Split gopkgs

components/gopkgs.nix

@@ -36,6 +36,12 @@ buildGo123Module {
       ))
     );
   };
+  outputs = [
+    "out"
+    "ldap"
+    "proxy"
+    "radius"
+  ];
   subPackages = [
     "cmd/ldap"
     "cmd/server"
@@ -48,5 +54,10 @@ buildGo123Module {
   postInstall = ''
     wrapProgram $out/bin/server --prefix PATH : ${authentikComponents.pythonEnv}/bin
     wrapProgram $out/bin/server --prefix PYTHONPATH : ${authentikComponents.staticWorkdirDeps}
+
+    mkdir -p $ldap/bin $proxy/bin $radius/bin
+    mv $out/bin/ldap $ldap/bin/
+    mv $out/bin/proxy $proxy/bin/
+    mv $out/bin/radius $radius/bin/
   '';
 }

module.nix

@@ -128,6 +128,29 @@ in
       };
     };
 
+    # Proxy oupost
+    authentik-proxy = {
+      enable = mkEnableOption "authentik Proxy outpost";
+
+      environmentFile = mkOption {
+        type = types.nullOr pathToSecret;
+        default = null;
+        example = "/run/secrets/authentik-proxy/authentik-proxy-env";
+        description = ''
+          Environment file as defined in {manpage}`systemd.exec(5)`.
+
+          Secrets may be passed to the service without adding them to the world-readable
+          /nix/store, by specifying the desied secrets as environment variables according
+          to the authentic documentation.
+
+          ```
+            # example content
+            AUTHENTIK_TOKEN=<token from authentik for this outpost>
+          ```
+        '';
+      };
+    };
+
     # RADIUS oupost
     authentik-radius = {
       enable = mkEnableOption "authentik RADIUS outpost";
@@ -348,7 +371,33 @@ in
             UMask = "0027";
             WorkingDirectory = "%t/authentik-ldap";
             DynamicUser = true;
-            ExecStart = "${config.services.authentik.authentikComponents.gopkgs}/bin/ldap";
+            ExecStart = "${config.services.authentik.authentikComponents.gopkgs.ldap}/bin/ldap";
+            EnvironmentFile = mkIf (cfg.environmentFile != null) [ cfg.environmentFile ];
+            Restart = "on-failure";
+          };
+        };
+      }
+    ))
+
+    # Proxy outpost
+    (mkIf config.services.authentik-proxy.enable (
+      let
+        cfg = config.services.authentik-proxy;
+      in
+      {
+        systemd.services.authentik-proxy = {
+          wantedBy = [ "multi-user.target" ];
+          wants = [ "network-online.target" ];
+          after = [
+            "network-online.target"
+            "authentik.service"
+          ];
+          serviceConfig = {
+            RuntimeDirectory = "authentik-proxy";
+            UMask = "0027";
+            WorkingDirectory = "%t/authentik-proxy";
+            DynamicUser = true;
+            ExecStart = "${config.services.authentik.authentikComponents.gopkgs.proxy}/bin/proxy";
             EnvironmentFile = mkIf (cfg.environmentFile != null) [ cfg.environmentFile ];
             Restart = "on-failure";
           };
@@ -374,7 +423,7 @@ in
             UMask = "0027";
             WorkingDirectory = "%t/authentik-radius";
             DynamicUser = true;
-            ExecStart = "${config.services.authentik.authentikComponents.gopkgs}/bin/radius";
+            ExecStart = "${config.services.authentik.authentikComponents.gopkgs.radius}/bin/radius";
             EnvironmentFile = mkIf (cfg.environmentFile != null) [ cfg.environmentFile ];
             Restart = "on-failure";
           };