mirror of
https://forge.katzen.cafe/katzen-cafe/katzen-cafe.git
synced 2024-11-22 05:54:41 +01:00
get mediawiki working finally with auth and permissions
This commit is contained in:
parent
0e23e021c1
commit
530087cf05
82
flake.lock
82
flake.lock
|
@ -1,12 +1,85 @@
|
||||||
{
|
{
|
||||||
"nodes": {
|
"nodes": {
|
||||||
|
"arion": {
|
||||||
|
"inputs": {
|
||||||
|
"flake-parts": "flake-parts",
|
||||||
|
"haskell-flake": "haskell-flake",
|
||||||
|
"nixpkgs": "nixpkgs"
|
||||||
|
},
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1682181677,
|
||||||
|
"narHash": "sha256-El8WQ2ccxWwkSrjuwKNR0gD/O7vS/KLBY4Q2/nF8m1c=",
|
||||||
|
"owner": "hercules-ci",
|
||||||
|
"repo": "arion",
|
||||||
|
"rev": "6a1f03329c400327b3b2e0ed5e1efff11037ba67",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "hercules-ci",
|
||||||
|
"repo": "arion",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"flake-parts": {
|
||||||
|
"inputs": {
|
||||||
|
"nixpkgs-lib": [
|
||||||
|
"arion",
|
||||||
|
"nixpkgs"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1675933616,
|
||||||
|
"narHash": "sha256-/rczJkJHtx16IFxMmAWu5nNYcSXNg1YYXTHoGjLrLUA=",
|
||||||
|
"owner": "hercules-ci",
|
||||||
|
"repo": "flake-parts",
|
||||||
|
"rev": "47478a4a003e745402acf63be7f9a092d51b83d7",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "hercules-ci",
|
||||||
|
"repo": "flake-parts",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"haskell-flake": {
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1675296942,
|
||||||
|
"narHash": "sha256-u1X1sblozi5qYEcLp1hxcyo8FfDHnRUVX3dJ/tW19jY=",
|
||||||
|
"owner": "srid",
|
||||||
|
"repo": "haskell-flake",
|
||||||
|
"rev": "c2cafce9d57bfca41794dc3b99c593155006c71e",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "srid",
|
||||||
|
"ref": "0.1.0",
|
||||||
|
"repo": "haskell-flake",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
"nixpkgs": {
|
"nixpkgs": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1682303062,
|
"lastModified": 1676300157,
|
||||||
"narHash": "sha256-x+KAADp27lbxeoPXLUMxKcRsUUHDlg+qVjt5PjgBw9A=",
|
"narHash": "sha256-1HjRzfp6LOLfcj/HJHdVKWAkX9QRAouoh6AjzJiIerU=",
|
||||||
"owner": "NixOS",
|
"owner": "NixOS",
|
||||||
"repo": "nixpkgs",
|
"repo": "nixpkgs",
|
||||||
"rev": "f5364316e314436f6b9c8fd50592b18920ab18f9",
|
"rev": "545c7a31e5dedea4a6d372712a18e00ce097d462",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "NixOS",
|
||||||
|
"ref": "nixos-unstable",
|
||||||
|
"repo": "nixpkgs",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"nixpkgs_2": {
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1683028696,
|
||||||
|
"narHash": "sha256-saPKTDj+HB9aPvB59wGcJ64CifRuiIt2CHvSbh7UHz8=",
|
||||||
|
"owner": "NixOS",
|
||||||
|
"repo": "nixpkgs",
|
||||||
|
