From 98cb289a83617ed157d2d3b401bc4c019119b909 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20van=20Br=C3=BCgge?= Date: Wed, 25 Sep 2024 12:42:18 +0200 Subject: [PATCH 01/11] nixos/authentik: init module --- .../manual/release-notes/rl-2411.section.md | 2 + nixos/modules/module-list.nix | 1 + nixos/modules/services/security/authentik.nix | 235 ++++++++++++++++++ 3 files changed, 238 insertions(+) create mode 100644 nixos/modules/services/security/authentik.nix diff --git a/nixos/doc/manual/release-notes/rl-2411.section.md b/nixos/doc/manual/release-notes/rl-2411.section.md index 9155b8f04715b..a82718e36f78e 100644 --- a/nixos/doc/manual/release-notes/rl-2411.section.md +++ b/nixos/doc/manual/release-notes/rl-2411.section.md @@ -163,6 +163,8 @@ - [Veilid](https://veilid.com), a headless server that enables privacy-focused data sharing and messaging on a peer-to-peer network. Available as [services.veilid](#opt-services.veilid.enable). +- [authentik](https://github.com/goauthentik/authentik), a self-hosted identity provider. Available as [services.authentik](#opt-services.authentik.enable). + ## Backward Incompatibilities {#sec-release-24.11-incompatibilities} - The `sound` options have been removed or renamed, as they had a lot of unintended side effects. See [below](#sec-release-24.11-migration-sound) for details. diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index fe67d39e70f92..c84f450cf4119 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -1298,6 +1298,7 @@ ./services/search/typesense.nix ./services/security/aesmd.nix ./services/security/authelia.nix + ./services/security/authentik.nix ./services/security/bitwarden-directory-connector-cli.nix ./services/security/certmgr.nix ./services/security/cfssl.nix diff --git a/nixos/modules/services/security/authentik.nix b/nixos/modules/services/security/authentik.nix new file mode 100644 index 0000000000000..591fa688d485e --- /dev/null +++ b/nixos/modules/services/security/authentik.nix @@ -0,0 +1,235 @@ +{ + config, + lib, + pkgs, + ... +}: +let + inherit (lib) + mkIf + types + mkOption + mkEnableOption + mkPackageOption + ; + cfg = config.services.authentik; + + isRedisUnixSocket = lib.hasPrefix "/" cfg.redis.host; + + commonServiceConfig = { + Type = "simple"; + User = cfg.user; + Group = cfg.group; + Restart = "always"; + RestartSec = 3; + RuntimeDirectory = "authentik"; + NoNewPrivileges = true; + PrivateTmp = true; + ProtectHome = true; + ProtectSystem = "strict"; + ProtectKernelTunables = true; + ProtectKernelModules = true; + ProtectControlGroups = true; + SystemCallFilter = "~@cpu-emulation @keyring @module @obsolete @raw-io @reboot @swap @sync"; + ConfigurationDirectory = "authentik"; + }; +in +{ + options.services.authentik = { + enable = mkEnableOption "authentik"; + package = mkPackageOption pkgs "authentik" { }; + + secretsFile = mkOption { + type = types.nullOr ( + types.str + // { + # We don't want users to be able to pass a path literal here but + # it should look like a path. + check = it: lib.isString it && lib.types.path.check it; + } + ); + default = null; + example = "/run/secrets/authentik"; + description = '' + Path of a file with extra environment variables to be loaded from disk. + This file is not added to the nix store, so it can be used to pass secrets to authentik. + Refer to the [documentation](https://docs.goauthentik.io/docs/installation/configuration) for options. + + authentik requires at least a secret key: + ``` + AUTHENTIK_SECRET_KEY= + ``` + You can also use services.authentik.environment.AUTHENTIK_SECRET_KEY = 'file:///path/to/secret' instead + ''; + }; + environment = mkOption { + type = types.attrsOf types.str; + default = { }; + example = { + AUTHENTIK_LOG_LEVEL = "debug"; + }; + description = '' + Extra configuration environment variables. Refer to the [documentation](https://docs.goauthentik.io/docs/installation/configuration) for options. + ''; + }; + + host = lib.mkOption { + type = types.str; + default = "localhost"; + description = "The host that authentik will listen on."; + }; + httpPort = mkOption { + type = types.port; + default = 9000; + description = "The http port that authentik will listen on."; + }; + httpsPort = mkOption { + type = types.port; + default = 9443; + description = "The https port that authentik will listen on."; + }; + user = mkOption { + type = types.str; + default = "authentik"; + description = "The user authentik should run as."; + }; + group = mkOption { + type = types.str; + default = "authentik"; + description = "The group authentik should run as."; + }; + database = { + enable = + mkEnableOption "the postgresql database for use with authentik. See {option}`services.postgresql`" + // { + default = true; + }; + createDB = mkEnableOption "the automatic creation of