add keycloak for OAuth, runbooks, and finish forgejo setup

1 files changed, 18 insertions, 0 deletions

diff --git a/machines/nixos/x86_64-linux/synology-vm/profiles/keycloak.nix b/machines/nixos/x86_64-linux/synology-vm/profiles/keycloak.nix
new file mode 100644
index 0000000..fc1fe2d
--- /dev/null
+++ b/machines/nixos/x86_64-linux/synology-vm/profiles/keycloak.nix
@@ -0,0 +1,18 @@
+{ config, self, ... }:
+{
+  age.secrets.keycloak-db-password = {
+    file = "${self}/secrets/keycloak-db-password.age";
+  };
+
+  services.keycloak = {
+    enable = true;
+    database.passwordFile = config.age.secrets.keycloak-db-password.path;
+    settings = {
+      hostname = "id.fcuny.net";
+      http-host = "10.100.0.40";
+      http-port = 8080;
+      proxy-headers = "xforwarded";
+      http-enabled = true;
+    };
+  };
+}