JakeHillion/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #39002 from serokell/oauth2_proxy_mod

Browse Source 
oauth2_proxy: refactor service
This commit is contained in:
Yegor Timoshenko 2018-04-27 22:15:50 +03:00 committed by GitHub
commit e71c36369f
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 103 additions and 57 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

160
nixos/modules/services/security/oauth2_proxy.nix
View File

@ -6,70 +6,81 @@ with lib;
let let
cfg = config.services.oauth2_proxy; cfg = config.services.oauth2_proxy;
# Use like:
# repeatedArgs (arg: "--arg=${arg}") args
repeatedArgs = concatMapStringsSep " ";
# oauth2_proxy provides many options that are only relevant if you are using # oauth2_proxy provides many options that are only relevant if you are using
# a certain provider. This set maps from provider name to a function that # a certain provider. This set maps from provider name to a function that
# takes the configuration and returns a string that can be inserted into the # takes the configuration and returns a string that can be inserted into the
# command-line to launch oauth2_proxy. # command-line to launch oauth2_proxy.
providerSpecificOptions = { providerSpecificOptions = {
azure = cfg: '' azure = cfg: {
--azure-tenant=${cfg.azure.tenant} \ azure.tenant = cfg.azure.tenant;
--resource=${cfg.azure.resource} \ resource = cfg.azure.resource;
''; };
github = cfg: '' github = cfg: { github = {
${optionalString (!isNull cfg.github.org) "--github-org=${cfg.github.org}"} \ inherit (cfg.github) org team;
${optionalString (!isNull cfg.github.team) "--github-org=${cfg.github.team}"} \ }; };
'';
google = cfg: '' google = cfg: { google = with cfg.google; optionalAttrs (groups != []) {
--google-admin-email=${cfg.google.adminEmail} \ admin-email = adminEmail;
--google-service-account=${cfg.google.serviceAccountJSON} \ service-account = serviceAccountJSON;
${repeatedArgs (group: "--google-group=${group}") cfg.google.groups} \ group = groups;
''; }; };
}; };
authenticatedEmailsFile = pkgs.writeText "authenticated-emails" cfg.email.addresses; authenticatedEmailsFile = pkgs.writeText "authenticated-emails" cfg.email.addresses;
getProviderOptions = cfg: provider: providerSpecificOptions.${provider} or (_: "") cfg; getProviderOptions = cfg: provider: providerSpecificOptions.${provider} or (_: {}) cfg;
mkCommandLine = cfg: '' allConfig = with cfg; {
--provider='${cfg.provider}' \ inherit (cfg) provider scope upstream;
${optionalString (!isNull cfg.email.addresses) "--authenticated-emails-file='${authenticatedEmailsFile}'"} \ approval-prompt = approvalPrompt;
--approval-prompt='${cfg.approvalPrompt}' \ basic-auth-password = basicAuthPassword;
${optionalString (cfg.passBasicAuth && !isNull cfg.basicAuthPassword) "--basic-auth-password='${cfg.basicAuthPassword}'"} \ client-id = clientID;
--client-id='${cfg.clientID}' \ client-secret = clientSecret;
--client-secret='${cfg.clientSecret}' \ custom-templates-dir = customTemplatesDir;
${optionalString (!isNull cfg.cookie.domain) "--cookie-domain='${cfg.cookie.domain}'"} \ email-domain = email.domains;
--cookie-expire='${cfg.cookie.expire}' \ http-address = httpAddress;
--cookie-httponly=${boolToString cfg.cookie.httpOnly} \ login-url = loginURL;
--cookie-name='${cfg.cookie.name}' \ pass-access-token = passAccessToken;
--cookie-secret='${cfg.cookie.secret}' \ pass-basic-auth = passBasicAuth;
--cookie-secure=${boolToString cfg.cookie.secure} \ pass-host-header = passHostHeader;
${optionalString (!isNull cfg.cookie.refresh) "--cookie-refresh='${cfg.cookie.refresh}'"} \ proxy-prefix = proxyPrefix;
${optionalString (!isNull cfg.customTemplatesDir) "--custom-templates-dir='${cfg.customTemplatesDir}'"} \ profile-url = profileURL;
${repeatedArgs (x: "--email-domain='${x}'") cfg.email.domains} \ redeem-url = redeemURL;
--http-address='${cfg.httpAddress}' \ redirect-url = redirectURL;
${optionalString (!isNull cfg.htpasswd.file) "--htpasswd-file='${cfg.htpasswd.file}' --display-htpasswd-form=${boolToString cfg.htpasswd.displayForm}"} \ request-logging = requestLogging;
${optionalString (!isNull cfg.loginURL) "--login-url='${cfg.loginURL}'"} \ skip-auth-regex = skipAuthRegexes;
--pass-access-token=${boolToString cfg.passAccessToken} \ signature-key = signatureKey;
--pass-basic-auth=${boolToString cfg.passBasicAuth} \ validate-url = validateURL;
--pass-host-header=${boolToString cfg.passHostHeader} \ htpasswd-file = htpasswd.file;
--proxy-prefix='${cfg.proxyPrefix}' \ cookie = {
${optionalString (!isNull cfg.profileURL) "--profile-url='${cfg.profileURL}'"} \ inherit (cookie) domain secure expire name secret refresh;