the database for authentik." // { + default = true; + }; + name = mkOption { + type = types.str; + default = "authentik"; + description = "The name of the authentik database."; + }; + host = mkOption { + type = types.str; + default = "/run/postgresql"; + example = "127.0.0.1"; + description = "Hostname or address of the postgresql server. If an absolute path is given here, it will be interpreted as a unix socket path."; + }; + port = mkOption { + type = types.port; + default = 5432; + description = "The port of the postgresql server"; + }; + user = mkOption { + type = types.str; + default = "authentik"; + description = "The database user for authentik."; + }; + }; + redis = { + enable = mkEnableOption "a redis cache for use with authentik" // { + default = true; + }; + host = mkOption { + type = types.str; + default = config.services.redis.servers.authentik.unixSocket; + defaultText = lib.literalExpression "config.services.redis.servers.authentik.unixSocket"; + description = "The host that redis will listen on."; + }; + port = mkOption { + type = types.port; + default = 0; + description = "The port that redis will listen on. Set to zero to disable TCP."; + }; + }; + }; + + config = mkIf cfg.enable { + assertions = [ + { + assertion = cfg.database.createDB -> cfg.database.name == cfg.database.user; + message = "The postgres module requires the database name and the database user name to be the same."; + } + { + assertion = cfg.secretsFile == null -> lib.hasPrefix "file://" cfg.environment.AUTHENTIK_SECRET_KEY; + message = "If no secretsFile is provided, services.authentik.environment has to provide AUTHENTIK_SECRET_KEY with a file:// prefix"; + } + { + assertion = cfg.secretsFile != null -> !(cfg.environment ? "AUTHENTIK_SECRET_KEY"); + message = "Possibly conflicting AUTHENTIK_SECRET_KEY definition in secretsFile and services.authentik.environment"; + } + ]; + + systemd.services.authentik-server = { + description = "Authentik server component"; + after = [ "network-online.target" ]; + wantedBy = [ "multi-user.target" ]; + inherit (cfg) environment; + + serviceConfig = commonServiceConfig // { + ExecStart = "${lib.getExe cfg.package} server"; + EnvironmentFile = cfg.secretsFile; + }; + }; + + systemd.services.authentik-worker = { + description = "Authentik worker component"; + after = [ "network-online.target" ]; + wantedBy = [ "multi-user.target" ]; + inherit (cfg) environment; + + serviceConfig = commonServiceConfig // { + ExecStart = "${lib.getExe cfg.package} worker"; + EnvironmentFile = cfg.secretsFile; + }; + }; + + services.postgresql = mkIf cfg.database.enable { + enable = true; + ensureDatabases = mkIf cfg.database.createDB [ cfg.database.name ]; + ensureUsers = mkIf cfg.database.createDB [ + { + name = cfg.database.user; + ensureDBOwnership = true; + ensureClauses.login = true; + } + ]; + }; + + services.authentik.environment = { + AUTHENTIK_CACHE__URL = mkIf isRedisUnixSocket "unix://${cfg.redis.host}"; + AUTHENTIK_CHANNEL__URL = mkIf isRedisUnixSocket "unix://${cfg.redis.host}"; + AUTHENTIK_RESULT_BACKEND__URL = mkIf isRedisUnixSocket "redis+socket://${cfg.redis.host}"; + AUTHENTIK_BROKER__URL = mkIf isRedisUnixSocket "redis+socket://${cfg.redis.host}"; + AUTHENTIK_REDIS__HOST = mkIf (!isRedisUnixSocket) cfg.redis.host; + AUTHENTIK_REDIS__PORT = mkIf (!isRedisUnixSocket) (toString cfg.redis.port); + AUTHENTIK_POSTGRESQL__HOST = cfg.database.host; + AUTHENTIK_POSTGRESQL__NAME = cfg.database.name; + AUTHENTIK_POSTGRESQL__USER = cfg.database.user; + AUTHENTIK_POSTGRESQL__PORT = toString cfg.database.port; + AUTHENTIK_LISTEN_HTTP = "${cfg.host}:${toString cfg.httpPort}"; + AUTHENTIK_LISTEN_HTTPS = "${cfg.host}:${toString cfg.httpsPort}"; + }; + + services.redis.servers = mkIf cfg.redis.enable { + authentik = { + enable = true; + user = cfg.user; + port = cfg.redis.port; + bind = mkIf (!isRedisUnixSocket) cfg.redis.host; + }; + }; + + users.users = mkIf (cfg.user == "authentik") { + authentik = { + name = "authentik"; + group = cfg.group; + isSystemUser = true; + }; + }; + users.groups = mkIf (cfg.group == "authentik") { authentik = { }; }; + }; +} From deff7f841d913a2e5fc52ace39761741be6edaf0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20van=20Br=C3=BCgge?