From f593fdb81f5ac70082e2a198d07c0bbc9c746d5b Mon Sep 17 00:00:00 2001 From: Noah Masur <7386960+nmasur@users.noreply.github.com> Date: Sun, 6 Sep 2026 18:50:03 +0000 Subject: [PATCH] feat(mealie): configure oidc authentication --- docs/CHANGELOG.md | 7 ++++++ docs/oidc-services.md | 22 ++++++++++--------- .../services/mealie/mealie-oidc-secret.age | 17 ++++++++++++++ .../presets/services/{ => mealie}/mealie.nix | 21 ++++++++++++++++++ 4 files changed, 57 insertions(+), 10 deletions(-) create mode 100644 platforms/nixos/modules/nmasur/presets/services/mealie/mealie-oidc-secret.age rename platforms/nixos/modules/nmasur/presets/services/{ => mealie}/mealie.nix (59%) diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index 62604347..7d9bd2ed 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -2,6 +2,13 @@ ## 2026-09-06 +- **Configured OpenID Connect (OIDC) authentication for Mealie**: + - Configured `services.mealie.settings` with OIDC settings pointing to Pocket ID (`auth.masu.rs`), using client ID `040925ed-b39e-4442-b8e8-369c948c0cd2`. + - Added secret management for `mealie-oidc-secret.age` via `secrets.mealie-oidc-secret`, using `prefix = "OIDC_CLIENT_SECRET="` to generate an environment file. + - Configured `services.mealie.credentialsFile` to load the client secret via systemd's `EnvironmentFile` without exposing it in the world-readable Nix store or systemd unit file. + - Configured `systemd.services.mealie` to order after `mealie-oidc-secret-secret.service`. + - Updated `docs/oidc-services.md` with the verified configuration and callback URI (`https://cooking.masu.rs/login`). + - **Configured OpenID Connect (OIDC) authentication for Actual Budget**: - Configured `services.actual.settings` with `loginMethod = "openid"` and `openId` settings pointing to Pocket ID (`auth.masu.rs`), using client ID `92afe9f8-7ef6-42ab-8a06-701df3c7179d`. - Added secret management for `actualbudget-oidc-secret.age` via `secrets.actualbudget-oidc-secret`, set with owner `actualbudget` and group `shared` (0440). diff --git a/docs/oidc-services.md b/docs/oidc-services.md index 7f1eb937..19a5488c 100644 --- a/docs/oidc-services.md +++ b/docs/oidc-services.md @@ -31,7 +31,7 @@ These services support OpenID Connect natively without requiring external authen | **Nextcloud** | `cloud.masu.rs` | Native (official `user_oidc` app) | Nextcloud app + `nextcloud-occ user_oidc:provider` | | **Grafana** | `metrics.masu.rs` | Native (Generic OAuth) | NixOS config (`services.grafana.settings."auth.generic_oauth"`) | | **Paperless-ngx** | `paper.masu.rs` | Native (`django-allauth`) | NixOS env vars (`PAPERLESS_SOCIALACCOUNT_PROVIDERS`) | -| **Mealie** | `cooking.masu.rs` | Native core feature | NixOS env vars (`OIDC_AUTH_ENABLED`, etc.) | +| **Mealie** | `cooking.masu.rs` | Native core feature | NixOS config (`services.mealie.settings` + `credentialsFile`) | | **Karakeep / Hoarder** | `keep.masu.rs` | Native (NextAuth OIDC) | NixOS env vars (`OAUTH_WELLKNOWN_URL`, etc.) | | **Audiobookshelf** | `read.masu.rs` | Native core feature (v2.3+) | Web UI (Settings → Authentication) | | **Actual Budget** | `money.masu.rs` | Native core feature (v24.3+) | NixOS config (`services.actual.settings.openId`) | @@ -181,16 +181,18 @@ All client secrets should be encrypted with `agenix` under the respective servic ### 6. Mealie (`cooking.masu.rs`) - **Pocket ID Redirect URI:** `https://cooking.masu.rs/login` -- **Setup in `mealie.nix`:** +- **Setup in `mealie/mealie.nix`:** ```nix - systemd.services.mealie.environment = { - OIDC_AUTH_ENABLED = "true"; - OIDC_SIGNUP_ENABLED = "true"; - OIDC_CONFIGURATION_URL = "https://auth.masu.rs/.well-known/openid-configuration"; - OIDC_CLIENT_ID = "mealie"; - OIDC_CLIENT_SECRET = "..."; - OIDC_PROVIDER_NAME = "Pocket ID"; - OIDC_USER_CLAIM = "email"; + services.mealie = { + credentialsFile = config.secrets.mealie-oidc-secret.dest; + settings = { + OIDC_AUTH_ENABLED = "true"; + OIDC_SIGNUP_ENABLED = "true"; + OIDC_CONFIGURATION_URL = "https://${hostnames.auth}/.well-known/openid-configuration"; + OIDC_CLIENT_ID = "040925ed-b39e-4442-b8e8-369c948c0cd2"; + OIDC_PROVIDER_NAME = "Pocket ID"; + OIDC_USER_CLAIM = "email"; + }; }; ``` diff --git a/platforms/nixos/modules/nmasur/presets/services/mealie/mealie-oidc-secret.age b/platforms/nixos/modules/nmasur/presets/services/mealie/mealie-oidc-secret.age new file mode 100644 index 00000000..c833c1ec --- /dev/null +++ b/platforms/nixos/modules/nmasur/presets/services/mealie/mealie-oidc-secret.age @@ -0,0 +1,17 @@ +-----BEGIN AGE ENCRYPTED FILE----- +YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE1nSGFPdyBhZWw0 +UTJSYitUUTY0b3A3RDZZTjhnWjh3QWdTaFBzZVRpRWs2UW43R3k0Cmg1ODRWWnI5 +TFdSbmtlTU9zdzhyTHpzMW1hNmk3Tk1sRjZlbFYwZURML1kKLT4gc3NoLWVkMjU1 +MTkgWXlTVU1RIHVvaGZjeVh3Zm8yWUcyMEZnb1VITHpveGY4aWxTOVhUTzVpbnI0 +c2lYQ0EKNHI4ZEVpUWFYRjVxTTUrTElwdTliWVc2RjdJT21wTTFtSi9ydUo1MVF3 +UQotPiBzc2gtZWQyNTUxOSBuanZYNUEgODhzWTIwVjJvZzZKWGJKNkNHRXFSOWI2 +bDZab1hLUFBOUmNBZXhEQUtoNAozRXBXNUF6THN4Ry9OcG9mb0pTNGZrL01zTzhr +QWZpRHg1dUNtdnFJTnhNCi0+IHNzaC1lZDI1NTE5IENxSU9VQSA2NWYza2ZDWmda +N3Eycll2cXNPM0Q3UVk5OHlta1p5OTU3QlQwY3dxNm1NCktLaUxVTkYwMFpZV1px +SUFUU1JYZ0pyUU9oRURKWVNVck5VSXdVT3N3b0UKLT4gc3NoLWVkMjU1MTkgejFP +Y1p3IGZNV3NRWVg5N3FQeUdKYjhwQ2xydzBsaUZDVzl5Y1BrTlhZNCtOOWduZ28K +dnozT0lFa2NsYW9hbGpTL2pNK1YwcjM2QkVoWHJUUVdjT09XMlJGNUx0RQotLS0g +My9aVWJuVlBQbTNYZWd2bXUzUGp0NzZXcmFicXNob2ROeWY1cnViWXNQRQpYZ/zy +L37ulzvRl/Wt2+tIz9fgfOtK2KHuagnPD27T9e8bC9oVinJngwrzfFsV4t7/GCCs +iI+gfp86+RPSbIwrCA== +-----END AGE ENCRYPTED FILE----- diff --git a/platforms/nixos/modules/nmasur/presets/services/mealie.nix b/platforms/nixos/modules/nmasur/presets/services/mealie/mealie.nix similarity index 59% rename from platforms/nixos/modules/nmasur/presets/services/mealie.nix rename to platforms/nixos/modules/nmasur/presets/services/mealie/mealie.nix index 4439efc6..441b5032 100644 --- a/platforms/nixos/modules/nmasur/presets/services/mealie.nix +++ b/platforms/nixos/modules/nmasur/presets/services/mealie/mealie.nix @@ -10,16 +10,37 @@ in options.nmasur.presets.services.mealie.enable = lib.mkEnableOption "mealie recipe manager"; config = lib.mkIf cfg.enable { + secrets.mealie-oidc-secret = { + source = ./mealie-oidc-secret.age; + dest = "${config.secretsDirectory}/mealie-oidc-secret"; + prefix = "OIDC_CLIENT_SECRET="; + }; + systemd.services.mealie-oidc-secret-secret = { + requiredBy = [ "mealie.service" ]; + before = [ "mealie.service" ]; + }; + services.mealie = { enable = true; port = 9099; database.createLocally = true; listenAddress = "127.0.0.1"; + credentialsFile = config.secrets.mealie-oidc-secret.dest; settings = { TOKEN_TIME = 7200; # Hours for login to last (300 days) + OIDC_AUTH_ENABLED = "true"; + OIDC_SIGNUP_ENABLED = "true"; + OIDC_CONFIGURATION_URL = "https://${hostnames.auth}/.well-known/openid-configuration"; + OIDC_CLIENT_ID = "040925ed-b39e-4442-b8e8-369c948c0cd2"; + OIDC_PROVIDER_NAME = "Pocket ID"; + OIDC_USER_CLAIM = "email"; }; }; + systemd.services.mealie = { + after = [ "mealie-oidc-secret-secret.service" ]; + }; + # Fix BASE_URL for downloading backups systemd.services.mealie.environment.BASE_URL = lib.mkForce "https://${hostnames.recipes}";