profiles/authelia.nix


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

{ config, ... }:
{
  age.secrets = {
    authelia-storage-key = {
      file = ../secrets/authelia-storage-key.age;
      owner = "authelia-main";
    };
    authelia-jwt-key = {
      file = ../secrets/authelia-jwt-key.age;
      owner = "authelia-main";
    };
    authelia-users = {
      file = ../secrets/authelia-users.yaml.age;
      owner = "authelia-main";
    };
  };

  services.authelia.instances.main = {
    enable = true;
    secrets.storageEncryptionKeyFile = config.age.secrets."authelia-storage-key".path;
    secrets.jwtSecretFile = config.age.secrets."authelia-jwt-key".path;
    settings = {
      server.address = "tcp://:9092";
      default_2fa_method = "totp";
      notifier.filesystem.filename = "/var/lib/authelia-main/notification.txt";
      authentication_backend = {
        file.path = config.age.secrets."authelia-users".path;
      };
      access_control.default_policy = "one_factor";
      session.domain = "fcuny.net";
      storage = {
        local = {
          path = "/var/lib/authelia-main/db.sqlite3";
        };
      };
    };
  };
}