danvics/selfhostblocks
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

Update SSO setup for Audiobookshelf

Browse source 
More or less copied from jellyfin.
This commit is contained in:
sivert 2025-08-18 21:12:51 +02:00 committed by Pierre Penninckx
parent 30f9f32448
commit 205e43acfb
2 changed files with 88 additions and 46 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

55
modules/services/audiobookshelf.nix
View file

@ -47,46 +47,75 @@ in
''; '';
}; };
oidcProvider = lib.mkOption { sso = lib.mkOption {
description = "SSO configuration.";
default = {};
type = lib.types.submodule {
options = {
enable = lib.mkEnableOption "SSO";
provider = lib.mkOption {
type = lib.types.str; type = lib.types.str;
description = "OIDC provider name"; description = "OIDC provider name";
default = "Authelia"; default = "Authelia";
}; };
authEndpoint = lib.mkOption { endpoint = lib.mkOption {
type = lib.types.str; type = lib.types.str;
description = "OIDC endpoint for SSO"; description = "OIDC endpoint for SSO";
example = "https://authelia.example.com"; example = "https://authelia.example.com";
}; };
oidcClientID = lib.mkOption { clientID = lib.mkOption {
type = lib.types.str; type = lib.types.str;
description = "Client ID for the OIDC endpoint"; description = "Client ID for the OIDC endpoint";
default = "audiobookshelf"; default = "audiobookshelf";
}; };
oidcAdminUserGroup = lib.mkOption { adminUserGroup = lib.mkOption {
type = lib.types.str; type = lib.types.str;
description = "OIDC admin group"; description = "OIDC admin group";
default = "audiobookshelf_admin"; default = "audiobookshelf_admin";
}; };
oidcUserGroup = lib.mkOption { userGroup = lib.mkOption {
type = lib.types.str; type = lib.types.str;
description = "OIDC user group"; description = "OIDC user group";
default = "audiobookshelf_user"; default = "audiobookshelf_user";
}; };
ssoSecret = lib.mkOption { authorization_policy = lib.mkOption {
description = "SSO shared secret."; type = lib.types.enum [ "one_factor" "two_factor" ];
description = "Require one factor (password) or two factor (device) authentication.";
default = "one_factor";
};
sharedSecret = lib.mkOption {
description = "OIDC shared secret for Audiobookshelf.";
type = lib.types.submodule { type = lib.types.submodule {
options = contracts.secret.mkRequester { options = contracts.secret.mkRequester {
mode = "0440";
owner = "audiobookshelf"; owner = "audiobookshelf";
group = "audiobookshelf";
restartUnits = [ "audiobookshelfd.service" ]; restartUnits = [ "audiobookshelfd.service" ];
}; };
}; };
}; };
sharedSecretForAuthelia = lib.mkOption {
description = "OIDC shared secret for Authelia.";
type = lib.types.submodule {
options = contracts.secret.mkRequester {
mode = "0400";
ownerText = "config.shb.authelia.autheliaUser";
owner = config.shb.authelia.autheliaUser;
};
};
};
};
};
};
backup = lib.mkOption { backup = lib.mkOption {
description = '' description = ''
Backup configuration. Backup configuration.
@ -144,17 +173,21 @@ in
''; '';
}; };
shb.authelia.oidcClients = [ shb.authelia.oidcClients = lib.lists.optionals cfg.sso.enable [
{ {
client_id = cfg.oidcClientID; client_id = cfg.sso.clientID;
client_name = "Audiobookshelf"; client_name = "Audiobookshelf";
client_secret.source = cfg.ssoSecret.result.path; client_secret.source = cfg.sso.sharedSecretForAuthelia.result.path;
public = false; public = false;
authorization_policy = "one_factor"; authorization_policy = cfg.sso.authorization_policy;
redirect_uris = [ redirect_uris = [
"https://${cfg.subdomain}.${cfg.domain}/auth/openid/callback" "https://${cfg.subdomain}.${cfg.domain}/auth/openid/callback"
"https://${cfg.subdomain}.${cfg.domain}/auth/openid/mobile-redirect" "https://${cfg.subdomain}.${cfg.domain}/auth/openid/mobile-redirect"
]; ];
require_pkce = true;
pkce_challenge_method = "S256";
userinfo_signed_response_alg = "none";
token_endpoint_auth_method = "client_secret_basic";
} }
]; ];
} { } {

19
test/services/audiobookshelf.nix
View file

@ -69,13 +69,22 @@ let
sso = { config, ... }: { sso = { config, ... }: {
shb.audiobookshelf = { shb.audiobookshelf = {
authEndpoint = "https://${config.shb.authelia.subdomain}.${config.shb.authelia.domain}"; sso = {
ssoSecret.result = config.shb.hardcodedsecret.ssoSecret.result; enable = true;
endpoint = "https://${config.shb.authelia.subdomain}.${config.shb.authelia.domain}";
sharedSecret.result = config.shb.hardcodedsecret.audiobookshelfSSOPassword.result;
sharedSecretForAuthelia.result = config.shb.hardcodedsecret.audiobookshelfSSOPasswordAuthelia.result;
};
}; };
shb.hardcodedsecret.ssoSecret = { shb.hardcodedsecret.audiobookshelfSSOPassword = {
request = config.shb.audiobookshelf.ssoSecret.request; request = config.shb.audiobookshelf.sso.sharedSecret.request;
settings.content = "ssoSecret"; settings.content = "ssoPassword";
};
shb.hardcodedsecret.audiobookshelfSSOPasswordAuthelia = {
request = config.shb.audiobookshelf.sso.sharedSecretForAuthelia.request;
settings.content = "ssoPassword";
}; };
}; };
in in