colin/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #250638 from benley/keycloak-systemd-notify

Browse Source 
nixos/keycloak: Add systemd startup notification
This commit is contained in:
Jade Lovelace 2024-05-15 14:13:20 -07:00 committed by GitHub
commit f05ecf16e6
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 36 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
nixos/modules/services/security/oauth2-proxy.nix
View File

@ -577,20 +577,22 @@ in
users.groups.oauth2-proxy = {};
systemd.services.oauth2-proxy = {
description = "OAuth2 Proxy";
path = [ cfg.package ];
wantedBy = [ "multi-user.target" ];
wants = [ "network-online.target" ];
after = [ "network-online.target" ];
systemd.services.oauth2-proxy =
let needsKeycloak = lib.elem cfg.provider ["keycloak" "keycloak-oidc"]
&& config.services.keycloak.enable;
in {
description = "OAuth2 Proxy";
path = [ cfg.package ];
wantedBy = [ "multi-user.target" ];
wants = [ "network-online.target" ] ++ lib.optionals needsKeycloak [ "keycloak.service" ];
after = [ "network-online.target" ] ++ lib.optionals needsKeycloak [ "keycloak.service" ];
serviceConfig = {
User = "oauth2-proxy";
Restart = "always";
ExecStart = "${cfg.package}/bin/oauth2-proxy ${configString}";
EnvironmentFile = lib.mkIf (cfg.keyFile != null) cfg.keyFile;
serviceConfig = {
User = "oauth2-proxy";
Restart = "always";
ExecStart = "${cfg.package}/bin/oauth2-proxy ${configString}";
EnvironmentFile = lib.mkIf (cfg.keyFile != null) cfg.keyFile;
};
};
};
};
}

5
nixos/modules/services/web-apps/keycloak.nix
View File

@ -466,7 +466,8 @@ in
confFile = pkgs.writeText "keycloak.conf" (keycloakConfig filteredConfig);
keycloakBuild = cfg.package.override {
inherit confFile;
plugins = cfg.package.enabledPlugins ++ cfg.plugins;
plugins = cfg.package.enabledPlugins ++ cfg.plugins ++
(with cfg.package.plugins; [quarkus-systemd-notify quarkus-systemd-notify-deployment]);
};
in
mkIf cfg.enable
@ -638,6 +639,8 @@ in
RuntimeDirectory = "keycloak";
RuntimeDirectoryMode = "0700";
AmbientCapabilities = "CAP_NET_BIND_SERVICE";
Type = "notify"; # Requires quarkus-systemd-notify plugin
NotifyAccess = "all";
};
script = ''
set -o errexit -o pipefail -o nounset -o errtrace

18
pkgs/servers/keycloak/all-plugins.nix
View File

@ -1,4 +1,4 @@
{ callPackage }:
{ callPackage, fetchMavenArtifact }:
{
scim-for-keycloak = callPackage ./scim-for-keycloak {};
@ -6,4 +6,20 @@
keycloak-discord = callPackage ./keycloak-discord {};
keycloak-metrics-spi = callPackage ./keycloak-metrics-spi {};
keycloak-restrict-client-auth = callPackage ./keycloak-restrict-client-auth {};
# These could theoretically be used by something other than Keycloak, but
# there are no other quarkus apps in nixpkgs (as of 2023-08-21)
quarkus-systemd-notify = (fetchMavenArtifact {
groupId = "io.quarkiverse.systemd.notify";
artifactId = "quarkus-systemd-notify";
version = "1.0.1";
hash = "sha256-3I4j22jyIpokU4kdobkt6cDsALtxYFclA+DV+BqtmLY=";
}).passthru.jar;
quarkus-systemd-notify-deployment = (fetchMavenArtifact {
groupId = "io.quarkiverse.systemd.notify";
artifactId = "quarkus-systemd-notify-deployment";
version = "1.0.1";
hash = "sha256-xHxzBxriSd/OU8gEcDG00VRkJYPYJDfAfPh/FkQe+zg=";
}).passthru.jar;
}