= Date: Wed, 25 Sep 2024 12:44:50 +0200 Subject: [PATCH 02/11] nixos/tests/authentik: init tests --- nixos/tests/all-tests.nix | 1 + nixos/tests/web-apps/authentik.nix | 27 +++++++++++++++++++++++++++ 2 files changed, 28 insertions(+) create mode 100644 nixos/tests/web-apps/authentik.nix diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index af9d79f649bd5..40361862bccaa 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -140,6 +140,7 @@ in { audiobookshelf = handleTest ./audiobookshelf.nix {}; auth-mysql = handleTest ./auth-mysql.nix {}; authelia = handleTest ./authelia.nix {}; + authentik = handleTest ./web-apps/authentik.nix {}; avahi = handleTest ./avahi.nix {}; avahi-with-resolved = handleTest ./avahi.nix { networkd = true; }; ayatana-indicators = runTest ./ayatana-indicators.nix; diff --git a/nixos/tests/web-apps/authentik.nix b/nixos/tests/web-apps/authentik.nix new file mode 100644 index 0000000000000..f3c49a3c101a8 --- /dev/null +++ b/nixos/tests/web-apps/authentik.nix @@ -0,0 +1,27 @@ +import ../make-test-python.nix ( + { ... }: + { + name = "authentik-nixos"; + + nodes.machine = + { pkgs, ... }: + { + environment.systemPackages = with pkgs; [ openssl ]; + + services.authentik = { + enable = true; + secretsFile = "/run/secrets/authentik"; + environment.AUTHENTIK_LOG_LEVEL = "debug"; + }; + }; + + testScript = '' + machine.succeed("mkdir -p /run/secrets ; echo \"AUTHENTIK_SECRET_KEY=$(openssl rand -base64 60 | tr -d '\n')\" > /run/secrets/authentik ; echo \"AUTHENTIK_BOOTSTRAP_PASSWORD=admin\" >> /run/secrets/authentik") + + machine.wait_for_unit("authentik-server.service") + + machine.wait_for_open_port(9000) + machine.wait_until_succeeds("curl --fail http://localhost:9000/api/v3/root/config", 100) + ''; + } +) From b51db438ce90e6be9a0387a7df147bba3579d1b7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20van=20Br=C3=BCgge?= Date: Wed, 2 Oct 2024 14:40:57 +0100 Subject: [PATCH 03/11] python3Packages.scim2-filter-parser: 0.5.0 -> 0.7.0 --- .../python-modules/scim2-filter-parser/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/scim2-filter-parser/default.nix b/pkgs/development/python-modules/scim2-filter-parser/default.nix index 2ddf986971858..2e50a85a70e2e 100644 --- a/pkgs/development/python-modules/scim2-filter-parser/default.nix +++ b/pkgs/development/python-modules/scim2-filter-parser/default.nix @@ -12,14 +12,14 @@ buildPythonPackage rec { pname = "scim2-filter-parser"; - version = "0.5.0"; + version = "0.7.0"; format = "pyproject"; src = fetchFromGitHub { owner = "15five"; repo = pname; rev = "refs/tags/${version}"; - hash = "sha256-QEPTYpWlRPWO6Evyt4zoqUST4ousF67GmiOpD7WUqcI="; + hash = "sha256-KmtOtI/5HT0lVwvXQFTlEwMeptoa4cA5hTSgSULxhIc="; }; patches = [ From 4c2851f715935345ad8f0bd4256338ba5ea51054 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20van=20Br=C3=BCgge?= Date: Wed, 2 Oct 2024 15:29:39 +0100 Subject: [PATCH 04/11] python3Packages.drf-orjson-renderer: init at 1.7.3 --- .../drf-orjson-renderer/default.nix | 38 +++++++++++++++++++ pkgs/top-level/python-packages.nix | 2 + 2 files changed, 40 insertions(+) create mode 100644 pkgs/development/python-modules/drf-orjson-renderer/default.nix diff --git a/pkgs/development/python-modules/drf-orjson-renderer/default.nix b/pkgs/development/python-modules/drf-orjson-renderer/default.nix new file mode 100644 index 0000000000000..a126bb6fc1f1b --- /dev/null +++ b/pkgs/development/python-modules/drf-orjson-renderer/default.nix @@ -0,0 +1,38 @@ +{ + lib, + buildPythonPackage, + fetchzip, + setuptools, + django, + djangorestframework, + orjson, +}: + +buildPythonPackage { + pname = "drf-orjson-renderer"; + version = "1.7.3"; + pyproject = true; + + src = fetchzip { + url = "https://files.pythonhosted.org/packages/4d/3e/5cc16467d91087bf883cdbeb52a06f3a6fa59563ad09b9b84bac72d68716/drf_orjson_renderer-1.7.3.tar.gz"; + hash = "sha256-KOR5GW30Oj8f6houoLHnTi4ZJt9n6o1a66CcApfCTJ4="; + }; + + build-system = [ setuptools ]; + + doCheck = false; # Tests are broken upstream (https://github.com/brianjbuck/drf_orjson_renderer/pull/26) + dependencies = [ + django + djangorestframework + orjson + ]; + + pythonImportsCheck = [ "drf_orjson_renderer" ]; + + meta = { + description = "JSON renderer and parser for Django Rest Framework using the orjson library"; + homepage = "https://github.com/brianjbuck/drf_orjson_renderer"; + license = lib.licenses.mit; + maintainers = with lib.maintainers; [ jvanbruegge ]; + }; +} diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index c1800dfbba93b..ea104e007bbbb 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -3726,6 +3726,8 @@ self: super: with self; { drf-nested-routers = callPackage ../development/python-modules/drf-nested-routers { }; + drf-orjson-renderer = callPackage ../development/python-modules/drf-orjson-renderer { }; + drf-spectacular = callPackage ../development/python-modules/drf-spectacular { }; drf-spectacular-sidecar = callPackage ../development/python-modules/drf-spectacular-sidecar { }; From 7746b5817c99f8f7ca094f15c43cc452a76fa36f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20van=20Br=C3=BCgge?= Date: Tue, 1 Oct 2024 16:27:33 +0100 Subject: [PATCH 05/11] authentik,authentik.outposts.