jawz/NixOS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add SOPS secrets for Keycloak database password and update configuration

Browse Source
This commit is contained in:
Danilo Reyes
2025-12-10 02:12:06 -06:00
parent 2cd3afe2b3
commit 303cd2db36
1 changed files with 13 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
modules/servers/keycloak.nix
View File

@@ -16,17 +16,20 @@ in
owner = "keycloak"; owner = "keycloak";
group = "keycloak"; group = "keycloak";
}; };
sops.secrets."keycloak/db_password" = {
sopsFile = ../../secrets/secrets.yaml;
owner = "keycloak";
group = "keycloak";
};
services.keycloak = { services.keycloak = {
inherit (cfg) enable; inherit (cfg) enable;
database = { database = {
type = "postgresql"; type = "postgresql";
host = config.my.postgresSocket; host = "localhost";
createLocally = false;
username = "keycloak"; username = "keycloak";
name = "keycloak"; name = "keycloak";
}; passwordFile = config.sops.secrets."keycloak/db_password".path;
initialAdmin = {
user = "admin";
passwordFile = config.sops.secrets."keycloak/admin_password".path;
}; };
settings = { settings = {
hostname = cfg.host; hostname = cfg.host;
@@ -35,7 +38,11 @@ in
"http-enabled" = true; "http-enabled" = true;
"http-port" = cfg.port; "http-port" = cfg.port;
"proxy" = "edge"; "proxy" = "edge";
"frontend-url" = cfg.url; };
};
systemd.services.keycloak = {
serviceConfig = {
EnvironmentFile = config.sops.secrets."keycloak/admin_password".path;
}; };
}; };
services.nginx.virtualHosts.${cfg.host} = services.nginx.virtualHosts.${cfg.host} =