"rev": "5dab6490fe6d72b3f120ae8660181e20f396fbdf",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
@ -18,7 +91,8 @@
|
||||||
},
|
},
|
||||||
"root": {
|
"root": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"nixpkgs": "nixpkgs"
|
"arion": "arion",
|
||||||
|
"nixpkgs": "nixpkgs_2"
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
|
|
13
flake.nix
13
flake.nix
|
@ -1,13 +1,15 @@
|
||||||
{
|
{
|
||||||
inputs = {
|
inputs = {
|
||||||
nixpkgs.url = "github:NixOS/nixpkgs/nixos-22.11";
|
nixpkgs.url = "github:NixOS/nixpkgs/nixos-22.11";
|
||||||
|
#nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
|
||||||
|
arion.url = "github:hercules-ci/arion";
|
||||||
};
|
};
|
||||||
|
|
||||||
outputs = { self, nixpkgs, ... }@inputs:
|
outputs = { self, nixpkgs, ... }@inputs:
|
||||||
let
|
let
|
||||||
pkgs = import nixpkgs { system = "x86_64-linux"; };
|
hostPkgs = import nixpkgs { system = "x86_64-linux"; };
|
||||||
in {
|
in {
|
||||||
devShell."x86_64-linux" = with pkgs; mkShell {
|
devShell."x86_64-linux" = with hostPkgs; mkShell {
|
||||||
buildInputs = [ colmena ];
|
buildInputs = [ colmena ];
|
||||||
};
|
};
|
||||||
colmena = {
|
colmena = {
|
||||||
|
@ -16,9 +18,12 @@
|
||||||
system = "aarch64-linux";
|
system = "aarch64-linux";
|
||||||
overlays = [];
|
overlays = [];
|
||||||
};
|
};
|
||||||
|
specialArgs = {
|
||||||
|
inherit inputs;
|
||||||
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
katzencafe = { name, nodes, pkgs, ... }: {
|
katzencafe = { name, nodes, pkgs, inputs, ... }: {
|
||||||
deployment = {
|
deployment = {
|
||||||
targetHost = "katzen.cafe";
|
targetHost = "katzen.cafe";
|
||||||
buildOnTarget = true;
|
buildOnTarget = true;
|
||||||
|
@ -27,7 +32,7 @@
|
||||||
./modules/base-stuff.nix
|
./modules/base-stuff.nix
|
||||||
./modules/proxy.nix
|
./modules/proxy.nix
|
||||||
./modules/postgres.nix
|
./modules/postgres.nix
|
||||||
#./modules/jitsi.nix
|
./modules/jitsi.nix
|
||||||
./modules/containers
|
./modules/containers
|
||||||
./modules/keycloak.nix
|
./modules/keycloak.nix
|
||||||
];
|
];
|
||||||
|
|
|
@ -2,5 +2,6 @@
|
||||||
{
|
{
|
||||||
imports = [
|
imports = [
|
||||||
./phtanumb-wiki.nix
|
./phtanumb-wiki.nix
|
||||||
|
./penpot.nix
|
||||||
];
|
];
|
||||||
}
|
}
|
||||||
|
|
92
modules/containers/penpot.nix
Normal file
92
modules/containers/penpot.nix
Normal file
|
@ -0,0 +1,92 @@
|
||||||
|
{ pkgs, inputs, ... }:
|
||||||
|
{
|
||||||
|
imports = [ inputs.arion.nixosModules.arion ];
|
||||||
|
virtualisation.docker.enable = true;
|
||||||
|
virtualisation.arion = {
|
||||||
|
backend = "docker";
|
||||||
|
projects.penpot.settings = {
|
||||||
|
networks.penpot.name = "penpot";
|
||||||
|
services = {
|
||||||
|
"penpot-backend".service = {
|
||||||
|
image = "penpotapp/backend:latest";
|
||||||
|
volumes = [ "/penpot/assets:/opt/data/assets" ];
|