{ldap,radius}: 2024.6.4 -> 2024.8.3 --- pkgs/by-name/au/authentik/ldap.nix | 9 ++-- pkgs/by-name/au/authentik/outposts.nix | 7 +-- pkgs/by-name/au/authentik/package.nix | 69 +++++++------------------- pkgs/by-name/au/authentik/radius.nix | 9 ++-- 4 files changed, 34 insertions(+), 60 deletions(-) diff --git a/pkgs/by-name/au/authentik/ldap.nix b/pkgs/by-name/au/authentik/ldap.nix index 278ea195e04c8..f9f515b5d20fb 100644 --- a/pkgs/by-name/au/authentik/ldap.nix +++ b/pkgs/by-name/au/authentik/ldap.nix @@ -1,10 +1,13 @@ -{ buildGoModule, authentik }: +{ + buildGo123Module, + authentik, +}: -buildGoModule { +buildGo123Module { pname = "authentik-ldap-outpost"; inherit (authentik) version src; - vendorHash = "sha256-BcL9QAc2jJqoPaQImJIFtCiu176nxmVcCLPjXjNBwqI="; + vendorHash = "sha256-xaVEyG5fNGh/zmXkewve5V2q2W7u+hqo27GqabAV9H0="; CGO_ENABLED = 0; diff --git a/pkgs/by-name/au/authentik/outposts.nix b/pkgs/by-name/au/authentik/outposts.nix index c10ace799611b..1757d4c22b211 100644 --- a/pkgs/by-name/au/authentik/outposts.nix +++ b/pkgs/by-name/au/authentik/outposts.nix @@ -1,4 +1,5 @@ -{ callPackage }: { - ldap = callPackage ./ldap.nix { }; - radius = callPackage ./radius.nix { }; +{ callPackage, authentik }: +{ + ldap = callPackage ./ldap.nix { inherit authentik; }; + radius = callPackage ./radius.nix { inherit authentik; }; } diff --git a/pkgs/by-name/au/authentik/package.nix b/pkgs/by-name/au/authentik/package.nix index 74511b866a381..6410d3a2f13b6 100644 --- a/pkgs/by-name/au/authentik/package.nix +++ b/pkgs/by-name/au/authentik/package.nix @@ -2,25 +2,22 @@ , stdenvNoCC , callPackages , fetchFromGitHub -, fetchpatch -, fetchzip , buildNpmPackage -, buildGoModule +, buildGo123Module , runCommand , openapi-generator-cli , nodejs , python312 -, codespell , makeWrapper }: let - version = "2024.6.4"; + version = "2024.8.3"; src = fetchFromGitHub { owner = "goauthentik"; repo = "authentik"; rev = "version/${version}"; - hash = "sha256-QwK/auMLCJEHHtyexFnO+adCq/u0fezHQ90fXW9J4c4="; + hash = "sha256-AlIzFSVfXBuvHkrlFqIBhcRohax5XFXvz/9ULelE8tw="; }; meta = with lib; { @@ -35,13 +32,14 @@ let website = buildNpmPackage { pname = "authentik-website"; inherit version src meta; - npmDepsHash = "sha256-JM+ae+zDsMdvovd2p4IJIH89KlMeDU7HOZjFbDCyehw="; + npmDepsHash = "sha256-Zp0V/G/XYFTOvZ5meNjohGg6sqq2slGW2Z4gMHirOrU="; NODE_ENV = "production"; NODE_OPTIONS = "--openssl-legacy-provider"; postPatch = '' cd website + substituteInPlace package.json --replace-fail 'cross-env ' "" ''; installPhase = '' @@ -87,7 +85,7 @@ let ln -s ${src}/website $out/ ln -s ${clientapi} $out/web/node_modules/@goauthentik/api ''; - npmDepsHash = "sha256-8TzB3ylZzVLePD86of8E/lGgIQCciWMQF9m1Iqv9ZTY="; + npmDepsHash = "sha256-Apd/jdSH/B9woYABtvk3qrfBE7n8xlDWXRc80sJ/lzg="; postPatch = '' cd web @@ -150,7 +148,7 @@ let repo = pname; rev = version; hash = "sha256-VwH7fwLcoH2Z9D/OY9iieM0cRhyDKOpAzqQ+4YVE3vU="; - }; + }; nativeBuildInputs = with prev; [ poetry-core ]; @@ -162,12 +160,12 @@ let django-pglock = prev.buildPythonPackage rec { pname = "django-pglock"; - version = "1.5.1"; + version = "1.6.0"; src = fetchFromGitHub { owner = "Opus10"; repo = pname; rev = version; - hash = "sha256-ZoEHDkGmrcNiMe/rbwXsEPZo3LD93cZp6zjftMKjLeg="; + hash = "sha256-KCB00W3sUyEERgK/DfDPl051uFkc0IRdbOJusUVs5SA="; }; nativeBuildInputs = with prev; [ poetry-core @@ -232,42 +230,11 @@ let ]; }; - scim2-filter-parser = prev.buildPythonPackage rec { - pname = "scim2-filter-parser"; - version = "0.5.1"; - # For some reason the normal fetchPypi does not work - src = fetchzip { - url = "https://files.pythonhosted.org/packages/54/df/ad9718acce76e81a93c57327356eecd23701625f240fbe03d305250399e6/scim2_filter_parser-0.5.1.tar.gz"; - hash = "sha256-DZAdRj6qyySggsvJZC47vdvXbHrB1ra3qiYBEUiceJ4="; - }; - - postPatch = '' - substituteInPlace pyproject.toml \ - --replace-fail 'poetry>=0.12' 'poetry-core>=1.0.0' \ - --replace-fail 'poetry.masonry.api' 'poetry.core.masonry.api' - ''; - - nativeBuildInputs = [ prev.poetry-core ]; - pyproject = true; - - propagatedBuildInputs = with final; [ - sly - ]; - }; - authentik-django = prev.buildPythonPackage { pname = "authentik-django"; inherit version src meta; pyproject = true; - patches = [ - (fetchpatch { - name = "scim-schema-load.patch"; - url = "https://github.com/goauthentik/authentik/commit/f3640bd3c0ee2f43efcfd506bb71d2b7b6761017.patch"; - hash = "sha256-4AC7Dc4TM7ok964ztc+XdHvoU/DKyi9yJoz5u1dljEM="; - }) - ]; - postPatch = '' rm lifecycle/system_migrations/tenant_files.py substituteInPlace authentik/root/settings.py \ @@ -289,12 +256,12 @@ let celery channels channels-redis - codespell - colorama + cryptography dacite deepmerge defusedxml django + django-countries django-cte django-filter django-guardian @@ -307,9 +274,9 @@ let djangorestframework djangorestframework-guardian2 docker + drf-orjson-renderer drf-spectacular duo-client - facebook-sdk