nixos/authentik: init module, authentik: 2024.6.4 -> 2024.8.3

nixos/doc/manual/release-notes/rl-2411.section.md

@@ -163,6 +163,8 @@
 
 - [Veilid](https://veilid.com), a headless server that enables privacy-focused data sharing and messaging on a peer-to-peer network. Available as [services.veilid](#opt-services.veilid.enable).
 
+- [authentik](https://github.com/goauthentik/authentik), a self-hosted identity provider. Available as [services.authentik](#opt-services.authentik.enable).
+
 ## Backward Incompatibilities {#sec-release-24.11-incompatibilities}
 
 - The `sound` options have been removed or renamed, as they had a lot of unintended side effects. See [below](#sec-release-24.11-migration-sound) for details.

nixos/modules/module-list.nix

@@ -1298,6 +1298,7 @@
   ./services/search/typesense.nix
   ./services/security/aesmd.nix
   ./services/security/authelia.nix
+  ./services/security/authentik.nix
   ./services/security/bitwarden-directory-connector-cli.nix
   ./services/security/certmgr.nix
   ./services/security/cfssl.nix

nixos/modules/services/security/authentik.nix

@@ -0,0 +1,235 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  inherit (lib)
+    mkIf
+    types
+    mkOption
+    mkEnableOption
+    mkPackageOption
+    ;
+  cfg = config.services.authentik;
+
+  isRedisUnixSocket = lib.hasPrefix "/" cfg.redis.host;
+
+  commonServiceConfig = {
+    Type = "simple";
+    User = cfg.user;
+    Group = cfg.group;
+    Restart = "always";
+    RestartSec = 3;
+    RuntimeDirectory = "authentik";
+    NoNewPrivileges = true;
+    PrivateTmp = true;
+    ProtectHome = true;
+    ProtectSystem = "strict";
+    ProtectKernelTunables = true;
+    ProtectKernelModules = true;
+    ProtectControlGroups = true;
+    SystemCallFilter = "~@cpu-emulation @keyring @module @obsolete @raw-io @reboot @swap @sync";
+    ConfigurationDirectory = "authentik";
+  };
+in
+{
+  options.services.authentik = {
+    enable = mkEnableOption "authentik";
+    package = mkPackageOption pkgs "authentik" { };
+
+    secretsFile = mkOption {
+      type = types.nullOr (
+        types.str
+        // {
+          # We don't want users to be able to pass a path literal here but
+          # it should look like a path.
+          check = it: lib.isString it && lib.types.path.check it;
+        }
+      );
+      default = null;
+      example = "/run/secrets/authentik";
+      description = ''
+        Path of a file with extra environment variables to be loaded from disk.
+        This file is not added to the nix store, so it can be used to pass secrets to authentik.
+        Refer to the [documentation](https://docs.goauthentik.io/docs/installation/configuration) for options.
+
+        authentik requires at least a secret key:
+        ```
+        AUTHENTIK_SECRET_KEY=<random key>
+        ```
+        You can also use services.authentik.environment.AUTHENTIK_SECRET_KEY = 'file:///path/to/secret' instead
+      '';
+    };
+    environment = mkOption {
+      type = types.attrsOf types.str;
+      default = { };
+      example = {
+        AUTHENTIK_LOG_LEVEL = "debug";
+      };
+      description = ''
+        Extra configuration environment variables. Refer to the [documentation](https://docs.goauthentik.io/docs/installation/configuration) for options.
+      '';
+    };
+
+    host = lib.mkOption {
+      type = types.str;
+      default = "localhost";
+      description = "The host that authentik will listen on.";
+    };
+    httpPort = mkOption {
+      type = types.port;
+      default = 9000;
+      description = "The http port that authentik will listen on.";
+    };
+    httpsPort = mkOption {
+      type = types.port;
+      default = 9443;
+      description = "The https port that authentik will listen on.";
+    };
+    user = mkOption {
+      type = types.str;
+      default = "authentik";
+      description = "The user authentik should run as.";
+    };
+    group = mkOption {
+      type = types.str;
+      default = "authentik";
+      description = "The group authentik should run as.";
+    };
+    database = {
+      enable =
+        mkEnableOption "the postgresql database for use with authentik. See {option}`services.postgresql`"
+        // {
+          default = true;
+        };
+      createDB = mkEnableOption "the automatic creation of the database for authentik." // {
+        default = true;
+      };
+      name = mkOption {
+        type = types.str;
+        default = "authentik";