||||||
|
depends_on = [ "penpot-postgres" "penpot-redis" ];
|
||||||
|
networks = [ "penpot" ];
|
||||||
|
environment = {
|
||||||
|
"PENPOT_FLAGS" = "enable-registration disable-login disable-login-with-password enable-login-with-oidc";
|
||||||
|
"PENPOT_PREPL_HOST" = "0.0.0.0";
|
||||||
|
|
||||||
|
"PENPOT_PUBLIC_URI" = "https://design.katzen.cafe/";
|
||||||
|
|
||||||
|
"PENPOT_DATABASE_URI" = "postgresql://penpot-postgres/penpot";
|
||||||
|
"PENPOT_DATABASE_USERNAME" = "penpot";
|
||||||
|
"PENPOT_DATABASE_PASSWORD" = "penpot";
|
||||||
|
"PENPOT_REDIS_URI" = "redis://penpot-redis/0";
|
||||||
|
|
||||||
|
"PENPOT_ASSETS_STORAGE_BACKEND" = "assets-fs";
|
||||||
|
"PENPOT_STORAGE_ASSETS_FS_DIRECTORY" = "/opt/data/assets";
|
||||||
|
#"PENPOT_OIDC_NAME_ATTR" = "username";
|
||||||
|
|
||||||
|
"PENPOT_TELEMETRY_ENABLED" = "false";
|
||||||
|
|
||||||
|
"PENPOT_OIDC_CLIENT_ID" = "penpot";
|
||||||
|
"PENPOT_OIDC_BASE_URI" = "https://auth.katzen.cafe/realms/master/";
|
||||||
|
#"PENPOT_OIDC_" = "";
|
||||||
|
|
||||||
|
#"PENPOT_SMTP_DEFAULT_FROM" = "Penpot <noreply-pp@schrottkatze.de>";
|
||||||
|
#"PENPOT_SMTP_DEFAULT_REPLY_TO" = "Penpot <noreply-pp@schrottkatze.de>";
|
||||||
|
#"PENPOT_SMTP_HOST" = "smtp.migadu.com";
|
||||||
|
#"PENPOT_SMTP_PORT" = "587";
|
||||||
|
#"PENPOT_SMTP_USERNAME" = "noreply-pp@schrottkatze.de";
|
||||||
|
#"PENPOT_SMTP_PASSWORD" = "${builtins.readFile ../secret-data/penpot-smtp-pass}";
|
||||||
|
#"PENPOT_SMTP_TLS" = "true";
|
||||||
|
#"PENPOT_SMTP_SSL" = "false";
|
||||||
|
};
|
||||||
|
env_file = [ "/penpot/secret/oidcPpSecret" ];
|
||||||
|
};
|
||||||
|
"penpot-frontend".service = {
|
||||||
|
image = "penpotapp/frontend:latest";
|
||||||
|
ports = [ "9001:80" ];
|
||||||
|
volumes = [ "/penpot/assets:/opt/data/assets" ];
|
||||||
|
depends_on = [ "penpot-backend" "penpot-exporter" ];
|
||||||
|
networks = [ "penpot" ];
|
||||||
|
environment = {
|
||||||
|
"PENPOT_FLAGS" = "enable-registration disable-login disable-login-with-password enable-login-with-oidc";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
"penpot-exporter".service = {
|
||||||
|
image = "penpotapp/exporter:latest";
|
||||||
|
networks = [ "penpot" ];
|
||||||
|
environment = {
|
||||||
|
"PENPOT_PUBLIC_URI" = "http://penpot-frontend";
|
||||||
|
"PENPOT_REDIS_URI" = "redis://penpot-redis/0";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
"penpot-postgres".service = {
|
||||||
|
image = "postgres:15";
|
||||||
|
stop_signal = "SIGINT";
|
||||||
|
volumes = [ "/penpot/postgres_v15:/var/lib/postgresql/data" ];
|
||||||
|
networks = [ "penpot" ];
|
||||||
|
environment = {
|
||||||
|
"POSTGRES_INITDB_ARGS" = "--data-checksums";
|
||||||
|
"POSTGRES_DB" = "penpot";
|
||||||
|
"POSTGRES_USER" = "penpot";
|
||||||
|
"POSTGRES_PASSWORD" = "penpot";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
