authelia_ldap.nix

{ config, lib, pkgs, ... }:
let
  domain = config.private.domain;
  vpn-address = config.private.hosts.${config.networking.hostName}.vpn-address;
  ldap_base_dn = builtins.concatStringsSep ","
    (builtins.map (s: "dc=" + s) (lib.splitString "." domain));
in {
  age.secrets = {
    lldap-admin-password = {
      file = ../secrets/lldap-admin-password;
      owner = "authelia-${domain}";
    };
    lldap-jwt-secret.file = ../secrets/lldap-jwt-secret;
    #lldap-key.file = ../secrets/lldap-key;
    auth-smtp-password.file = ../secrets/auth-smtp-password;
    authelia-storage-key.file = ../secrets/authelia-storage-key;
    authelia-oidc-issuer-key.file = ../secrets/authelia-oidc-issuer-key;
    authelia-oidc-hmac.file = ../secrets/authelia-oidc-hmac;
    authelia-jwt-secret.file = ../secrets/authelia-jwt-secret;

  };
  systemd.services.lldap.serviceConfig.LoadCredential =
    with config.age.secrets; [
      "lldap-admin-password:${lldap-admin-password.path}"
      "lldap-jwt-secret:${lldap-jwt-secret.path}"
      #LLDAP_KEY_FILE = builtins.toString lldap-key.path;
    ];
  services = {
    lldap.enable = true;
    lldap.environment = {
      LLDAP_JWT_SECRET_FILE = "%d/lldap-jwt-secret";
      LLDAP_LDAP_USER_PASS_FILE = "%d/lldap-admin-password";
    };
    lldap.settings = {
      ldap_user_email = "auth@${domain}";
      ldap_host = vpn-address;
      ldap_port = 3890;
      http_host = vpn-address;
      http_port = 17170;
      http_url = "https://${vpn-address}:17170/";

      inherit ldap_base_dn;
      smtp_options = {
        server = "127.0.0.1";
        port = 587;
        user = "auth@${domain}";
        from = "User Management <auth@${domain}>";
        password = config.age.secrets.auth-smtp-password.path;
      };
    };

    authelia.instances.${domain} = {
      enable = true;
      secrets = with config.age.secrets; {
        storageEncryptionKeyFile = authelia-storage-key.path;
        oidcIssuerPrivateKeyFile = authelia-oidc-issuer-key.path;
        oidcHmacSecretFile = authelia-oidc-hmac.path;
        jwtSecretFile = authelia-jwt-secret.path;
      };
      settings = {
        storage.local.path = "/var/lib/authelia/storage.db";
        notifier.smtp = {
          host = "127.0.0.1";
          port = 587;
          sender = "User Management <auth@${domain}>";
        };
        default_2fa_method = "totp";
        default_redirection_url = "https://${domain}/";
        authentication_backend.ldap = {
          implementation = "custom";
          url = "ldap://localhost:3890";
          start_tls = false;
          base_dn = ldap_base_dn;
          username_attribute = "uid";
          additional_users_dn = "ou=people";
          users_filter =
            "(&({username_attribute}={input})(objectClass=person))";
          additional_groups_dn = "ou=groups";
          groups_filter = "(member={dn})";
          group_name_attribute = "cn";
          mail_attribute = "mail";
          display_name_attribute = "displayName";
          user = "uid=admin,ou=people," + ldap_base_dn;
          password = config.age.secrets.lldap-admin-password.path;
        };
        session.domain = domain;
        access_control = {
          default_policy = "deny";
          rules = [{
            domain = "*.${domain}";
            policy = "one_factor";
          }];
        };
        telemetry.metrics = {
          enabled = true;
          address = "tcp://${vpn-address}:9959";
        };
      };
    };
  };
}