nico/dots
2
2
Fork 1
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

tinyauth: init

Browse source
This commit is contained in:
Nico 2026-01-12 16:19:38 +11:00
parent 0d346e5ae6
commit 59e9e26fcb
Signed by: nico
SSH key fingerprint: SHA256:XuacYOrGqRxC3jVFjfLROn1CSvLz85Dec6N7O9Gwu/0
3 changed files with 65 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

1
flake.nix
View file

@ -30,6 +30,7 @@
./modules/services/uptime-kuma.nix
./modules/services/auth/kanidm.nix
./modules/services/auth/tinyauth.nix
./modules/services/caddy.nix
./modules/services/forgejo.nix
./modules/services/miniflux.nix

43
modules/services/auth/tinyauth.nix Normal file
View file

@ -0,0 +1,43 @@
{ config, lib, pkgs, ... }:
{
virtualisation.oci-containers.backend = "podman";
virtualisation.oci-containers.containers.tinyauth = {
image = "ghcr.io/steveiliop56/tinyauth:v4";
ports = [
"3009:3000"
];
environment = {
"APP_URL" = "https://tinyauth.${config.homelab.domain}";
"PROVIDERS_KANIDM_CLIENT_ID" = "tinyauth";
"PROVIDERS_KANIDM_AUTH_URL" = "https://${config.homelab.authDomain}/ui/oauth2";
"PROVIDERS_KANIDM_TOKEN_URL" = "https://${config.homelab.authDomain}/oauth2/token";
"PROVIDERS_KANIDM_USER_INFO_URL" = "https://${config.homelab.authDomain}/oauth2/openid/tinyauth/userinfo";
"PROVIDERS_KANIDM_REDIRECT_URL" = "https://tinyauth.${config.homelab.domain}/api/oauth/callback/kanidm";
"PROVIDERS_KANIDM_SCOPES" = "openid email profile groups";
"PROVIDERS_KANIDM_NAME" = "${config.homelab.authDomain}";
};
environmentFiles = [
# set variable PROVIDERS_KANIDM_CLIENT_SECRET here
/var/lib/tinyauth
];
};
services.caddy.extraConfig = ''
(tinyauth_forwarder) {
forward_auth 127.0.0.1:3009 {
uri /api/auth/caddy
}
}
'';
services.caddy.virtualHosts."tinyauth.${config.homelab.domain}" = {
useACMEHost = config.homelab.domain;
extraConfig = ''
reverse_proxy http://localhost:3009
'';
};
}

26
modules/services/media/arr.nix
View file

@ -15,8 +15,12 @@
services.caddy.virtualHosts."radarr.${config.homelab.domain}" = {
useACMEHost = config.homelab.domain;
extraConfig = ''
reverse_proxy http://localhost:7878
# For tinyauth
reverse_proxy http://localhost:7878 {
header_up -X-Forwarded-For
}
import block_non_private_ips
import tinyauth_forwarder *
'';
};
@ -32,8 +36,11 @@
services.caddy.virtualHosts."sonarr.${config.homelab.domain}" = {
useACMEHost = config.homelab.domain;
extraConfig = ''
reverse_proxy http://localhost:8989
reverse_proxy http://localhost:8989 {
header_up -X-Forwarded-For
}
import block_non_private_ips
import tinyauth_forwarder *
'';
};
@ -47,7 +54,10 @@
services.caddy.virtualHosts."prowlarr.${config.homelab.domain}" = {
useACMEHost = config.homelab.domain;
extraConfig = ''
reverse_proxy http://localhost:9696
reverse_proxy http://localhost:9696 {
header_up -X-Forwarded-For
}
import tinyauth_forwarder *
import block_non_private_ips
'';
};
@ -63,7 +73,10 @@
services.caddy.virtualHosts."bazarr.${config.homelab.domain}" = {
useACMEHost = config.homelab.domain;
extraConfig = ''
reverse_proxy http://localhost:6767
reverse_proxy http://localhost:6767 {
header_up -X-Forwarded-For
}
import tinyauth_forwarder *
import block_non_private_ips
'';
};
@ -80,7 +93,10 @@
services.caddy.virtualHosts."deluge.${config.homelab.domain}" = {
useACMEHost = config.homelab.domain;
extraConfig = ''
reverse_proxy http://localhost:8112
reverse_proxy http://localhost:8112 {
header_up -X-Forwarded-For
}
import tinyauth_forwarder *
import block_non_private_ips
'';
};