${optionalString (!isNull cfg.redeemURL) "--redeem-url='${cfg.redeemURL}'"} \ httponly = cookie.httpOnly;
${optionalString (!isNull cfg.redirectURL) "--redirect-url='${cfg.redirectURL}'"} \ };
--request-logging=${boolToString cfg.requestLogging} \ set-xauthrequest = setXauthrequest;
${optionalString (!isNull cfg.scope) "--scope='${cfg.scope}'"} \ } // lib.optionalAttrs (!isNull cfg.email.addresses) {
${repeatedArgs (x: "--skip-auth-regex='${x}'") cfg.skipAuthRegexes} \ authenticated-emails-file = authenticatedEmailsFile;
${optionalString (!isNull cfg.signatureKey) "--signature-key='${cfg.signatureKey}'"} \ } // lib.optionalAttrs (cfg.passBasicAuth) {
--upstream='${cfg.upstream}' \ basic-auth-password = cfg.basicAuthPassword;
${optionalString (!isNull cfg.validateURL) "--validate-url='${cfg.validateURL}'"} \ } // lib.optionalAttrs (!isNull cfg.htpasswd.file) {
${optionalString cfg.tls.enable "--tls-cert='${cfg.tls.certificate}' --tls-key='${cfg.tls.key}' --https-address='${cfg.tls.httpsAddress}'"} \ display-htpasswd-file = cfg.htpasswd.displayForm;
'' + getProviderOptions cfg cfg.provider; } // lib.optionalAttrs tls.enable {
tls-cert = tls.certificate;
tls-key = tls.key;
https-address = tls.httpsAddress;
} // (getProviderOptions cfg cfg.provider) // cfg.extraConfig;
mapConfig = key: attr:
if (!isNull attr && attr != []) then (
if (builtins.typeOf attr) == "set" then concatStringsSep " "
(mapAttrsToList (name: value: mapConfig (key + "-" + name) value) attr) else
if (builtins.typeOf attr) == "list" then concatMapStringsSep " " (mapConfig key) attr else
if (builtins.typeOf attr) == "bool" then "--${key}=${boolToString attr}" else
if (builtins.typeOf attr) == "string" then "--${key}='${attr}'" else
"--${key}=${toString attr}")
else "";
configString = concatStringsSep " " (mapAttrsToList mapConfig allConfig);
in in
{ {
options.services.oauth2_proxy = { options.services.oauth2_proxy = {
@ -110,7 +121,7 @@ in
}; };
clientID = mkOption { clientID = mkOption {
type = types.str; type = types.nullOr types.str;
description = '' description = ''
The OAuth Client ID. The OAuth Client ID.
''; '';
@ -118,7 +129,7 @@ in
}; };
clientSecret = mkOption { clientSecret = mkOption {
type = types.str; type = types.nullOr types.str;
description = '' description = ''
The OAuth Client Secret. The OAuth Client Secret.
''; '';
@ -272,7 +283,8 @@ in
#################################################### ####################################################
# UPSTREAM Configuration # UPSTREAM Configuration
upstream = mkOption { upstream = mkOption {
type = types.commas; type = with types; coercedTo string (x: [x]) (listOf string);
default = [];
description = '' description = ''
The http url(s) of the upstream endpoint or <literal>file://</literal> The http url(s) of the upstream endpoint or <literal>file://</literal>
paths for static files. Routing is based on the path. paths for static files. Routing is based on the path.
@ -365,7 +377,7 @@ in
}; };
secret = mkOption { secret = mkOption {
type = types.str; type = types.nullOr types.str;
description = '' description = ''
The seed string for secure cookies. The seed string for secure cookies.
''; '';
@ -494,10 +506,43 @@ in
''; '';
}; };
setXauthrequest = mkOption {
type = types.nullOr types.bool;
default = false;
description = ''
Set X-Auth-Request-User and X-Auth-Request-Email response headers (useful in Nginx auth_request mode). Setting this to 'null' means using the upstream default (false).
'';
};
extraConfig = mkOption {
default = {};
description = ''
Extra config to pass to oauth2_proxy.
'';
};
keyFile = mkOption {
type = types.nullOr types.string;
default = null;
description = ''
oauth2_proxy allows passing sensitive configuration via environment variables.
Make a file that contains lines like
OAUTH2_PROXY_CLIENT_SECRET=asdfasdfasdf.apps.googleuserscontent.com
and specify the path here.
'';
example = "/run/keys/oauth2_proxy";
};
}; };
config = mkIf cfg.enable { config = mkIf cfg.enable {
services.oauth2_proxy = mkIf (!isNull cfg.keyFile) {
clientID = mkDefault null;
clientSecret = mkDefault null;
cookie.secret = mkDefault null;
};
users.extraUsers.oauth2_proxy = { users.extraUsers.oauth2_proxy = {
description = "OAuth2 Proxy"; description = "OAuth2 Proxy";
}; };
@ -511,7 +556,8 @@ in
serviceConfig = { serviceConfig = {
User = "oauth2_proxy"; User = "oauth2_proxy";
Restart = "always"; Restart = "always";
ExecStart = "${cfg.package.bin}/bin/oauth2_proxy ${mkCommandLine cfg}"; ExecStart = "${cfg.package.bin}/bin/oauth2_proxy ${configString}";
EnvironmentFile = mkIf (cfg.keyFile != null) cfg.keyFile;
}; };
}; };