"penpot-redis".service = {
|
||||||
|
image = "redis:7";
|
||||||
|
networks = [ "penpot" ];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
deployment.keys = {
|
||||||
|
"oidcPpSecret" = {
|
||||||
|
keyCommand = [ "cat" "/home/jade/keys-tmp/penpot-keycloak-secret" ];
|
||||||
|
destDir = "/penpot/secret/";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
||||||
|
|
|
@ -36,15 +36,33 @@
|
||||||
virtualHost.adminAddr = "admin@katzen.cafe";
|
virtualHost.adminAddr = "admin@katzen.cafe";
|
||||||
passwordFile = "/var/mediawiki/passwordFile";
|
passwordFile = "/var/mediawiki/passwordFile";
|
||||||
extraConfig = ''
|
extraConfig = ''
|
||||||
|
# $wgShowExceptionDetails = true;
|
||||||
|
# $wgDebugToolbar = true;
|
||||||
|
# $wgShowDebug = true;
|
||||||
|
# $wgDevelopmentWarnings = true;
|
||||||
|
|
||||||
# Disable anonymous editing
|
# Disable anonymous editing
|
||||||
$wgGroupPermissions['*']['edit'] = false;
|
$wgGroupPermissions['*']['edit'] = false;
|
||||||
|
$wgGroupPermissions['oidc_editor']['edit'] = true;
|
||||||
|
$wgGroupPermissions['oidc_editor']['createpage'] = true;
|
||||||
|
|
||||||
|
$wgGroupPermissions['oidc_interface_admin'] = $wgGroupPermissions['interface_admin'];
|
||||||
|
$wgGroupPermissions['oidc_admin'] = $wgGroupPermissions['sysop'];
|
||||||
|
$wgGroupPermissions['oidc_admin']['userrights'] = true;
|
||||||
|
|
||||||
$wgDebugLogFile = "/var/log/mediawiki/debug-{$wgDBname}.log";
|
$wgDebugLogFile = "/var/log/mediawiki/debug-{$wgDBname}.log";
|
||||||
$wgPluggableAuth_Config["katzen.cafe authentication"] = [
|
|
||||||
|
$oidcClientSecret = file_get_contents('/var/mediawiki/keycloakClientSecret', false, null, 0, 32);
|
||||||
|
|
||||||
|
$wgPluggableAuth_Config[] = [
|
||||||
'plugin' => 'OpenIDConnect',
|
'plugin' => 'OpenIDConnect',
|
||||||
'data' => [
|
'data' => [
|
||||||
'providerURL' => 'https://auth.katzen.cafe/realms/master/',
|
'providerURL' => 'https://auth.katzen.cafe/realms/phtanum-b',
|
||||||
'clientID' => 'phtanumb-wiki',
|
'clientID' => 'phtanumb-wiki',
|
||||||
'clientsecret' => '/var/mediawiki/keycloakClientSecret',
|
# hack to try dynamically get the secret
|
||||||
|
'clientsecret' => $oidcClientSecret,
|
||||||
|
'global_roles' => ['property' => ['realm_access', 'roles']],
|
||||||
|
'wiki_roles' => ['property' => ['resource_access', 'phtanumb-wiki', 'roles']]
|
||||||
]
|
]
|
||||||
];
|
];
|
||||||
'';
|
'';
|
||||||
|
@ -65,12 +83,13 @@
|
||||||
};
|
};
|
||||||
deployment.keys = {
|
deployment.keys = {
|
||||||
"passwordFile" = {
|
"passwordFile" = {
|
||||||
keyCommand = [ "cat" "/home/jade/keys/phtanumb-wiki/passwordFile" ];
|
keyCommand = [ "cat" "/home/jade/keys-tmp/phtanumb-wiki-passwordFile" ];
|
||||||
destDir = "/phtanum-b/wiki";
|
destDir = "/phtanum-b/wiki";