+        description = "The name of the authentik database.";
+      };
+      host = mkOption {
+        type = types.str;
+        default = "/run/postgresql";
+        example = "127.0.0.1";
+        description = "Hostname or address of the postgresql server. If an absolute path is given here, it will be interpreted as a unix socket path.";
+      };
+      port = mkOption {
+        type = types.port;
+        default = 5432;
+        description = "The port of the postgresql server";
+      };
+      user = mkOption {
+        type = types.str;
+        default = "authentik";
+        description = "The database user for authentik.";
+      };
+    };
+    redis = {
+      enable = mkEnableOption "a redis cache for use with authentik" // {
+        default = true;
+      };
+      host = mkOption {
+        type = types.str;
+        default = config.services.redis.servers.authentik.unixSocket;
+        defaultText = lib.literalExpression "config.services.redis.servers.authentik.unixSocket";
+        description = "The host that redis will listen on.";
+      };
+      port = mkOption {
+        type = types.port;
+        default = 0;
+        description = "The port that redis will listen on. Set to zero to disable TCP.";
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.database.createDB -> cfg.database.name == cfg.database.user;
+        message = "The postgres module requires the database name and the database user name to be the same.";
+      }
+      {
+        assertion = cfg.secretsFile == null -> lib.hasPrefix "file://" cfg.environment.AUTHENTIK_SECRET_KEY;
+        message = "If no secretsFile is provided, services.authentik.environment has to provide AUTHENTIK_SECRET_KEY with a file:// prefix";
+      }
+      {
+        assertion = cfg.secretsFile != null -> !(cfg.environment ? "AUTHENTIK_SECRET_KEY");
+        message = "Possibly conflicting AUTHENTIK_SECRET_KEY definition in secretsFile and services.authentik.environment";
+      }
+    ];
+
+    systemd.services.authentik-server = {
+      description = "Authentik server component";
+      after = [ "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
+      inherit (cfg) environment;
+
+      serviceConfig = commonServiceConfig // {
+        ExecStart = "${lib.getExe cfg.package} server";
+        EnvironmentFile = cfg.secretsFile;
+      };
+    };
+
+    systemd.services.authentik-worker = {
+      description = "Authentik worker component";
+      after = [ "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
+      inherit (cfg) environment;
+
+      serviceConfig = commonServiceConfig // {
+        ExecStart = "${lib.getExe cfg.package} worker";
+        EnvironmentFile = cfg.secretsFile;
+      };
+    };
+
+    services.postgresql = mkIf cfg.database.enable {
+      enable = true;
+      ensureDatabases = mkIf cfg.database.createDB [ cfg.database.name ];
+      ensureUsers = mkIf cfg.database.createDB [
+        {
+          name = cfg.database.user;
+          ensureDBOwnership = true;
+          ensureClauses.login = true;
+        }
+      ];
+    };
+
+    services.authentik.environment = {
+      AUTHENTIK_CACHE__URL = mkIf isRedisUnixSocket "unix://${cfg.redis.host}";
+      AUTHENTIK_CHANNEL__URL = mkIf isRedisUnixSocket "unix://${cfg.redis.host}";
+      AUTHENTIK_RESULT_BACKEND__URL = mkIf isRedisUnixSocket "redis+socket://${cfg.redis.host}";
+      AUTHENTIK_BROKER__URL = mkIf isRedisUnixSocket "redis+socket://${cfg.redis.host}";
+      AUTHENTIK_REDIS__HOST = mkIf (!isRedisUnixSocket) cfg.redis.host;
+      AUTHENTIK_REDIS__PORT = mkIf (!isRedisUnixSocket) (toString cfg.redis.port);
+      AUTHENTIK_POSTGRESQL__HOST = cfg.database.host;
+      AUTHENTIK_POSTGRESQL__NAME = cfg.database.name;
+      AUTHENTIK_POSTGRESQL__USER = cfg.database.user;
+      AUTHENTIK_POSTGRESQL__PORT = toString cfg.database.port;
+      AUTHENTIK_LISTEN_HTTP = "${cfg.host}:${toString cfg.httpPort}";
+      AUTHENTIK_LISTEN_HTTPS = "${cfg.host}:${toString cfg.httpsPort}";
+    };
+
+    services.redis.servers = mkIf cfg.redis.enable {
+      authentik = {
+        enable = true;
+        user = cfg.user;
+        port = cfg.redis.port;
+        bind = mkIf (!isRedisUnixSocket) cfg.redis.host;
+      };
+    };
+
+    users.users = mkIf (cfg.user == "authentik") {
+      authentik = {
+        name = "authentik";
+        group = cfg.group;
+        isSystemUser = true;
+      };
+    };
+    users.groups = mkIf (cfg.group == "authentik") { authentik = { }; };
+  };
+}

