From 08e525b19d19bf49dccd685ce8821d7f36286cd1 Mon Sep 17 00:00:00 2001 From: Moritz 'e1mo' Fromm Date: Mon, 24 Jul 2023 16:54:48 +0200 Subject: [PATCH 1/2] hedgedoc: Init --- hosts/goldberg/configuration.nix | 1 + hosts/shirley/configuration.nix | 1 + secrets/goldberg/secrets.yaml | 5 +- secrets/shirley/secrets.yaml | 5 +- services/hedgedoc.nix | 79 ++++++++++++++++++++++++++++++++ 5 files changed, 87 insertions(+), 4 deletions(-) create mode 100644 services/hedgedoc.nix diff --git a/hosts/goldberg/configuration.nix b/hosts/goldberg/configuration.nix index b7af7da..874d947 100644 --- a/hosts/goldberg/configuration.nix +++ b/hosts/goldberg/configuration.nix @@ -8,6 +8,7 @@ ../../services/vaultwarden.nix ../../services/dokuwiki.nix ../../services/freescout.nix + ../../services/hedgedoc.nix ]; system.stateVersion = "23.05"; diff --git a/hosts/shirley/configuration.nix b/hosts/shirley/configuration.nix index dc35ca8..47bb276 100644 --- a/hosts/shirley/configuration.nix +++ b/hosts/shirley/configuration.nix @@ -8,6 +8,7 @@ ../../services/vaultwarden.nix ../../services/dokuwiki.nix ../../services/freescout.nix + ../../services/hedgedoc.nix ]; system.stateVersion = "23.05"; diff --git a/secrets/goldberg/secrets.yaml b/secrets/goldberg/secrets.yaml index 3b05795..332a6d0 100644 --- a/secrets/goldberg/secrets.yaml +++ b/secrets/goldberg/secrets.yaml @@ -9,6 +9,7 @@ dokuwiki: keycloak_key: ENC[AES256_GCM,data:/6+NWA==,iv:61M+OdGx3lCR3uFWmArpYUm9Q4L+pv656V8g257YMTw=,tag:fOESdHA6+bpMMDRbWRFn+A==,type:str] vaultwarden: env: ENC[AES256_GCM,data:mDqHHAjisl0din/q67+zH7NMKLXld9qC0Si6ZREhRStXr6HEFD/QwaGLN86AvUI7sHNf9l4nrgKOht7uXNJrkjuidGsFEEJWkuUOjBRnrtipNKV2YK7giPQXEhH7wTdGeaqxqi4sk90Oq/FoKi2vPkFyNWGOQ5vOXkKKXjjHnbyKIQkIRWya2Dy6IN0CXU8UK0OiQXY3kgEFOyJoqt4sx/HOScHNKkaLb8U+0rpfzxSVyP3oY4o/DFkE51bnd/CNKg3ZK4Ynp/5m7Rs=,iv:aWpDXSp6Ds7cfdw/vfM3I5wcHz0MytnhpIIWEa24LBE=,tag:5YZKo4ZCT57gji8iyBMAiQ==,type:str] +hedgedoc_env: ENC[AES256_GCM,data:MeMyjUNchdUm9gqt7hOZU0xvlZvbUWmgh2iiZjkmb20y9dGt083FbGLNuWLkWd8WFM93dETaOj9WD0mbRK11THXyV61rjrwpBkx2NjCFeHX/JjUe7MzxAhm/7Kn9IFl9As5B++SiD97QxEBpcG0AJDoluXqVpZSIHgG6W5FXSYDgZ+/V8dmfSplF5Nj2cseD5kI=,iv:7l8wNfi9HWc8Ep1Y9bUkdJo+2UQVkTfqW0J3pfPxpNg=,tag:xS+vD73r6rDmeeAB4bstww==,type:str] sops: kms: [] gcp_kms: [] @@ -24,8 +25,8 @@ sops: QjBmYlNYWlFoWHd0ZFJkWE0xMkpvZzQKJwKap35S2pWGNOtBHe931dRqAQAczbWv /BUEtl900F8YLQCB1/myV0Dk5X9XDlww1yrzw/La3gXANY93Ndu3MA== -----END AGE ENCRYPTED FILE----- - lastmodified: "2022-12-24T23:32:14Z" - mac: ENC[AES256_GCM,data:H6fvAvgQCx/iXcLnId7KW5wQ/xMpW/IELg9saYOC6UBMngXNMAoneEgTtmo89Dbwvc2e1qo5fzkk7XacBTx6SNOq27gwPUyfsNKD/V+VPpJtAV+PH47CoR83pnS0uPbiyCAIJvp+bXBI9LNMBb6VrrqR7NqKva2BG528n6b3LUQ=,iv:9KyBPOKu4swk6IZCNt/xI9DKqeuwyG7z1aEXIXDxVvg=,tag:hIVSBQd/85C0+sEiCKGQ/w==,type:str] + lastmodified: "2023-07-24T14:30:13Z" + mac: ENC[AES256_GCM,data:UXYfO7Ezx6jhuElF4ncJ3qcm5e9S4dLnIJ6ieELzmwHZEAIf8HCeovJIuubv9UbQeXg3F+jQzUA7xP8cGcx4fh6WzaXZuq+i/GbF79HCbgtYb8KogC7C/nbi7aFgd6euM84txNpIFlBMmcOAaVAdO+9zM6AxaclPq0Am+I+eG2E=,iv:ObMNbl1fI0yFQraR56rxSxBzv++MMdNY6JOZtPqBl5U=,tag:Nu5GZqWutwWxxORWcfLlVQ==,type:str] pgp: - created_at: "2023-07-23T14:01:56Z" enc: |- diff --git a/secrets/shirley/secrets.yaml b/secrets/shirley/secrets.yaml index cb2a817..b8bb5a0 100644 --- a/secrets/shirley/secrets.yaml +++ b/secrets/shirley/secrets.yaml @@ -4,6 +4,7 @@ dokuwiki: keycloak_key: ENC[AES256_GCM,data:gXCRVg==,iv:BqBPRnD8mIQ97MHfn/KESqe8ABXGaDXEIAGyYcbfXlI=,tag:KhgQX5N3MATmnqXnEIjzBQ==,type:str] vaultwarden: env: ENC[AES256_GCM,data:4zeSpiaJQ8v00EBHrS6IU/1KXCEP6EBpkMacW0mf3ygZxSfUL3oQ11sXOu24OOMnTpaZUPJ68rj1jSNgBoVQ7rLttpCHKy62ART2xi0PcSCpDCBLpBocPdpFydQzwFOrMAYpcS6SB/ijy2ZxvfzVQqykcqfLdwdZs3PCys15OSQT269FmFERT25pTW7d6zxE3eY2YhLf1Y+6MjYHffAEv8RqN35UWyAOh8dJU09lbEsUiBRwN3tNhQ0STOsShhxY/ogMZdAHQwvGjo0=,iv:yK9PBOURtOVBBPwuJSpARvb5eXUIhPypEbEYbX2PqRs=,tag:MG7fcBPMg9eMjtD5V+yjBw==,type:str] +hedgedoc_env: ENC[AES256_GCM,data:M/UW8QjiiHU/YsSYsYnZbeA+SPAub53E1FAiSvRFTeQeR0d3+t0g0lfn9Wqcok541NjETs7LN4lCrYBR6cH4EqQ9581pj2Fi5KabypA/2DUNTaAjtCbA2RNM/M/1/ka5n8AFNgzXppb/yEQ2xqQfV7IN/d6ClJzfFi+3FoFa3wRwAajvkH+yP8rfTBkQFamQWTQ=,iv:6vOeJHkNnva92GCrhuIj3HtG6z50UBnxRGg97jv2/gk=,tag:eYN4q7/HL0BtPdYLlbaW+A==,type:str] sops: kms: [] gcp_kms: [] @@ -19,8 +20,8 @@ sops: Z3FXczZaSUVLY2lCcWJaQklXNHBzczAKQev4noy5ValCq65BhvXl1weY2QNsTe6f f4SUmm5NGbTiGaghOLC1Cio3K8ibA0vszVyySNE1khkvcM7JewIXAQ== -----END AGE ENCRYPTED FILE----- - lastmodified: "2022-12-30T21:13:58Z" - mac: ENC[AES256_GCM,data:hdQd5oQUBMdbjPqVsMd5sFIJOCq7GjcRPZ4trcT+MkZhYUyTkrHIk80XpVWUugsV4CXafq503gH5BnwMZaaYWtA53k4laIkKzuChXTSJ/D0TY1mX2+WxxMjrc5wPA2iWJwTS25O9pPA4y2tqonYXAG8jHAxDiNZmtdTKepJyaB8=,iv:H73rk9mNbsd+HoxDzcE+Cx5CmqFeuw3A9oQc5yxyMik=,tag:t4w1WozItK+QlIrs5wL8Mw==,type:str] + lastmodified: "2023-07-24T15:00:19Z" + mac: ENC[AES256_GCM,data:TqoMFF2XBc1iA/FnwgEwKdTKneHV6AvvPRVR+E7bkpqHQsxcl/wRLUzfQ5bg3YDviB/kB1KDuS25xQn/ztJKoBn7deWF0+9xz5npStQimNWuzgbTCIQS5hbqahgOejnnGVvJ/zms67ZOOG/Ek8W4eE8DUNMlUlNNIxGD8fkRwYI=,iv:FYW3K/QipSCrk0ZrxUhJANB5CBY4K5af4KhUf7GwuYU=,tag:HeLAe/yCZnDXqNHeUDpylQ==,type:str] pgp: - created_at: "2023-07-23T14:01:46Z" enc: |- diff --git a/services/hedgedoc.nix b/services/hedgedoc.nix new file mode 100644 index 0000000..c9dab9f --- /dev/null +++ b/services/hedgedoc.nix @@ -0,0 +1,79 @@ +{ config +, baseDomain +, lib +, ... +}: + +let + domain = "md.