William
6f1aca7b01
Add OAuth2 client configuration to enable auto-registration via SSO with Kanidm, while disabling direct public registration. Users can now authenticate through the identity provider with automatic account creation and avatar syncing. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
41 lines
1,008 B
Nix
41 lines
1,008 B
Nix
{
|
|
config,
|
|
lib,
|
|
inputs,
|
|
...
|
|
}:
|
|
let
|
|
utils = import ../../utils.nix { inherit inputs lib; };
|
|
inherit (utils) mkNginxVHosts;
|
|
in
|
|
{
|
|
services.forgejo = {
|
|
enable = true;
|
|
repositoryRoot = "/data/forgejo";
|
|
settings = {
|
|
session.COOKIE_SECURE = true;
|
|
server = {
|
|
PROTOCOL = "http+unix";
|
|
DOMAIN = "git.baduhai.dev";
|
|
ROOT_URL = "https://git.baduhai.dev";
|
|
OFFLINE_MODE = true; # disable use of CDNs
|
|
SSH_DOMAIN = "baduhai.dev";
|
|
};
|
|
log.LEVEL = "Warn";
|
|
mailer.ENABLED = false;
|
|
actions.ENABLED = false;
|
|
service.DISABLE_REGISTRATION = true;
|
|
oauth2_client = {
|
|
ENABLE_AUTO_REGISTRATION = true;
|
|
UPDATE_AVATAR = true;
|
|
ACCOUNT_LINKING = "login";
|
|
USERNAME = "preferred_username";
|
|
};
|
|
};
|
|
};
|
|
|
|
services.nginx.virtualHosts = mkNginxVHosts {
|
|
domains."git.baduhai.dev".locations."/".proxyPass =
|
|
"http://unix:${config.services.forgejo.settings.server.HTTP_ADDR}:/";
|
|
};
|
|
}
|