danvics/selfhostblocks
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

authelia: update test now that authelia forbids http

Browse source
This commit is contained in:
ibizaman 2026-05-10 00:00:02 +02:00
parent 15ddc0f78c
commit 4e384211ba
2 changed files with 24 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
modules/blocks/authelia.nix
View file

@ -645,6 +645,7 @@ in
shb.mitmdump.instances."authelia-${fqdn}" = lib.mkIf cfg.debug { shb.mitmdump.instances."authelia-${fqdn}" = lib.mkIf cfg.debug {
listenPort = 9091; listenPort = 9091;
upstreamPort = 9090; upstreamPort = 9090;
timeout = 30;
after = [ "authelia-${fqdn}.service" ]; after = [ "authelia-${fqdn}.service" ];
enabledAddons = [ config.shb.mitmdump.addons.logger ]; enabledAddons = [ config.shb.mitmdump.addons.logger ];
extraArgs = [ extraArgs = [

25
test/blocks/authelia.nix
View file

@ -16,6 +16,7 @@ in
(pkgs'.path + "/nixos/modules/profiles/qemu-guest.nix") (pkgs'.path + "/nixos/modules/profiles/qemu-guest.nix")
../../modules/blocks/authelia.nix ../../modules/blocks/authelia.nix
../../modules/blocks/hardcodedsecret.nix ../../modules/blocks/hardcodedsecret.nix
../../modules/blocks/ssl.nix
]; ];
networking.hosts = { networking.hosts = {
@ -28,11 +29,29 @@ in
]; ];
}; };
shb.certs.cas.selfsigned.myca = {
name = "My CA";
};
shb.certs.certs.selfsigned = {
"machine.com" = {
ca = config.shb.certs.cas.selfsigned.myca;
domain = "*.machine.com";
group = "nginx";
};
};
systemd.services.nginx.after = [ config.shb.certs.certs.selfsigned."machine.com".systemdService ];
systemd.services.nginx.requires = [
config.shb.certs.certs.selfsigned."machine.com".systemdService
];
shb.lldap = { shb.lldap = {
enable = true; enable = true;
dcdomain = "dc=example,dc=com"; dcdomain = "dc=example,dc=com";
subdomain = "ldap"; subdomain = "ldap";
domain = "machine.com"; domain = "machine.com";
ssl = config.shb.certs.certs.selfsigned."machine.com";
ldapUserPassword.result = config.shb.hardcodedsecret.ldapUserPassword.result; ldapUserPassword.result = config.shb.hardcodedsecret.ldapUserPassword.result;
jwtSecret.result = config.shb.hardcodedsecret.jwtSecret.result; jwtSecret.result = config.shb.hardcodedsecret.jwtSecret.result;
}; };
@ -50,6 +69,8 @@ in
enable = true; enable = true;
subdomain = "authelia"; subdomain = "authelia";
domain = "machine.com"; domain = "machine.com";
ssl = config.shb.certs.certs.selfsigned."machine.com";
ldapHostname = "${config.shb.lldap.subdomain}.${config.shb.lldap.domain}"; ldapHostname = "${config.shb.lldap.subdomain}.${config.shb.lldap.domain}";
ldapPort = config.shb.lldap.ldapPort; ldapPort = config.shb.lldap.ldapPort;
dcdomain = config.shb.lldap.dcdomain; dcdomain = config.shb.lldap.dcdomain;
@ -136,10 +157,10 @@ in
machine.wait_for_unit("authelia-authelia.machine.com.target") machine.wait_for_unit("authelia-authelia.machine.com.target")
machine.wait_for_open_port(9091) machine.wait_for_open_port(9091)
endpoints = json.loads(machine.succeed("curl -s http://machine.com/.well-known/openid-configuration")) endpoints = json.loads(machine.succeed("curl -s https://authelia.machine.com/.well-known/openid-configuration"))
auth_endpoint = endpoints['authorization_endpoint'] auth_endpoint = endpoints['authorization_endpoint']
print(f"auth_endpoint: {auth_endpoint}") print(f"auth_endpoint: {auth_endpoint}")
if auth_endpoint != "http://machine.com/api/oidc/authorization": if auth_endpoint != "https://authelia.machine.com/api/oidc/authorization":
raise Exception("Unexpected auth_endpoint") raise Exception("Unexpected auth_endpoint")
resp = machine.succeed( resp = machine.succeed(