${baseDomain}"; + isDev = (builtins.substring 0 3 baseDomain) == "dev"; + realm = if isDev then "dev" else "chaos-jetzt"; + sso_url = "https://sso.chaos.jetzt/auth/realms/${realm}/protocol/openid-connect"; + sock_path = "/run/hedgedoc/hedgedoc.sock"; +in { + # Contains CMD_SESSION_SECRET and CMD_OAUTH2_CLIENT_SECRET + sops.secrets."hedgedoc_env" = {}; + + services.hedgedoc = { + enable = true; + environmentFile = config.sops.secrets.hedgedoc_env.path; + settings = { + inherit domain; + + allowAnonymousEdits = true; + allowEmailRegister = false; + allowFreeURL = true; + requireFreeURLAuthentication = false; + allowGravatar = false; + allowOrigin = [ domain ]; + db = { + dialect = "postgres"; + host = "/run/postgresql"; + }; + email = false; + path = sock_path; + protocolUseSSL = true; + oauth2 = { + baseURL = sso_url; + userProfileURL = "${sso_url}/userinfo"; + userProfileUsernameAttr = "preferred_username"; + userProfileDisplayNameAttr = "preferred_username"; + userProfileEmailAttr = "email"; + tokenURL = "${sso_url}/token"; + authorizationURL = "${sso_url}/auth"; + clientID = "hedgedoc"; + providerName = if isDev then "SSO (dev)" else "SSO"; + }; + useCDN = false; + logLevel = "warn"; + }; + }; + + services.nginx.virtualHosts."${domain}" = { + forceSSL = true; + enableACME = true; + locations."/" = { + proxyPass = "http://unix:${sock_path}"; + proxyWebsockets = true; + }; + }; + + + services.postgresql = { + enable = true; + ensureDatabases = [ "hedgedoc" ]; + ensureUsers = [{ + name = "hedgedoc"; + ensurePermissions."DATABASE hedgedoc" = "ALL PRIVILEGES"; + }]; + }; + + # Required for nginx to be able to access the hedgedoc socket + users.users.nginx.extraGroups = [ "hedgedoc" ]; + systemd.services.hedgedoc = { + serviceConfig = { + UMask = "0007"; + RuntimeDirectory = "hedgedoc"; + }; + }; +} From d7358ccdca5c1d8a508d9fbf297412c8f3ce2158 Mon Sep 17 00:00:00 2001 From: Moritz 'e1mo' Fromm Date: Sun, 13 Aug 2023 20:53:19 +0200 Subject: [PATCH 2/2] hedgedoc: Disable SSO and login for now --- services/hedgedoc.nix | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/services/hedgedoc.nix b/services/hedgedoc.nix index c9dab9f..945d24d 100644 --- a/services/hedgedoc.nix +++ b/services/hedgedoc.nix @@ -33,7 +33,9 @@ in { email = false; path = sock_path; protocolUseSSL = true; - oauth2 = { + # NOTE(@e1mo): Currently disabled until we decide if we want + # SSO but left in here as this is a known working config. + oauth2 = lib.mkIf false { baseURL = sso_url; userProfileURL = "${sso_url}/userinfo"; userProfileUsernameAttr = "preferred_username";