hosts/sakura/services/authelia.nix

@@ -1,59 +0,0 @@
-{config, ...}: {
-  networking.firewall.allowedTCPPorts = [9091];
-  sops.secrets.authelia-jwt = {owner = config.systemd.services.authelia-default.serviceConfig.User;};
-  sops.secrets.authelia-sek = {owner = config.systemd.services.authelia-default.serviceConfig.User;};
-  services.authelia.instances.default = {
-    enable = true;
-    secrets = {
-      jwtSecretFile = config.sops.secrets.authelia-jwt.path;
-      storageEncryptionKeyFile = config.sops.secrets.authelia-sek.path;
-    };
-    settings = {
-      log.level = "debug";
-      theme = "dark";
-      default_2fa_method = "totp";
-      default_redirection_url = "https://passport.notohh.dev/";
-      authentication_backend = {
-        file.path = "/etc/authelia/user.yml";
-      };
-      session = {
-        domain = "notohh.dev";
-        expiration = 3600;
-        inactivity = 300;
-      };
-      totp = {
-        issuer = "authelia.com";
-        disable = false;
-        algorithm = "sha1";
-        digits = 6;
-        period = 30;
-        skew = 1;
-        secret_size = 32;
-      };
-      server = {
-        host = "0.0.0.0";
-        port = 9091;
-      };
-      access_control = {
-        default_policy = "deny";
-        rules = [
-          {
-            domain = "notohh.dev";
-            policy = "bypass";
-          }
-        ];
-      };
-      regulation = {
-        max_retries = 3;
-        find_time = 120;
-        ban_time = 300;
-      };
-      notifier.filesystem = {
-        filename = "/var/lib/authelia-default/notif.txt";
-      };
-      storage.local = {
-        path = "/var/lib/authelia-default/db.sqlite3";
-      };
-    };
-  };
-}

hosts/sakura/services/default.nix

@@ -1,7 +1,6 @@
 {...}: {
   imports = [
     ./traefik.nix
-    ./authelia.nix
     ./hugo.nix
     ./foundryvtt.nix
     ./forgejo.nix

hosts/sakura/services/traefik.nix

@@ -1,6 +1,6 @@
 {config, ...}: {
   sops.secrets.cloudflare-api-key = {};
-  networking.firewall.allowedTCPPorts = [80 443 8080];
+  networking.firewall.allowedTCPPorts = [80 443];
   systemd.services.traefik = {
     environment = {
       CLOUDFLARE_EMAIL = "jch0tm2e@notohh.dev";
@@ -12,12 +12,6 @@
   services.traefik = {
     enable = true;
     dynamicConfigOptions = {
-      http.middlewares.authelia = {
-        forwardauth = {
-          address = "http://localhost:9091/api/verify?rd=https://passport.notohh.dev/";
-          trustForwardHeader = true;
-        };
-      };
       http = {
         routers = {
           api = {
@@ -40,20 +34,12 @@
             entrypoints = ["web"];
             service = "dashdot";
           };
-          authelia = {
-            rule = "Host(`passport.notohh.dev`)";
-            entrypoints = ["websecure"];
-            service = "authelia";
-            tls.domains = [{main = "*.notohh.dev";}];
-            tls.certresolver = "production";
-          };
           hugo = {
             rule = "Host(`notohh.dev`)";
-            entrypoints = ["websecure"];
+            entryPoints = ["websecure"];
             service = "hugo";
             tls.domains = [{main = "*.notohh.dev";}];
             tls.certresolver = "production";
-            middlewares = "authelia";
           };
           foundryvtt = {
             rule = "Host(`foundry.notohh.dev`)";
@@ -106,7 +92,6 @@
           };
         };
         services = {
-          authelia.loadBalancer.servers = [{url = "http://localhost:9091";}];
           dashdot.loadBalancer.servers = [{url = "http://localhost:4000";}];
           hugo.loadBalancer.servers = [{url = "http://localhost:1313";}];
           jellyfin.loadBalancer.servers = [{url = "http://localhost:8096";}];
@@ -138,11 +123,6 @@
           forwardedHeaders.insecure = true;
         };
       };
-      metrics = {
-        prometheus = {
-          addServicesLabels = true;
-        };
-      };
       certificatesResolvers = {
         staging.acme = {
           email = "x3xr6n66@notohh.dev";