|
||||||
};
|
};
|
||||||
"keycloakClientSecret" = {
|
"keycloakClientSecret" = {
|
||||||
keyCommand = [ "cat" "/home/jade/keys-tmp/phtanumb-wiki-keycloak-secret" ];
|
keyCommand = [ "cat" "/home/jade/keys-tmp/phtanumb-wiki-keycloak-secret" ];
|
||||||
destDir = "/phtanum-b/wiki";
|
destDir = "/phtanum-b/wiki";
|
||||||
|
permissions = "0604";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
@ -7,10 +7,10 @@
|
||||||
webroot = "/var/lib/acme/acme-challenge";
|
webroot = "/var/lib/acme/acme-challenge";
|
||||||
};
|
};
|
||||||
certs = {
|
certs = {
|
||||||
#"meet.katzen.cafe" = {
|
"meet.katzen.cafe" = {
|
||||||
#group = "nginx";
|
group = "nginx";
|
||||||
#keyType = "rsa4096";
|
keyType = "rsa4096";
|
||||||
#};
|
};
|
||||||
"wiki.phtanum-b.katzen.cafe" = {
|
"wiki.phtanum-b.katzen.cafe" = {
|
||||||
group = "nginx";
|
group = "nginx";
|
||||||
keyType = "rsa4096";
|
keyType = "rsa4096";
|
||||||
|
@ -19,10 +19,20 @@
|
||||||
group = "nginx";
|
group = "nginx";
|
||||||
keyType = "rsa4096";
|
keyType = "rsa4096";
|
||||||
};
|
};
|
||||||
|
"design.katzen.cafe" = {
|
||||||
|
group = "nginx";
|
||||||
|
keyType = "rsa4096";
|
||||||
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
services.nginx = {
|
services.nginx = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
|
||||||
|
recommendedGzipSettings = true;
|
||||||
|
recommendedOptimisation = true;
|
||||||
|
recommendedTlsSettings = true;
|
||||||
|
recommendedProxySettings = true;
|
||||||
|
|
||||||
virtualHosts = {
|
virtualHosts = {
|
||||||
"wiki.phtanum-b.katzen.cafe" = {
|
"wiki.phtanum-b.katzen.cafe" = {
|
||||||
forceSSL = true;
|
forceSSL = true;
|
||||||
|
@ -36,14 +46,28 @@
|
||||||
enableACME = true;
|
enableACME = true;
|
||||||
locations."/" = {
|
locations."/" = {
|
||||||
proxyPass = "http://127.0.0.1:8080";
|
proxyPass = "http://127.0.0.1:8080";
|
||||||
|
extraConfig = ''
|
||||||
|
proxy_buffers 4 256k;
|
||||||
|
proxy_buffer_size 128k;
|
||||||
|
proxy_busy_buffers_size 256k;
|
||||||
|
proxy_set_header Host $host;
|
||||||
|
proxy_set_header X-Forwarded-Proto $scheme;
|
||||||
|
proxy_set_header X-Forwarded-For $proxy_protocol_addr;
|
||||||
|
proxy_set_header X-Real-IP $remote_addr;
|
||||||
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
#extraConfig = ''
|
||||||
|
#'';
|
||||||
|
};
|
||||||
|
"design.katzen.cafe" = {
|
||||||
|
forceSSL = true;
|
||||||
|
enableACME = true;
|
||||||
|
locations."/" = {
|
||||||
|
proxyPass = "http://localhost:9001";
|
||||||
|
proxyWebsockets = true;
|
||||||
};
|
};
|
||||||
extraConfig = ''
|
|
||||||
proxy_set_header X-Forwarded-For $proxy_protocol_addr;
|
|
||||||
proxy_set_header X-Forwarded-Proto $scheme;
|
|
||||||
proxy_set_header Host $host;
|
|
||||||
'';
|
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in a new issue