fido2 flower geoip2 @@ -327,6 +294,7 @@ let pydantic pydantic-scim pyjwt + pyrad pyyaml requests-oauthlib scim2-filter-parser @@ -337,7 +305,6 @@ let swagger-spec-validator tenant-schemas-celery twilio - twisted ua-parser urllib3 uvicorn @@ -368,7 +335,7 @@ let inherit (python.pkgs) authentik-django; - proxy = buildGoModule { + proxy = buildGo123Module { pname = "authentik-proxy"; inherit version src meta; @@ -383,7 +350,7 @@ let CGO_ENABLED = 0; - vendorHash = "sha256-BcL9QAc2jJqoPaQImJIFtCiu176nxmVcCLPjXjNBwqI="; + vendorHash = "sha256-xaVEyG5fNGh/zmXkewve5V2q2W7u+hqo27GqabAV9H0="; postInstall = '' mv $out/bin/server $out/bin/authentik @@ -392,7 +359,7 @@ let subPackages = [ "cmd/server" ]; }; -in stdenvNoCC.mkDerivation { +in stdenvNoCC.mkDerivation (final: { pname = "authentik"; inherit src version; @@ -419,11 +386,11 @@ in stdenvNoCC.mkDerivation { runHook postInstall ''; - passthru.outposts = callPackages ./outposts.nix { }; + passthru.outposts = callPackages ./outposts.nix { authentik = final; }; nativeBuildInputs = [ makeWrapper ]; meta = meta // { mainProgram = "ak"; }; -} +}) diff --git a/pkgs/by-name/au/authentik/radius.nix b/pkgs/by-name/au/authentik/radius.nix index 1a26c661ef07e..f4adc8b2b7396 100644 --- a/pkgs/by-name/au/authentik/radius.nix +++ b/pkgs/by-name/au/authentik/radius.nix @@ -1,10 +1,13 @@ -{ buildGoModule, authentik }: +{ + buildGo123Module, + authentik, +}: -buildGoModule { +buildGo123Module { pname = "authentik-radius-outpost"; inherit (authentik) version src; - vendorHash = "sha256-BcL9QAc2jJqoPaQImJIFtCiu176nxmVcCLPjXjNBwqI="; + vendorHash = "sha256-xaVEyG5fNGh/zmXkewve5V2q2W7u+hqo27GqabAV9H0="; CGO_ENABLED = 0; From 697e7c67db6aeb65bac8dddde9dd3a0bd3649a32 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20van=20Br=C3=BCgge?= Date: Thu, 3 Oct 2024 15:15:50 +0100 Subject: [PATCH 06/11] authentik.outposts.proxy: init at 2024.8.3 --- pkgs/by-name/au/authentik/outposts.nix | 1 + pkgs/by-name/au/authentik/proxy.nix | 21 +++++++++++++++++++++ 2 files changed, 22 insertions(+) create mode 100644 pkgs/by-name/au/authentik/proxy.nix diff --git a/pkgs/by-name/au/authentik/outposts.nix b/pkgs/by-name/au/authentik/outposts.nix index 1757d4c22b211..2f6a2c07e7410 100644 --- a/pkgs/by-name/au/authentik/outposts.nix +++ b/pkgs/by-name/au/authentik/outposts.nix @@ -2,4 +2,5 @@ { ldap = callPackage ./ldap.nix { inherit authentik; }; radius = callPackage ./radius.nix { inherit authentik; }; + proxy = callPackage ./proxy.nix { inherit authentik; }; } diff --git a/pkgs/by-name/au/authentik/proxy.nix b/pkgs/by-name/au/authentik/proxy.nix new file mode 100644 index 0000000000000..c5f0ed9217853 --- /dev/null +++ b/pkgs/by-name/au/authentik/proxy.nix @@ -0,0 +1,21 @@ +{ + buildGo123Module, + authentik, +}: + +buildGo123Module { + pname = "authentik-proxy-outpost"; + inherit (authentik) version src; + + vendorHash = "sha256-xaVEyG5fNGh/zmXkewve5V2q2W7u+hqo27GqabAV9H0="; + + CGO_ENABLED = 0; + + subPackages = [ "cmd/proxy" ]; + + meta = authentik.meta // { + description = "Authentik proxy outpost which is used for HTTP reverse proxy authentication"; + homepage = "https://goauthentik.io/docs/providers/proxy/"; + mainProgram = "proxy"; + }; +} From ca15b55992457993e410984fe79ea6b7de607848 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20van=20Br=C3=BCgge?= Date: Wed, 2 Oct 2024 14:49:06 +0100 Subject: [PATCH 07/11] python3Packages.django-cte: move out of authentik Co-authored-by: jopejoe1 --- pkgs/by-name/au/authentik/package.nix | 13 ---- .../python-modules/django-cte/default.nix | 63 +++++++++++++++++++ pkgs/top-level/python-packages.nix | 2 + 3 files changed, 65 insertions(+), 13 deletions(-) create mode 100644 pkgs/development/python-modules/django-cte/default.nix diff --git a/pkgs/by-name/au/authentik/package.nix b/pkgs/by-name/au/authentik/package.nix index 6410d3a2f13b6..6811c3bc2277c 100644 --- a/pkgs/by-name/au/authentik/package.nix +++ b/pkgs/by-name/au/authentik/package.nix @@ -127,19 +127,6 @@ let ]; }; - django-cte = prev.buildPythonPackage rec { - pname = "django-cte"; - version = "1.3.3"; - src = fetchFromGitHub { - owner = "dimagi"; - repo = pname; - rev = "v${version}"; - hash = "sha256-OCENg94xHBeeE4A2838Cu3q2am2im2X4SkFSjc6DuhE="; - }; - doCheck = false; # Tests require postgres - format = "setuptools"; - }; - django-pgactivity = prev.buildPythonPackage rec { pname = "django-pgactivity"; version = "1.4.1"; diff --git a/pkgs/development/python-modules/django-cte/default.nix b/pkgs/development/python-modules/django-cte/default.nix new file mode 100644 index 0000000000000..6e84be494f0c6 --- /dev/null +++ b/pkgs/development/python-modules/django-cte/default.nix @@ -0,0 +1,63 @@ +{ + lib, + buildPythonPackage, + fetchFromGitHub, + pytestCheckHook, + setuptools, + django, +}: + +buildPythonPackage rec { + pname = "django-cte"; + version = "1.3.3"; + pyproject = true; + + src = fetchFromGitHub { + owner = "dimagi"; + repo = "django-cte"; + rev = "refs/tags/v${version}"; + hash = "sha256-OCENg94xHBeeE4A2838Cu3q2am2im2X4SkFSjc6DuhE="; + }; + + build-system = [ setuptools ]; + + dependencies = [ django ]; + + nativeCheckInputs = [ pytestCheckHook ]; + + disabledTests = [ + # Require Database connection + "test_cte_queryset" + "test_experimental_left_outer_join" + "test_explain" + "test_left_outer_join_on_empty_result_set_cte" + "test_named_ctes" + "test_named_simple_ctes" + "test_non_cte_subquery" + "test_outerref_in_cte_query" + "test_simple_cte_query" + "test_update_cte_query" + "test_update_with_subquery" + "test_heterogeneous_filter_in_cte" + "test_raw_cte_sql" + "test_alias_as_subquery" + "test_alias_change_in_annotation" + "test_attname_should_not_mask_col_name" + "test_pickle_recursive_cte_queryset" + "test_recursive_cte_query" + "test_recursive_cte_reference_in_condition" + "test_union_with_first" + "test_union_with_select_related_and_first" + "test_union_with_select_related_and_order" + ]; + + pythonImportsCheck = [ "django_cte" ]; + + meta = { + description = "Common Table Expressions (CTE) for Django"; + homepage = "https://github.com/dimagi/django-cte"; + changelog = "https://github.com/dimagi/django-cte/blob/v${version}/CHANGELOG.md"; + license = lib.licenses.bsd3; + maintainers = with lib.maintainers; [ jopejoe1 ]; + }; +} diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index ea104e007bbbb..aa0c1542ee2ff 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -3354,6 +3354,8 @@ self: super: with self; { django-csp = callPackage ../development/python-modules/django-csp { }; + django-cte = callPackage ../development/python-modules/django-cte { }; + django-currentuser = callPackage ../development/python-modules/django-currentuser { }; django-debug-toolbar = callPackage ../development/python-modules/django-debug-toolbar { }; From 6aa43f22f88e0a56b251036abf97e257ec066b51 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20van=20Br=C3=BCgge?= Date: Wed, 2 Oct 2024 14:58:38 +0100 Subject: [PATCH 08/11] python3Packages.django-tenants: move out of authentik Co-authored-by: jopejoe1 --- pkgs/by-name/au/authentik/package.nix | 13 +----- .../python-modules/django-tenants/default.nix | 40 +++++++++++++++++++ pkgs/top-level/python-packages.nix | 2 + 3 files changed, 44 insertions(+), 11 deletions(-) create mode 100644 pkgs/development/python-modules/django-tenants/default.nix diff --git a/pkgs/by-name/au/authentik/package.nix b/pkgs/by-name/au/authentik/package.nix index 6811c3bc2277c..4530f39b0d354 100644 --- a/pkgs/by-name/au/authentik/package.nix +++ b/pkgs/by-name/au/authentik/package.nix @@ -108,23 +108,14 @@ let python = python312.override { self = python; packageOverrides = final: prev: { - django-tenants = prev.buildPythonPackage rec { - pname = "django-tenants"; + django-tenants = prev.django-tenants.overrideAttrs { version = "unstable-2024-01-11"; src = fetchFromGitHub { owner = "rissson"; - repo = pname; + repo = "django-tenants"; rev = "a7f37c53f62f355a00142473ff1e3451bb794eca"; hash = "sha256-YBT0kcCfETXZe0j7/f1YipNIuRrcppRVh1ecFS3cvNo="; }; - format = "setuptools"; - doCheck = false; # Tests require postgres - - propagatedBuildInputs = with final; [ - django - psycopg - gunicorn - ]; }; django-pgactivity = prev.buildPythonPackage rec { diff --git a/pkgs/development/python-modules/django-tenants/default.nix b/pkgs/development/python-modules/django-tenants/default.nix new file mode 100644 index 0000000000000..7fa53e9670d6d --- /dev/null +++ b/pkgs/development/python-modules/django-tenants/default.nix @@ -0,0 +1,40 @@ +{ + lib, + buildPythonPackage, + fetchFromGitHub, + setuptools, + django, + psycopg, +}: + +buildPythonPackage rec { + pname = "django-tenants"; + version = "3.7.0"; + pyproject = true; + + src = fetchFromGitHub { + owner = "django-tenants"; + repo = "django-tenants"; + rev = "refs/tags/v${version}"; + hash = "sha256-QdEONKVFW/DWBjXWRTG+ahvirw9BP8M6PztUMZGZ33Q="; + }; + + build-system = [ setuptools ]; + + dependencies = [ + django + psycopg + ]; + + doCheck = false; # Tests require postgres + + pythonImportsCheck = [ "django_tenants" ]; + + meta = { + description = "Django tenants using PostgreSQL Schemas"; + homepage = "https://github.com/django-tenants/django-tenants"; + changelog = "https://github.com/django-tenants/django-tenants/releases/tag/v${version}"; + license = lib.licenses.mit; + maintainers = with lib.maintainers; [ jopejoe1 ]; + }; +} diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index aa0c1542ee2ff..6d82db2eac662 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -3546,6 +3546,8 @@ self: super: with self; { django-tastypie = callPackage ../development/python-modules/django-tastypie { }; + django-tenants = callPackage ../development/python-modules/django-tenants { }; + django-timezone-field = callPackage ../development/python-modules/django-timezone-field { }; django-treebeard = callPackage ../development/python-modules/django-treebeard { }; From 36da7cfec47abbfcf3e61f52125277d2b84e5b0a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20van=20Br=C3=BCgge?