From ab03e929d4ae79cd5218608d88d4435c3f7445cb Mon Sep 17 00:00:00 2001
From: Daniel Flanagan <daniel@lyte.dev>
Date: Mon, 5 Aug 2024 20:42:50 -0500
Subject: [PATCH] WIP kanidm deployment

---
 modules/nixos/kanidm/client.toml |   2 ++
 modules/nixos/kanidm/kanidm.db   | Bin 0 -> 73728 bytes
 modules/nixos/kanidm/server.toml |  10 ++++++++++
 nixos/beefcake.nix               |  32 +++++++++++++++++++++++++++++++
 nixos/router.nix                 |   1 +
 templates/rust/flake.nix         |   2 ++
 6 files changed, 47 insertions(+)
 create mode 100644 modules/nixos/kanidm/client.toml
 create mode 100644 modules/nixos/kanidm/kanidm.db
 create mode 100644 modules/nixos/kanidm/server.toml

diff --git a/modules/nixos/kanidm/client.toml b/modules/nixos/kanidm/client.toml
new file mode 100644
index 0000000..1ea48a5
--- /dev/null
+++ b/modules/nixos/kanidm/client.toml
@@ -0,0 +1,2 @@
+uri = "https://idm.foxtrot.hare-cod.ts.net:8443"
+ca_path = "/tmp/cert.pem"
diff --git a/modules/nixos/kanidm/kanidm.db b/modules/nixos/kanidm/kanidm.db
new file mode 100644
index 0000000000000000000000000000000000000000..2a0e7c7d26881f9589f10fbc95b0837e8dff78ce
GIT binary patch
literal 73728
zcmeI)%}yIv7zW@OFt#CpLn>scQN#o(YKVqv&Uj{QXVW@lf~>fv7}7SXBG<tVvA{OP
zcA6;4B9tt80o}G2kwv@f9dyyFsJhE4Rabq#u`#A#LZzxz+}FZke$LN#o^y;CzN4(I
z=BllV@u0C=E47S-c3#tU?L))RG%bwx1-uVlavnN3!FRpyc+g>3d%yVZRP1+cCh}5?
zU5foQ`SbK|(?3k_Pp?k=IQjkL&SYlt!uW3V+wl(~FQZ=!YKGS-KmiI+fCB$}f#=uG
zN8*<+>w9yp(*5nq!)C2mF11R<*5T32Qo+xx`^I|aM$R`5uNzk<i~+B$$`fPV|7_j(
zxRCuQQ@Cr~_V1blOFt@Yw=2et+{z6jzp`%R@8ohPmR(59gyYMXb*)-2R~|RN+{P~(
z#ZtS~2+oU#krmb9@rCE_O-JH$bNb$;-UzGpR%d|0LG0N0g3JH@@Kh`u_vcO<UJzJk
zbiv{Iy``yO`u10Y!PP3Y`<30sgJSFOX!^+T4zCXw-)6Dhu9kz@J9)-RZz^zWrQm0m
z^D^gGJFP7k1^<>`@bgRlnz6atXzvtTSEZW;<EGpw1S>0>&#q@Px!m3EMgQi>0ra=u
z3Fb)qrHze7TPC>M!%80Q<$NsQrOet==B9saZ7uA58jZv+UesTV1&ZAWyWhr-_;oK1
z!0XYydEwVfwMyqRa<Jx&JNfMD9slG(H+SlPqx5FATyM)#FtYh|f7vheK3J!A(rRo~
z>PJ6_Cr49xyi?tMf=}v4ej&TmYy7zE;$%3Uxj1M^cQK1j_h4%A+*yhzy2U3KC(csb
z?iN3{IDVGms#|>GYi%_6!SP}xSQWi>)jJ3sSsA^{!?`wgO3mh1joosvJWgH}|NQb%
zk<)%6_QZ=$?=Y&uXRDIvRf(vvvsJNsRl+KCwkoPuW$gK!9*JMMqVMU!aw^|1KC0|C
ztBrcG)qgy4WKs3s8L+OpKdj&U6Q|qV!H<OFAJ*hZIDY%epbu+*C`HwOHj3Y(qVk*6
z6yAF5wT3UgC_n)UP=Epypa2CZKmiI+fC3a4E`dmBbauQ}s@5kkE<XPc*W_|E6rcbF
zC_n)UP=Epypa2CZK!L76baYmi$N!Mz|FP+xFA7kA0u-PC1t>rP3Q&Lo6rcbFhFC!I
z|9t)*;tA%^C_n)UP=Epypa2CZKmiI+fC3QU^FNmX1t>rP3Q&Lo6rcbFC_n)UP+<54
z`20WobIcJ^fC3bt00k&O0SZun0u-PC1^E2WH9!FhP=Epypa2CZKmiI+fC3a4egXdf
zf5Sh=93cfLKmiI+fC3bt00k&O0SZun`G2kf3Q&Lo6rcbFC_n)UP=Epypuq48@cDoE
z=a?g;00k&O0SZun0u-PC1t>rP3h?=#Yk&e2pa2CZKmiI+fC3bt00k&8`~rObAO1P!
z2q{1T3Q&Lo6rcbFC_n)UP=Esb|NpoKC_n)UP=Epypa2CZKmiI+fC9rWAkY6JQ@?1_
zzv3UhC_n)UP=Epypa2CZKmiI+;4Ko^duJpxyFdT1R@!(vzt(urT6<WsUGEb$fBotF
zR^`e3_0Mfvnd!8dNSW!BX(yDa9M8m&<(RmdG?kUWJ833tQ`xxg;xvI0wuy?KYo<^!
zZQ3?&r}4Hd6ZMlQ=-{elo30n!L>c#<Io~R6N}mZQxTjKP3b)Z>(m}tt=%h>!eac%x
zk-oj4IfdTrgoP%mkI;fjqU9u7_Ry^*bvz4AN|^-SZl}6J2@JtjR?vg(BEWmkp6$)*
zp_%<_wXKdxrqYDT@<y$nMWJ^L6Y-#V<(aMoh~{04uVW-b#rPFERvt7Q7afV0B_=pi
zX%tK&Ky;6uQ#f<sqHssfh0H-+v}n6d&qg^2*h-_Fpmhf!L%>#DBp0m+1#Tle+m&uG
zIJDu2Z-67!gK0uED2Wz?%EDYB7|S!$u8Dwg%}ZmBJCk9-MfU%X#9nE!SFu0dqD9V7
zDL?@VP=Epypa2CZKmiI+fC3aaO&~fttIOYpM#e^G#%o)W|JSF!)9}R?1t>rP3Q&Lo
z6rcbFC_n)U{AU9DMLiV%CRHsXZ{JB=`y1uvU(@;BB)%<~WgIJ{cx~kNl_c4bFjlr}
zO0GSLys?}jWsj`7nGW*j3h8VQ`DLVt74qGZpq2!C3RUsVmdr6S%E(tEA08y6Q)mTg
zWL!xg<BSs|zLENO(Whjkk>!`>kocBe14zUt<)Y;0ksnW*NR6Wk_7r$1hda`mjo1*P
zoJ!=9MaL!q#3fae*a?6{wu81L8!nL|g`PH%A4d`%=Rw|FlK&W%Y#+cT0hK~CHfkZf
zpgG)>D9{gb;Ml65kQWbbNR}NV_7I<7Nk&}`F=9l44F<040g!DG5+oAt3MqMXg0Ud2
z9_%uZN*KQ6{eztVaF87c7>~dRS`Zt65SJWUeQAFr<rTEB2?7V`6%D1(sbgY#6oxJC
zlKht$!%RqEo;t|*%hm}LOCdN+JRmU`h0^%4E$lgfH%iF3(X*(?rT{O2>W^J3J%7F4
t-rnxy|Ml2w4PSgwfC3bt00k&O0SZun0u-PC1t>6F0@2a<c<@)HKLKtsRdxUX

