rope/nixos
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

authelia: household group; guildhall invite links

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
rope 2026-10-18 14:11:16 +01:00
parent 791a3bdf34
commit 782a1c96a6
6 changed files with 502 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

77
services/guildhall-join.nix Normal file
View file

@ -0,0 +1,77 @@
# services/guildhall-join.nix — invite links that create Guildhall accounts.
#
# guildhall-invite [note] print a one-time link, valid for a week
# guildhall-invite list open, used and expired invites
# guildhall-invite revoke ID cancel one
#
# The link opens guildhall.nordhammer.it/join/<token>, the one path nginx
# serves without Authelia. The page appends the new user, in the `guildhall`
# group only, to Authelia's users file (see services/authelia.nix), which
# Authelia reloads on change. The service shares a dedicated authelia-users
# group with Authelia rather than authelia-main, which would also open
# Authelia's secrets.
{ config, lib, pkgs, ... }:
let
port = 8099;
stateDir = "/var/lib/guildhall-join";
pythonEnv = pkgs.python3.withPackages (ps: [ ps.pyyaml ps.argon2-cffi ]);
script = ../scripts/guildhall-join.py;
environment = {
GUILDHALL_JOIN_STATE = stateDir;
GUILDHALL_JOIN_USERS = "/var/lib/authelia-users/users_database.yml";
GUILDHALL_JOIN_SITE = "https://guildhall.nordhammer.it";
GUILDHALL_JOIN_PORT = toString port;
};
invite = pkgs.writeShellScriptBin "guildhall-invite" ''
case "''${1:-}" in
list|revoke) ;;
*) set -- invite "$@" ;;
esac
exec /run/wrappers/bin/sudo -u guildhall-join ${pkgs.coreutils}/bin/env \
${lib.concatStringsSep " " (lib.mapAttrsToList (k: v: "${k}=${lib.escapeShellArg v}") environment)} \
${pythonEnv}/bin/python3 ${script} "$@"
'';
in
{
config = lib.mkIf (config.networking.hostName == "FredOS-Mediaserver") {
users.groups.authelia-users = { };
users.groups.guildhall-join = { };
users.users.guildhall-join = {
isSystemUser = true;
group = "guildhall-join";
extraGroups = [ "authelia-users" ];
description = "Guildhall invite page";
};
users.users.authelia-main.extraGroups = [ "authelia-users" ];
systemd.tmpfiles.rules = [ "d ${stateDir} 0700 guildhall-join guildhall-join -" ];
systemd.services.guildhall-join = {
description = "Guildhall invite page";
wantedBy = [ "multi-user.target" ];
after = [ "network.target" "authelia-main.service" ];
inherit environment;
serviceConfig = {
ExecStart = "${pythonEnv}/bin/python3 ${script} serve";
User = "guildhall-join";
Group = "guildhall-join";
Restart = "on-failure";
RestartSec = 3;
UMask = "0077";
NoNewPrivileges = true;
PrivateTmp = true;
PrivateDevices = true;
ProtectSystem = "strict";
ProtectHome = true;
ProtectKernelTunables = true;
ProtectKernelModules = true;
ProtectControlGroups = true;
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
ReadWritePaths = [ stateDir "/var/lib/authelia-users" ];
};
};
environment.systemPackages = [ invite ];
};
}