gay

modules/base-stuff.nix

@@ -25,7 +25,7 @@
   };
 
   environment.systemPackages = with pkgs; [
-    neovim wget neofetch
+    vim wget neofetch btop
   ];
 
   fileSystems."/" = { 

modules/containers/default.nix

@@ -1,6 +1,6 @@
 { pkgs, ... }:
 {
   imports = [
-    #./phtanumb-wiki.nix
+    ./phtanumb-wiki.nix
   ];
 }

modules/containers/phtanumb-wiki.nix

@@ -2,22 +2,33 @@
 {
   containers."phtanumb-wiki" = {
     autoStart = true;
-    localAddress = "127.0.0.1";
+    hostAddress = "127.0.0.1";
     bindMounts = {
       "/var/mediawiki" = {
         hostPath = "/phtanum-b/wiki";
         isReadOnly = false;
       };
     };
+    forwardPorts = [
+      {
+        protocol = "tcp";
+        hostPort = 5432;
+        containerPort = 5432;
+      }
+      {
+        protocol = "tcp";
+        hostPort = 8081;
+        containerPort = 8081;
+      }
+    ];
     config = { config, pkgs, ... }: {
-
       services.mediawiki = {
         enable = true;
         name = "phtanum-b";
         virtualHost.listen = [
           {
-            ip = "127.0.0.1";
-            port = 8080;
+            ip = "127.0.0.2";
+            port = 8081;
             ssl = false;
           }
         ];
@@ -27,14 +38,39 @@
         extraConfig = ''
           # Disable anonymous editing
           $wgGroupPermissions['*']['edit'] = false;
+          $wgDebugLogFile = "/var/log/mediawiki/debug-{$wgDBname}.log";
+          $wgPluggableAuth_Config["katzen.cafe authentication"] = [
+            'plugin' => 'OpenIDConnect',
+            'data' => [
+              'providerURL' => 'https://auth.katzen.cafe/realms/master/',
+              'clientID' => 'phtanumb-wiki',
+              'clientsecret' => '/var/mediawiki/keycloakClientSecret',
+            ]
+          ];
         '';
+        extensions = {
+          PluggableAuth = pkgs.fetchzip {
+            url = "https://extdist.wmflabs.org/dist/extensions/PluggableAuth-REL1_38-5331512.tar.gz";
+            sha256 = "sha256-OWfr3oq2XzyJ5tynP5bRRPm34ymqz2oIBe2vBPHK+/Q=";
+          };
+          OpenIDConnect = pkgs.fetchzip {
+            url = "https://extdist.wmflabs.org/dist/extensions/OpenIDConnect-REL1_38-8f8bab6.tar.gz";
+            sha256 = "sha256-g+PGNzt0o2FebI3xyVamz5RA95E86MD2yqD4v8N6zKU=";
+          };
+        };
       };
 
       system.stateVersion = "22.11";
     };
   };
-  deployment.keys."passwordFile" = {
+  deployment.keys = {
+    "passwordFile" = {
       keyCommand = [ "cat" "/home/jade/keys/phtanumb-wiki/passwordFile" ];
-    destDir = "/var/mediawiki";
+      destDir = "/phtanum-b/wiki";
+    };
+    "keycloakClientSecret" = {
+      keyCommand = [ "cat" "/home/jade/keys-tmp/phtanumb-wiki-keycloak-secret" ];
+      destDir = "/phtanum-b/wiki";
+    };
   };
 }

modules/keycloak.nix

@@ -4,12 +4,20 @@
     enable = true;
 
     settings = {
-      http-port = 8097;
+      http-port = 8080;
+      http-enabled = true;
+
       proxy = "edge";
+
       hostname = "auth.katzen.cafe";
+      hostname-port = "-1";
+      hostname-admin-url = "https://auth.katzen.cafe";
       hostname-strict-backchannel = true;
     };
 
+    #sslCertificateKey = "/var/lib/acme/auth.katzen.cafe/key.pem";
+    #sslCertificate = "/var/lib/acme/auth.katzen.cafe/cert.pem";
+
     database = {
       type = "postgresql";
       createLocally = true;

modules/proxy.nix

@@ -11,10 +11,10 @@
         #group = "nginx";
         #keyType = "rsa4096";
       #};
-      #"wiki.phtanum-b.katzen.cafe" = {
-        #group = "nginx";
-        #keyType = "rsa4096";
-      #};
+      "wiki.phtanum-b.katzen.cafe" = {
+        group = "nginx";
+        keyType = "rsa4096";
+      };
       "auth.katzen.cafe" = {
         group = "nginx";
         keyType = "rsa4096";
@@ -24,19 +24,24 @@
   services.nginx = {
     enable = true;
     virtualHosts = {
-      #"wiki.phtanum-b.katzen.cafe" = {
-        #forceSSL = true;
-        #enableACME = true;
-        #locations."/" = {
-          #proxyPass = "http://127.0.0.1:8080";
-        #};
-      #};
+      "wiki.phtanum-b.katzen.cafe" = {
+        forceSSL = true;
+        enableACME = true;
+        locations."/" = {
+          proxyPass = "http://127.0.0.2:8081";
+        };
+      };
       "auth.katzen.cafe" = {
         forceSSL = true;
         enableACME = true;
         locations."/" = {
-          proxyPass = "http://127.0.0.1:8097";
+          proxyPass = "http://127.0.0.1:8080";
         };
+        extraConfig = ''
+            proxy_set_header X-Forwarded-For $proxy_protocol_addr;
+            proxy_set_header X-Forwarded-Proto $scheme; 
+            proxy_set_header Host $host;
+          '';
       };
     };