= Date: Wed, 2 Oct 2024 15:02:57 +0100 Subject: [PATCH 09/11] python3Packages.django-pgactivity: move out of authentik Co-authored-by: jopejoe1 --- pkgs/by-name/au/authentik/package.nix | 18 --------- .../django-pgactivity/default.nix | 40 +++++++++++++++++++ pkgs/top-level/python-packages.nix | 2 + 3 files changed, 42 insertions(+), 18 deletions(-) create mode 100644 pkgs/development/python-modules/django-pgactivity/default.nix diff --git a/pkgs/by-name/au/authentik/package.nix b/pkgs/by-name/au/authentik/package.nix index 4530f39b0d354..cf4fde7c24e94 100644 --- a/pkgs/by-name/au/authentik/package.nix +++ b/pkgs/by-name/au/authentik/package.nix @@ -118,24 +118,6 @@ let }; }; - django-pgactivity = prev.buildPythonPackage rec { - pname = "django-pgactivity"; - version = "1.4.1"; - src = fetchFromGitHub { - owner = "Opus10"; - repo = pname; - rev = version; - hash = "sha256-VwH7fwLcoH2Z9D/OY9iieM0cRhyDKOpAzqQ+4YVE3vU="; - }; - nativeBuildInputs = with prev; [ - poetry-core - ]; - propagatedBuildInputs = with final; [ - django - ]; - pyproject = true; - }; - django-pglock = prev.buildPythonPackage rec { pname = "django-pglock"; version = "1.6.0"; diff --git a/pkgs/development/python-modules/django-pgactivity/default.nix b/pkgs/development/python-modules/django-pgactivity/default.nix new file mode 100644 index 0000000000000..1661fd0c27147 --- /dev/null +++ b/pkgs/development/python-modules/django-pgactivity/default.nix @@ -0,0 +1,40 @@ +{ + lib, + buildPythonPackage, + fetchFromGitHub, + poetry-core, + django, + psycopg, +}: + +buildPythonPackage rec { + pname = "django-pgactivity"; + version = "1.5.0"; + pyproject = true; + + src = fetchFromGitHub { + owner = "Opus10"; + repo = "django-pgactivity"; + rev = "refs/tags/${version}"; + hash = "sha256-jOpm/vYy3Ubi+NfvARH19ozZMUgyGD/ZztqxKNvAoLQ="; + }; + + build-system = [ poetry-core ]; + + dependencies = [ + django + psycopg + ]; + + doCheck = false; # Test require postgres + + pythonImportsCheck = [ "pgactivity" ]; + + meta = { + description = "View, filter, and kill Postgres queries"; + homepage = "https://github.com/Opus10/django-pgactivity"; + changelog = "https://github.com/Opus10/django-pgactivity/blob/${version}/CHANGELOG.md"; + license = lib.licenses.bsd3; + maintainers = with lib.maintainers; [ jopejoe1 ]; + }; +} diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index 6d82db2eac662..d57808462d321 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -3452,6 +3452,8 @@ self: super: with self; { django-payments = callPackage ../development/python-modules/django-payments { }; + django-pgactivity = callPackage ../development/python-modules/django-pgactivity { }; + django-pglocks = callPackage ../development/python-modules/django-pglocks { }; django-phonenumber-field = callPackage ../development/python-modules/django-phonenumber-field { }; From dde311043b2f0ec64a74e4156d1e7766ee15b609 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20van=20Br=C3=BCgge?= Date: Wed, 2 Oct 2024 15:07:15 +0100 Subject: [PATCH 10/11] python3Packages.django-pglock: move out of authentik Co-authored-by: jopejoe1 --- pkgs/by-name/au/authentik/package.nix | 19 --------- .../python-modules/django-pglock/default.nix | 40 +++++++++++++++++++ pkgs/top-level/python-packages.nix | 2 + 3 files changed, 42 insertions(+), 19 deletions(-) create mode 100644 pkgs/development/python-modules/django-pglock/default.nix diff --git a/pkgs/by-name/au/authentik/package.nix b/pkgs/by-name/au/authentik/package.nix index cf4fde7c24e94..8a9621b6d077e 100644 --- a/pkgs/by-name/au/authentik/package.nix +++ b/pkgs/by-name/au/authentik/package.nix @@ -118,25 +118,6 @@ let }; }; - django-pglock = prev.buildPythonPackage rec { - pname = "django-pglock"; - version = "1.6.0"; - src = fetchFromGitHub { - owner = "Opus10"; - repo = pname; - rev = version; - hash = "sha256-KCB00W3sUyEERgK/DfDPl051uFkc0IRdbOJusUVs5SA="; - }; - nativeBuildInputs = with prev; [ - poetry-core - ]; - propagatedBuildInputs = with final; [ - django - django-pgactivity - ]; - pyproject = true; - }; - # Use 3.14.0 until https://github.com/encode/django-rest-framework/issues/9358 is fixed. # Otherwise applying blueprints/default/default-brand.yaml fails with: # authentik.flows.models.RelatedObjectDoesNotExist: FlowStageBinding has no target. diff --git a/pkgs/development/python-modules/django-pglock/default.nix