feat(actualbudget): configure oidc authentication

platforms/nixos/modules/nmasur/presets/services/actualbudget/actualbudget-oidc-secret.age

@@ -0,0 +1,17 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE1nSGFPdyBycCtF
+S1ErMkNoME1ZNzYramZ6cFJGL1VLbU1sSnVBaTA2Y3B2M1FUYTM0Cnl1a0dmdEpt
+U3puRS9RUEUyVVBDelRRRGlGQXdWQzc4cHprZGNRb2RuYmcKLT4gc3NoLWVkMjU1
+MTkgWXlTVU1RIDJ1M1dmTnB4Vzg3WDZ3QzZDZ1phYTU4YUk0U1VmV2M5cHZ2bENE
+eEE5aDQKODFrOWJBWjE0WFJKRTVrb2dlTmVHdEVHeVc4MU9GRHhTY1l5Mzh1YnZo
+dwotPiBzc2gtZWQyNTUxOSBuanZYNUEgM2JNTmVuTCtiSnNOS2UybE5qQXptcW92
+QngyaGh5Y0VqOGZEaWpkazYzawpjZmExWmF5MjV0NE05ZXVzenhYVXpRaGg4R25x
+QkpFa080S3haTXpTUi80Ci0+IHNzaC1lZDI1NTE5IENxSU9VQSBQcjgrV0c3S21I
+RXY5WnlSdWRML1g4ZmtvNWVmTGNwb3owZUFWN0s0ckhZCm1PbGtKY1hOanBGU0V6
+MzRrd3lPSUIrUVY3ZW5VTzFrWnJjblNvZmVIYk0KLT4gc3NoLWVkMjU1MTkgejFP
+Y1p3IGdoRHVhbG52OE5wUEFwWjlvb0xZSUpOS0loNm1QOWZ0N2RGZ2xMcW5RQXcK
+UUpNdDh1aUN0cHM2N0M3bGMvcjIwT2YrV01sdjdBQThkM3BxQ1hXY1A3bwotLS0g
+K21sZndObVJLdkNBR3IvWHZ3c0RjSEJQajFUV2tFUmNXWDQ3RU1DNzJKcwon7wF2
+i2V9/fXS9QBfTvUJGP9MQ1gCe+UxstI3IPv+ODudHLeCGT0JoxkN6DZtayxKYYJn
+iKghS8tUNdzshOBqpA==
+-----END AGE ENCRYPTED FILE-----

platforms/nixos/modules/nmasur/presets/services/actualbudget/actualbudget.nix

@@ -32,6 +32,22 @@ in
       enable = true;
       settings = {
         port = cfg.port;
+        loginMethod = "openid";
+        openId = {
+          discoveryURL = "https://${hostnames.auth}/.well-known/openid-configuration";
+          client_id = "92afe9f8-7ef6-42ab-8a06-701df3c7179d";
+          client_secret._secret = config.secrets.actualbudget-oidc-secret.dest;
+          server_hostname = "https://${hostnames.budget}";
+          authMethod = "openid";
+        };
+      };
+    };
+
+    systemd.services.actual = {
+      after = [ "actualbudget-oidc-secret-secret.service" ];
+      serviceConfig = {
+        PrivateUsers = lib.mkForce false;
+        SupplementaryGroups = [ "shared" ];
       };
     };
 
@@ -107,6 +123,17 @@ in
       owner = builtins.toString config.users.users.actualbudget.uid;
       group = builtins.toString config.users.users.actualbudget.uid;
     };
+    secrets.actualbudget-oidc-secret = {
+      source = ./actualbudget-oidc-secret.age;
+      dest = "${config.secretsDirectory}/actualbudget-oidc-secret";
+      owner = config.users.users.actualbudget.name;
+      group = config.users.groups.shared.name;
+      permissions = "0440";
+    };
+    systemd.services.actualbudget-oidc-secret-secret = {
+      requiredBy = [ "actual.service" ];
+      before = [ "actual.service" ];
+    };
 
     # Allow web traffic to Caddy
     nmasur.presets.services.caddy.routes = lib.mkAfter [