feat(nix): add authelia TOTP, require auth for all domains

sbulav · Nov 15, 2024 · c5ca76d · c5ca76d
1 parent 8bcf3b7
commit c5ca76d
Show file tree

Hide file tree

Showing 9 changed files with 63 additions and 31 deletions.
diff --git a/nix/modules/nixos/containers/adguard/default.nix b/nix/modules/nixos/containers/adguard/default.nix
@@ -87,9 +87,7 @@ in {
         entrypoints = ["websecure"];
         rule = "Host(`${cfg.host}`)";
         service = "adguard";
-        middlewares = [
-          "secure-headers"
-        ];
+        middlewares = ["auth-chain"];
         tls = {
           certResolver = "production";
         };

diff --git a/nix/modules/nixos/containers/authelia/default.nix b/nix/modules/nixos/containers/authelia/default.nix
@@ -93,11 +93,18 @@ in {
                 max_retries = 3;
               };
               session = {
-                domain = "${cfg.domain}";
-                expiration = 604800;
-                inactivity = 300;
                 name = "authelia_session";
+                cookies = [
+                  {
+                    domain = "${cfg.domain}";
+                    authelia_url = "https://${cfg.host}";
+                    default_redirection_url = "https://homepage.${cfg.domain}";
+                  }
+                ];
               };
+              default_2fa_method = "totp";
+              # TODO: change notifier to smtp/2fa
+              #used to send 2FA registration emails etc
               notifier = {
                 disable_startup_check = false;
                 filesystem = {
@@ -106,11 +113,13 @@ in {
               };
               access_control = {
                 # default_policy = "deny";
-                default_policy = "one_factor";
+                # default_policy = "one_factor";
+                default_policy = "two_factor";
                 rules = [
                   {
-                    domain = "*.sbulav.ru";
-                    policy = "one_factor";
+                    domain = "*.${cfg.domain}";
+                    # policy = "one_factor";
+                    policy = "two_factor";
                   }
                 ];
               };

diff --git a/nix/modules/nixos/containers/flood/default.nix b/nix/modules/nixos/containers/flood/default.nix
@@ -73,9 +73,7 @@ in {
         entrypoints = ["websecure"];
         rule = "Host(`${cfg.host}`)";
         service = "flood";
-        middlewares = [
-          "secure-headers"
-        ];
+        middlewares = ["auth-chain"];
         tls = {
           certResolver = "production";
         };

diff --git a/nix/modules/nixos/containers/homepage/default.nix b/nix/modules/nixos/containers/homepage/default.nix
@@ -83,7 +83,7 @@ in {
                     href = "https://adguard.sbulav.ru";
                     widget = {
                       type = "adguard";
-                      url = "https://adguard.sbulav.ru";
+                      url = "http://${config.${namespace}.containers.adguard.localAddress}:3000";
                     };
                   };
                 }
@@ -93,7 +93,7 @@ in {
                     href = "https://flood.sbulav.ru";
                     widget = {
                       type = "flood";
-                      url = "https://flood.sbulav.ru";
+                      url = "http://${config.${namespace}.containers.flood.localAddress}:3000";
                     };
                   };
                 }
@@ -121,9 +121,7 @@ in {
         entrypoints = ["websecure"];
         rule = "Host(`${cfg.host}`)";
         service = "homepage";
-        middlewares = [
-          "secure-headers"
-        ];
+        middlewares = ["auth-chain"];
         tls = {
           certResolver = "production";
         };

diff --git a/nix/modules/nixos/containers/nextcloud/default.nix b/nix/modules/nixos/containers/nextcloud/default.nix
@@ -155,9 +155,7 @@ in {
         entrypoints = ["websecure"];
         rule = "Host(`${cfg.host}`)";
         service = "nextcloud";
-        middlewares = [
-          "secure-headers"
-        ];
+        middlewares = ["auth-chain"];
         tls = {
           certResolver = "production";
         };

diff --git a/nix/modules/nixos/containers/traefik/default.nix b/nix/modules/nixos/containers/traefik/default.nix
@@ -14,6 +14,12 @@ in {
     domain = mkOpt str "" "The domain to get certificates to";
     dataPath = mkOpt str "/tank/traefik" "Traefik data path on host machine";
   };
+  imports = [
+    # Middlewares
+    ./middleware_authelia.nix
+    ./middleware_allow-lan.nix
+    ./middleware_secure-headers.nix
+  ];
 
   config = mkIf cfg.enable {
     sops.secrets = {
@@ -62,9 +68,7 @@ in {
               routers.traefik-dashboard = {
                 rule = "Host(`traefik.${cfg.domain}`)";
                 service = "api@internal";
-                middlewares = [
-                  "secure-headers"
-                ];
+                middlewares = ["secure-headers" "allow-lan"];
                 tls = {
                   certResolver = "production";
                   domains = {
@@ -76,8 +80,12 @@ in {
                 };
               };
 
-              # TODO: implement authelia auth
-              middlewares = import ./middleware_secure-headers.nix;
+              middlewares.auth-chain = {
+                chain.middlewares = [
+                  "secure-headers"
+                  "authelia"
+                ];
+              };
             };
           };
         };

diff --git a/nix/modules/nixos/containers/traefik/middleware_allow-lan.nix b/nix/modules/nixos/containers/traefik/middleware_allow-lan.nix
@@ -0,0 +1,10 @@
+{
+  containers.traefik.config.services.traefik.dynamicConfigOptions.http.middlewares.allow-lan = {
+    ipAllowList.sourceRange = [
+      "127.0.0.1/32"
+      "172.16.64.0/24"
+      "192.168.88.0/24"
+      "192.168.89.0/24"
+    ];
+  };
+}
diff --git a/nix/modules/nixos/containers/traefik/middleware_authelia.nix b/nix/modules/nixos/containers/traefik/middleware_authelia.nix
@@ -0,0 +1,18 @@
+{
+  namespace,
+  config,
+  ...
+}: {
+  containers.traefik.config.services.traefik.dynamicConfigOptions.http.middlewares.authelia = {
+    forwardAuth = {
+      address = "http://${config.${namespace}.containers.authelia.localAddress}:9091/api/authz/forward-auth";
+      trustForwardHeader = true;
+      authResponseHeaders = [
+        "Remote-User"
+        "Remote-Groups"
+        "Remote-Name"
+        "Remote-Email"
+      ];
+    };
+  };
+}
diff --git a/nix/modules/nixos/containers/traefik/middleware_secure-headers.nix b/nix/modules/nixos/containers/traefik/middleware_secure-headers.nix
@@ -1,5 +1,5 @@
 {
-  secure-headers = {
+  containers.traefik.config.services.traefik.dynamicConfigOptions.http.middlewares.secure-headers = {
     headers = {
       sslRedirect = true;
       accessControlMaxAge = "100";
@@ -27,9 +27,4 @@
       };
     };
   };
-  auth-chain = {
-    chain.middlewares = [
-      "secure-headers"
-    ];
-  };
 }