b/pkgs/development/python-modules/django-pglock/default.nix new file mode 100644 index 0000000000000..a6b8e11d0f76d --- /dev/null +++ b/pkgs/development/python-modules/django-pglock/default.nix @@ -0,0 +1,40 @@ +{ + lib, + buildPythonPackage, + fetchFromGitHub, + poetry-core, + django, + django-pgactivity, +}: + +buildPythonPackage rec { + pname = "django-pglock"; + version = "1.6.0"; + pyproject = true; + + src = fetchFromGitHub { + owner = "Opus10"; + repo = "django-pglock"; + rev = "refs/tags/${version}"; + hash = "sha256-KCB00W3sUyEERgK/DfDPl051uFkc0IRdbOJusUVs5SA="; + }; + + build-system = [ poetry-core ]; + + doCheck = false; # Tests require postgres + + dependencies = [ + django + django-pgactivity + ]; + + pythonImportsCheck = [ "pglock" ]; + + meta = { + description = "Postgres advisory locks, table locks, and blocking lock management"; + homepage = "https://github.com/Opus10/django-pglock"; + changelog = "https://github.com/Opus10/django-pglock/blob/${version}/CHANGELOG.md"; + license = lib.licenses.bsd3; + maintainers = with lib.maintainers; [ jopejoe1 ]; + }; +} diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index d57808462d321..997d7d8cb9ea5 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -3454,6 +3454,8 @@ self: super: with self; { django-pgactivity = callPackage ../development/python-modules/django-pgactivity { }; + django-pglock = callPackage ../development/python-modules/django-pglock { }; + django-pglocks = callPackage ../development/python-modules/django-pglocks { }; django-phonenumber-field = callPackage ../development/python-modules/django-phonenumber-field { }; From 482a30b4527d643a32439fc24b350d3776a031d6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20van=20Br=C3=BCgge?= Date: Wed, 2 Oct 2024 15:10:54 +0100 Subject: [PATCH 11/11] python3Packages.tenant-schemas-celery: move out of authentik Co-authored-by: jopejoe1 --- pkgs/by-name/au/authentik/package.nix | 19 ---------- .../tenant-schemas-celery/default.nix | 36 +++++++++++++++++++ pkgs/top-level/python-packages.nix | 2 ++ 3 files changed, 38 insertions(+), 19 deletions(-) create mode 100644 pkgs/development/python-modules/tenant-schemas-celery/default.nix diff --git a/pkgs/by-name/au/authentik/package.nix b/pkgs/by-name/au/authentik/package.nix index 8a9621b6d077e..490956a5dadba 100644 --- a/pkgs/by-name/au/authentik/package.nix +++ b/pkgs/by-name/au/authentik/package.nix @@ -152,25 +152,6 @@ let pythonImportsCheck = [ "rest_framework" ]; }; - tenant-schemas-celery = prev.buildPythonPackage rec { - pname = "tenant-schemas-celery"; - version = "3.0.0"; - src = fetchFromGitHub { - owner = "maciej-gol"; - repo = pname; - rev = version; - hash = "sha256-3ZUXSAOBMtj72sk/VwPV24ysQK+E4l1HdwKa78xrDtg="; - }; - format = "setuptools"; - doCheck = false; - - propagatedBuildInputs = with final; [ - freezegun - more-itertools - psycopg2 - ]; - }; - authentik-django = prev.buildPythonPackage { pname = "authentik-django"; inherit version src meta; diff --git a/pkgs/development/python-modules/tenant-schemas-celery/default.nix b/pkgs/development/python-modules/tenant-schemas-celery/default.nix new file mode 100644 index 0000000000000..e2eac8b76d256 --- /dev/null +++ b/pkgs/development/python-modules/tenant-schemas-celery/default.nix @@ -0,0 +1,36 @@ +{ + lib, + buildPythonPackage, + fetchFromGitHub, + setuptools, + celery, +}: + +buildPythonPackage rec { + pname = "tenant-schemas-celery"; + version = "3.0.0"; + pyproject = true; + + src = fetchFromGitHub { + owner = "maciej-gol"; + repo = "tenant-schemas-celery"; + rev = "refs/tags/${version}"; + hash = "sha256-3ZUXSAOBMtj72sk/VwPV24ysQK+E4l1HdwKa78xrDtg="; + }; + + build-system = [ setuptools ]; + + dependencies = [ celery ]; + + doCheck = false; # Tests require postgres + + pythonImportsCheck = [ "tenant_schemas_celery" ]; + + meta = { + description = "Celery application implementation that allows celery tasks to cooperate with multi-tenancy provided by django-tenant-schemas and django-tenants packages"; + homepage = "https://github.com/maciej-gol/tenant-schemas-celery"; + changelog = "https://github.com/maciej-gol/tenant-schemas-celery/releases/tag/${version}"; + license = lib.licenses.mit; + maintainers = with lib.maintainers; [ jopejoe1 ]; + }; +} diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index 997d7d8cb9ea5..bdd0aaad4d805 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -15310,6 +15310,8 @@ self: super: with self; { tenacity = callPackage ../development/python-modules/tenacity { }; + tenant-schemas-celery = callPackage ../development/python-modules/tenant-schemas-celery { }; + tencentcloud-sdk-python = callPackage ../development/python-modules/tencentcloud-sdk-python { }; tendo = callPackage ../development/python-modules/tendo { };