secrets/secrets.yaml

@@ -7,9 +7,7 @@ woodpecker-server: ENC[AES256_GCM,data:elB9cO9bM3B4aRadcma42tz5TFdXRPN4RS71PDfqK
 woodpecker-agent-secret: ENC[AES256_GCM,data:Xfz8OEQqcqeb9zi531zhfitbDbfxtVAsf4JFmmqpAL9rMsQwRl8vWVp3m23yEl6F5f67+Bf26GAlPwWT8hVCAA==,iv:fCoBgR1L1niZaa/HCCfJTsrJvOrlGv0Fa7zcTL6s118=,tag:SOE/4MOp6tx+eTr4vrxxGA==,type:str]
 attic-secret: ENC[AES256_GCM,data:dHKfY7zNz5cH2pOiK6evuZv/WMt+VHhzeOB2E3kgcEvB7uCTcC1xRtyyCpCpsBZiTJg6RRHKPf0RO8pF3NIrKlTMQZvnzlTOW7baNlOXDPGrgTfH78/a3o+laVUeBozTIvvi8fkztJjUq3VcSPRkkdzo6OCwft70R3dbYmqPQ3vd,iv:MrJ55LJMBlGik0LW1Co99pHiK4JysoBJtJvW6Rgx4Bs=,tag:eW2kdbTJ7LQy8QlRr5NkTg==,type:str]
 gluetun: ENC[AES256_GCM,data:yL+LOPpwU+CAtbjc7YWbNUOTpDhq4mH3aJOl3hPYxgbFUba6NVJQ73mFt7BF+PXeqA/ilbZJW3GbCfAoXWLDP3qzFYqs9XeEV/FhHznkVHB88xdr+Fbv7cuCEa7PnnYbSiwr/R68EZLsGSr+u99+uu1TH6ABXG9nJna0bkwkTfx6ui/Yc2GndWS+Ew==,iv:rYdMasJS1LqMGvMYFyAdEkoTLtOHrZHGcfBOvbn63bg=,tag:YNcP/pvgKHPYNhAwVGdFHw==,type:str]
-miniflux: ENC[AES256_GCM,data:cEaquTD8Vr6pdAIK07QB/8OddXdRTf9SCD2yvzBi6De42sxYlbmwPTxzDu63R641JnoPRNIc,iv:RfQmmzPeHJOBFTYAEcHg0aRj+uugy4pIonR+m9BUws8=,tag:06EinGKF+MXO2K54Wjbdmw==,type:str]
+miniflux: ENC[AES256_GCM,data:Ug7i6US14DKf0WvCdk07oganRcepD6GbrX7fKKDYhfpoIsksZCWQPLNCxO+uBHm4xAf7e+bk,iv:biWn2ou2chR0gDJM0dEFbAojVHrM7BFvwZ/xtk9f4og=,tag:deFNV/lCNEz0F8yBwCnVyw==,type:str]
-authelia-jwt: ENC[AES256_GCM,data:cAn2uZeSGjG2FqTFgZkupcSutCZLvZXCNBsxuUQvGX4=,iv:1OTDQzQwaPTmnTEB4TfnxU6l8CdBAlHfqFThE8QZa6A=,tag:KJ6aYDczHFajhLJHemfIQw==,type:str]
-authelia-sek: ENC[AES256_GCM,data:yWhAvl1AuEcrUCFAv2vcz6A8BLEIMIz9sqbFRAriHpw=,iv:i887EZgqGtRfFs6mHHAJry0XfQzvrTaDliz8PRh7oLs=,tag:dmn2GSG8gZk9CVXMNmH1Dw==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -25,8 +23,8 @@ sops:
             YWNQcURKMSs2U0pOa3E0cTdCZ3RnalkKGayA7DBUQS+kn+6OYVBc6oTunF0qeZdt
             5b9DLHgh0HRWFm09XGSOog8K315d93Wzblw1My1/dXeEQX/ryinqUQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-06-19T20:34:23Z"
+    lastmodified: "2023-06-19T09:08:32Z"
-    mac: ENC[AES256_GCM,data:Loc5ydaxx63TE0uK7rfKLx3vl6BxNaTiTLrOYNUXVvtgGramkgnlM2gO5soHV1XetZEdNMljqenKZvVHGFmg8uhYAyRQjo1SbwcBMlqFFBhywxaQBm1kLF2Z8x6RDnXfFJCcA5ejafD/VAR4rUghj+FgLhe1OtBdr3XUOTiB99k=,iv:XyLv6WPgux4R5r4e8E9vDNEXjXxtfWu6iITGqcdcDz4=,tag:VP2sn/j90eFOOyV44ai8TQ==,type:str]
+    mac: ENC[AES256_GCM,data:0F4X7gdqDin1iXKB0iknrhYXPdw40uhEfgjSEdj47HhMHsQofDX/74jl6U3fGaAt7Gp8mhbqaE9ZdU2eYzU7kpX/zYExnEwEjwwzD/S5Qpovl6YbfQgZ1F1iGmohCZK1r8GXV5pnvzmqrJyZL1b8g0jSeC10CFGEqCCnaUjLe8Y=,iv:2/615IMcdghY0juFyGOEWILf+5ACNk/6BZoglU75fI4=,tag:Nup4fpsidj/Usxu6GKGp3w==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.7.3