jory
582faec359
- Replace age-based key decryption with automatic SSH host key support - Simplify SSH configuration with consolidated host entries and enhanced security settings - Upgrade home-manager to himmelblau for Microsoft Entra ID authentication - Remove legacy agenix inputs and consolidate secrets to essential services only - Add Cisco Secure Client overlay for enterprise VPN capabilities - Update secrets.yaml to minimal configuration with gitea/github/hetzner services - Expand system packages with tun module for VPN connectivity - Add work directory setup for user development environment
48 lines
1.4 KiB
Nix
48 lines
1.4 KiB
Nix
{ config, lib, pkgs, inputs, ... }:
|
|
|
|
# Himmelblau: Microsoft Entra ID authentication for Linux
|
|
#
|
|
# Authenticates Linux users against the digistate.nl Entra ID tenant.
|
|
# Users log in with their Entra ID credentials via OIDC Device Authorization
|
|
# Grant flow (browser-based) or the native PAM orchestrator.
|
|
#
|
|
# Requires:
|
|
# - A working Entra ID tenant with digistate.nl as a verified domain
|
|
# - An OIDC app registration (Himmelblau client) in the tenant
|
|
# - Network connectivity to login.microsoftonline.com
|
|
#
|
|
# References:
|
|
# - https://himmelblau-idm.org/docs/
|
|
# - https://github.com/himmelblau-idm/himmelblau
|
|
|
|
let
|
|
cfg = config.work.himmelblau;
|
|
in {
|
|
options.work.himmelblau = {
|
|
enable = lib.mkEnableOption "Himmelblau Entra ID authentication" // {
|
|
default = true;
|
|
};
|
|
};
|
|
|
|
config = lib.mkIf cfg.enable {
|
|
services.himmelblau = {
|
|
enable = true;
|
|
settings = {
|
|
domain = [ "digistate.nl" ];
|
|
# Uncomment and set to Entra ID group Object IDs or names to
|
|
# restrict which users can authenticate:
|
|
# pam_allow_groups = [ "ENTRA-GROUP-GUID-HERE" ];
|
|
};
|
|
};
|
|
|
|
# Himmelblau registers an NSS module (system.nssModules) for user/group lookups,
|
|
# which requires nscd to be enabled. Keep it on.
|
|
# services.nscd.enable = lib.mkForce false;
|
|
|
|
# Expose the aad-tool CLI for diagnostics and enrollment
|
|
environment.systemPackages = [
|
|
inputs.himmelblau.packages.${pkgs.system}.aad-tool
|
|
];
|
|
};
|
|
}
|