darmanandClaude Sonnet 5
ced2b56764
Local Postgres, peer-authed over the unix socket (the "zitadel" role is granted createdb+createrole and doubles as both the runtime and bootstrap DB user - no password anywhere). TLS terminates at Caddy; Zitadel listens on localhost:8080 and is proxied at auth.mgaction.town. Master key and admin bootstrap password come from sops - the admin password specifically needs the sops.templates -> rendered-file route (services.zitadel.steps would leak it into the world-readable Nix store), same pattern as mercury's pihole.env. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
63 lines
1.9 KiB
Nix
63 lines
1.9 KiB
Nix
{ config, ... }:
|
|
|
|
# Zitadel — self-hosted identity/OIDC provider. Local Postgres (peer-authed
|
|
# over the unix socket, no password anywhere) since Zitadel is latency-
|
|
# sensitive to its DB. TLS is terminated at Caddy (see the host's
|
|
# configuration.nix for the public vhost); Zitadel itself only listens on
|
|
# localhost:8080.
|
|
#
|
|
# The "zitadel" Postgres role doubles as both Database.postgres.User (normal
|
|
# runtime queries) and .Admin (bootstrap: creates the db/extensions on first
|
|
# start) — granted createdb+createrole instead of using the real postgres
|
|
# superuser, matching Zitadel's own guidance to keep bootstrap privileges
|
|
# scoped to a dedicated role.
|
|
#
|
|
# Needs, wired via sops in the host's secrets.nix:
|
|
# - masterKeyFile: 32 raw bytes, e.g. `openssl rand -hex 16`
|
|
# - extraStepsPaths: a FirstInstance admin bootstrap file (keeps the admin
|
|
# password out of the Nix store — settings.steps would leak it, since
|
|
# it's rendered into a world-readable store path)
|
|
{
|
|
services.postgresql = {
|
|
enable = true;
|
|
ensureDatabases = [ "zitadel" ];
|
|
ensureUsers = [
|
|
{
|
|
name = "zitadel";
|
|
ensureDBOwnership = true;
|
|
ensureClauses = {
|
|
createdb = true;
|
|
createrole = true;
|
|
};
|
|
}
|
|
];
|
|
};
|
|
|
|
services.zitadel = {
|
|
enable = true;
|
|
tlsMode = "external";
|
|
masterKeyFile = config.sops.secrets.zitadel_master_key.path;
|
|
extraStepsPaths = [ config.sops.templates."zitadel-first-instance.yaml".path ];
|
|
|
|
settings = {
|
|
Port = 8080;
|
|
ExternalPort = 443;
|
|
ExternalSecure = true;
|
|
|
|
Database.postgres = {
|
|
Host = "/run/postgresql";
|
|
Port = 5432;
|
|
Database = "zitadel";
|
|
User = {
|
|
Username = "zitadel";
|
|
SSL.Mode = "disable";
|
|
};
|
|
Admin = {
|
|
Username = "zitadel";
|
|
SSL.Mode = "disable";
|
|
};
|
|
};
|
|
};
|
|
};
|
|
}
|