noah/dotfiles
1
0
Fork 0
mirror of https://github.com/nmasur/dotfiles synced 2026-09-09 03:36:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(actualbudget): configure oidc authentication

Browse Source
This commit is contained in:
Noah Masur
2026-09-06 18:18:57 +00:00
parent 2a3cbfb5f5
commit 01ee98155a
4 changed files with 62 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
platforms/nixos/modules/nmasur/presets/services/actualbudget/actualbudget.nix
+27
View File
@@ -32,6 +32,22 @@ in
enable = true;
settings = {
port = cfg.port;
loginMethod = "openid";
openId = {
discoveryURL = "https://${hostnames.auth}/.well-known/openid-configuration";
client_id = "92afe9f8-7ef6-42ab-8a06-701df3c7179d";
client_secret._secret = config.secrets.actualbudget-oidc-secret.dest;
server_hostname = "https://${hostnames.budget}";
authMethod = "openid";
};
};
};
systemd.services.actual = {
after = [ "actualbudget-oidc-secret-secret.service" ];
serviceConfig = {
PrivateUsers = lib.mkForce false;
SupplementaryGroups = [ "shared" ];
};
};
@@ -107,6 +123,17 @@ in
owner = builtins.toString config.users.users.actualbudget.uid;
group = builtins.toString config.users.users.actualbudget.uid;
};
secrets.actualbudget-oidc-secret = {
source = ./actualbudget-oidc-secret.age;
dest = "${config.secretsDirectory}/actualbudget-oidc-secret";
owner = config.users.users.actualbudget.name;
group = config.users.groups.shared.name;
permissions = "0440";
};
systemd.services.actualbudget-oidc-secret-secret = {
requiredBy = [ "actual.service" ];
before = [ "actual.service" ];
};
# Allow web traffic to Caddy
nmasur.presets.services.caddy.routes = lib.mkAfter [