darman/homelab
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

neptun: replace Zitadel with Authentik as the OIDC provider

Browse Source 
nixpkgs only carries Zitadel 2.71, which predates the login-v2 split and
cannot take a v3/v4 database (its migrations are forward-only), so the
instance running on the old Debian VPS could never have moved onto it.
authentik-nix ships 2026.5.4 and tracks upstream closely.

The authentik-nix input deliberately does not follow our nixpkgs, per
upstream's warning that overriding it breaks their pinned python
dependency set. That costs a second nixpkgs in the lock, so add
nix-community's Cachix to common.nix -- without it the closure is ~400
local derivations (npm, rust, python). The laptop that runs
scripts/deploy needs the same two lines in /etc/nix/nix.custom.conf.

Authentik's own module creates the database and orders its units against
postgresql.target, and recent versions need no redis, so the wiring is
just the module plus a secret. Pin postgresql explicitly so that editing
system.stateVersion can never silently demand a pg_upgrade of the
identity store.

Secret ownership is not uniform and the difference matters: authentik
and caddy take a systemd EnvironmentFile, which PID 1 reads as root
before dropping privileges, so root:root 0400 is correct. Headplane
opens its secret paths itself while already running as the headscale
user, so those three need an explicit owner or they fail to start.

Also on neptun:

- Pass Caddy's ACME account email through the same EnvironmentFile
  mechanism and reference it with the Caddyfile {$VAR} placeholder.
  services.caddy.email would render the address into the world-readable
  store.
- Stop accepting MagicDNS from our own control server. headscale pushes
  override_local_dns, so joining the tailnet would point neptun's
  resolv.conf at a MagicDNS served by the tailscaled neptun itself hosts
  -- a tailscaled failure would then also take out DNS, ACME renewal and
  finally the certs for the control server every other node needs in
  order to recover.
- Give headplane a writable DNS extra-records file. Its view of
  headscale's config stays read-only, which is the right outcome for a
  declarative box; records are data rather than config.
- Require a password for sudo. Deploys become interactive, but darman's
  key is otherwise the only thing between the public internet and root.
- Enable zram (8 GB, and disko leaves no room for a swap device), and let
  tailscaled-autoconnect retry instead of failing permanently when the
  control server isn't up yet on a first boot.

networking.hosts still carries a PLACEHOLDER address for jupiter --
replace it from `headscale nodes list` once jupiter first enrols.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
darman
2026-07-20 07:50:39 +02:00
co-authored by Claude Opus 4.8
parent d7a66f3e3b
commit ac42f231f5
12 changed files with 439 additions and 119 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/identity/authentik.nix
+47
View File
@@ -0,0 +1,47 @@
{ config, pkgs, inputs, ... }:
# Authentik — self-hosted identity/OIDC provider.
#
# Replaced Zitadel: nixpkgs only carries Zitadel 2.71 (no login-v2 split, and
# a v3/v4 database migrates forward only, so an existing instance can't be
# moved onto it). authentik-nix tracks upstream closely instead.
#
# The upstream module owns postgres (createDatabase) AND orders the units
# against postgresql.target, so no manual After= is needed here. No redis —
# recent authentik runs channels/cache on postgres.
#
# TLS terminates at Caddy; every listener is pinned to loopback below so
# nothing is reachable from the tailnet (hosts trust tailscale0).
#
# Needs, wired via sops in the host's secrets.nix: an environmentFile carrying
# - AUTHENTIK_SECRET_KEY (`openssl rand -base64 60`) — signs sessions
# - AUTHENTIK_BOOTSTRAP_PASSWORD first-run akadmin password
# systemd reads EnvironmentFile as root before dropping to the service's
# DynamicUser, so the sops default root:root 0400 is correct — do NOT set
# `owner` on it the way the headplane secrets need.
{
imports = [ inputs.authentik-nix.nixosModules.default ];
# Pinned explicitly: the default tracks system.stateVersion, so editing that
# line would silently demand a pg_upgrade of the identity store. Bump this
# deliberately, with a dump in hand.
services.postgresql.package = pkgs.postgresql_17;
services.authentik = {
enable = true;
environmentFile = config.sops.templates."authentik.env".path;
settings = {
# Default is 0.0.0.0 on all three; behind Caddy loopback is enough.
listen = {
listen_http = "127.0.0.1:9000";
listen_https = "127.0.0.1:9443";
listen_metrics = "127.0.0.1:9300";
};
disable_startup_analytics = true;
error_reporting.enabled = false;
avatars = "initials";
};
};
}
services/identity/zitadel.nix
-60
View File
@@ -1,60 +0,0 @@
{ config, ... }:
# Zitadel — self-hosted identity/OIDC provider. Local Postgres (peer-authed
# over the unix socket, no password anywhere) since Zitadel is latency-
# sensitive to its DB. TLS terminates at Caddy; Zitadel itself only listens
# on localhost:8080.
#
# The "zitadel" Postgres role doubles as both User (runtime queries) and
# Admin (bootstrap: creates db/extensions on first start) — granted
# createdb+createrole rather than using the postgres superuser, per
# Zitadel's own guidance to scope bootstrap privileges to a dedicated role.
#
# Needs, wired via sops in the host's secrets.nix:
# - masterKeyFile: 32 raw bytes, e.g. `openssl rand -hex 16`
# - extraStepsPaths: a FirstInstance admin bootstrap file (keeps the admin
# password out of the Nix store — settings.steps would leak it, since
# it's rendered into a world-readable store path)
{
services.postgresql = {
enable = true;
ensureDatabases = [ "zitadel" ];
ensureUsers = [
{
name = "zitadel";
ensureDBOwnership = true;
ensureClauses = {
createdb = true;
createrole = true;
};
}
];
};
services.zitadel = {
enable = true;
tlsMode = "external";
masterKeyFile = config.sops.secrets.zitadel_master_key.path;
extraStepsPaths = [ config.sops.templates."zitadel-first-instance.yaml".path ];
settings = {
Port = 8080;
ExternalPort = 443;
ExternalSecure = true;
Database.postgres = {
Host = "/run/postgresql";
Port = 5432;
Database = "zitadel";
User = {
Username = "zitadel";
SSL.Mode = "disable";
};
Admin = {
Username = "zitadel";
SSL.Mode = "disable";
};
};
};
};
}