literal 0
HcmV?d00001

diff --git a/modules/nixos/kanidm/server.toml b/modules/nixos/kanidm/server.toml
new file mode 100644
index 0000000..3e35d9e
--- /dev/null
+++ b/modules/nixos/kanidm/server.toml
@@ -0,0 +1,10 @@
+bindaddress = "[::]:8443"
+db_path = "/home/daniel/code/nix/modules/nixos/kanidm/kanidm.db"
+tls_chain = "/tmp/cert.pem"
+tls_key = "/tmp/key.pem"
+domain = "idm.foxtrot.hare-cod.ts.net"
+origin = "https://idm.foxtrot.hare-cod.ts.net:8443"
+
+[online_backup]
+path = "/tmp/kanidm/backups/"
+schedule = "00 22 * * *"
diff --git a/nixos/beefcake.nix b/nixos/beefcake.nix
index 0583aea..0f520ed 100644
--- a/nixos/beefcake.nix
+++ b/nixos/beefcake.nix
@@ -999,6 +999,38 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
         26966
       ];
     }
+    {
+      # kanidm
+      services.kanidm = {
+        enableClient = true;
+        enablePam = true;
+        enableServer = true;
+
+        serverSettings = {
+          bindaddress = "[::]:8443";
+          db_path = "/storage/kanidm/data/kanidm.db";
+          # TODO: these will need permissions?
+          tls_chain = "/var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/idm.h.lyte.dev.crt";
+          tls_key = "/var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/idm.h.lyte.dev.key";
+          domain = "idm.foxtrot.hare-cod.ts.net";
+          origin = "https://idm.h.lyte.dev:8443";
+
+          online_backup = {
+            path = "/storage/kanidm/backups/";
+            schedule = "00 22 * * *";
+          };
+        };
+
+        clientSettings = {
+          uri = "https://idm.h.lyte.dev";
+          # ca_path = "/tmp/cert.pem";
+        };
+      };
+
+      services.caddy.virtualHosts."idm.h.lyte.dev" = {
+        extraConfig = ''reverse_proxy :8443'';
+      };
+    }
   ];
 
   # TODO: non-root processes and services that access secrets need to be part of
diff --git a/nixos/router.nix b/nixos/router.nix
index 1931dad..f1c7cd1 100644
--- a/nixos/router.nix
+++ b/nixos/router.nix
@@ -46,6 +46,7 @@
       additionalHosts = [
         ".beefcake.lan"
         "nix.h.lyte.dev"
+        "idm.h.lyte.dev"
         "git.lyte.dev"
         "video.lyte.dev"
         "a.lyte.dev"
diff --git a/templates/rust/flake.nix b/templates/rust/flake.nix
index f7c6efa..d1b1f18 100644
--- a/templates/rust/flake.nix
+++ b/templates/rust/flake.nix
@@ -52,6 +52,8 @@
         src = ./.;
         hash = pkgs.lib.fakeHash;
         cargoHash = "sha256-W7VQlMktGsRPQL9VGVmxYV6C5u2eJ48S7eTpOM+3n8U=";
+
+        RUSTFLAGS = pkgs.lib.optionalString pkgs.stdenv.isLinux "-C link-arg=-fuse-ld=mold";
       };
 
       default = outputs.packages.${pkgs.system}.my-package;