ domain = "flowtrack.nordhammer.it"; policy = "one_factor"; subject = [ "user:kayla" "user:fred" ]; }
@ -70,5 +93,8 @@ in
notifier.filesystem.filename = "/var/lib/authelia-main/notification.txt";
};
};
# First, before the module's validate-config pre-start.
systemd.services.authelia-main.serviceConfig.ExecStartPre = lib.mkBefore [ "+${prepareUsers}" ];
};
}