nixos/tests/all-tests.nix

@@ -140,6 +140,7 @@ in {
   audiobookshelf = handleTest ./audiobookshelf.nix {};
   auth-mysql = handleTest ./auth-mysql.nix {};
   authelia = handleTest ./authelia.nix {};
+  authentik = handleTest ./web-apps/authentik.nix {};
   avahi = handleTest ./avahi.nix {};
   avahi-with-resolved = handleTest ./avahi.nix { networkd = true; };
   ayatana-indicators = runTest ./ayatana-indicators.nix;

nixos/tests/web-apps/authentik.nix

@@ -0,0 +1,27 @@
+import ../make-test-python.nix (
+  { ... }:
+  {
+    name = "authentik-nixos";
+
+    nodes.machine =
+      { pkgs, ... }:
+      {
+        environment.systemPackages = with pkgs; [ openssl ];
+
+        services.authentik = {
+          enable = true;
+          secretsFile = "/run/secrets/authentik";
+          environment.AUTHENTIK_LOG_LEVEL = "debug";
+        };
+      };
+
+    testScript = ''
+      machine.succeed("mkdir -p /run/secrets ; echo \"AUTHENTIK_SECRET_KEY=$(openssl rand -base64 60 | tr -d '\n')\" > /run/secrets/authentik ; echo \"AUTHENTIK_BOOTSTRAP_PASSWORD=admin\" >> /run/secrets/authentik")
+
+      machine.wait_for_unit("authentik-server.service")
+
+      machine.wait_for_open_port(9000)
+      machine.wait_until_succeeds("curl --fail http://localhost:9000/api/v3/root/config", 100)
+    '';
+  }
+)

pkgs/by-name/au/authentik/ldap.nix

@@ -1,10 +1,13 @@
-{ buildGoModule, authentik }:
+{
+  buildGo123Module,
+  authentik,
+}:
 
-buildGoModule {
+buildGo123Module {
   pname = "authentik-ldap-outpost";
   inherit (authentik) version src;
 
-  vendorHash = "sha256-BcL9QAc2jJqoPaQImJIFtCiu176nxmVcCLPjXjNBwqI=";
+  vendorHash = "sha256-xaVEyG5fNGh/zmXkewve5V2q2W7u+hqo27GqabAV9H0=";
 
   CGO_ENABLED = 0;
 

pkgs/by-name/au/authentik/outposts.nix

@@ -1,4 +1,6 @@
-{ callPackage }: {
-  ldap = callPackage ./ldap.nix { };
-  radius = callPackage ./radius.nix { };
+{ callPackage, authentik }:
+{
+  ldap = callPackage ./ldap.nix { inherit authentik; };
+  radius = callPackage ./radius.nix { inherit authentik; };
+  proxy = callPackage ./proxy.nix { inherit authentik; };
 }