···

       
464
       
464
       
 
       


     

       
465
       
465
       
 
       
        access_control = {

     

       
466
       
466
       
 
       
          default_policy = "deny";

     

       
467
       
467
       
+
       
          # Rules are sequential and do not apply to OIDC

     

       
467
       
468
       
 
       
          rules = [

     

       
468
       
469
       
 
       
            {

     

       
469
       
469
       
-
       
              domain = "*.wiro.world";

     

       
470
       
470
       
+
       
              domain = "headscale.wiro.world";

     

       
471
       
471
       
+
       
              policy = "two_factor";

     

       
472
       
472
       
+
       


     

       
473
       
473
       
+
       
            }

     

       
474
       
474
       
+
       
            {

     

       
475
       
475
       
+
       
              domain = "news.wiro.world";

     

       
470
       
476
       
 
       
              policy = "one_factor";

     

       
477
       
477
       
+
       


     

       
478
       
478
       
+
       
              subject = [ [ "group:miniflux" "oauth2:client:miniflux" ] ];

     

       
479
       
479
       
+
       
            }

     

       
480
       
480
       
+
       
            {

     

       
481
       
481
       
+
       
              domain = "*.wiro.world";

     

       
482
       
482
       
+
       
              policy = "two_factor";

     

       
471
       
483
       
 
       
            }

     

       
472
       
484
       
 
       
          ];

     

       
473
       
485
       
 
       
        };

     

       
474
       
486
       
 
       


     

       
475
       
487
       
 
       
        identity_providers.oidc = {

     

       
476
       
488
       
 
       
          enforce_pkce = "always";

     

       
489
       
489
       
+
       


     

       
490
       
490
       
+
       
          authorization_policies =

     

       
491
       
491
       
+
       
            let

     

       
492
       
492
       
+
       
              mkStrictPolicy = policy: subject:

     

       
493
       
493
       
+
       
                { default_policy = "deny"; rules = [{ inherit policy subject; }]; };

     

       
494
       
494
       
+
       
            in

     

       
495
       
495
       
+
       
            {

     

       
496
       
496
       
+
       
              headscale = mkStrictPolicy "two_factor" [ "group:headscale" ];

     

       
497
       
497
       
+
       
              grafana = mkStrictPolicy "one_factor" [ "group:grafana" ];

     

       
498
       
498
       
+
       
              miniflux = mkStrictPolicy "one_factor" [ "group:miniflux" ];

     

       
499
       
499
       
+
       
            };

     

       
500
       
500
       
+
       


     

       
477
       
501
       
 
       
          clients = [

     

       
478
       
502
       
 
       
            {

     

       
479
       
503
       
 
       
              client_name = "Headscale";

     

       
480
       
504
       
 
       
              client_id = "headscale";

     

       
481
       
505
       
 
       
              client_secret = "$pbkdf2-sha256$310000$XY680D9gkSoWhD0UtYHNFg$ptWB3exOYCga6uq1N.oimuV3ILjK3F8lBWBpsBpibos";

     

       
482
       
482
       
-
       


     

       
483
       
483
       
-
       
              redirect_uris = [ "https://headscale.wiro.world/oidc/callback" ];

     

       
484
       
484
       
-
       
            }

     

       
485
       
485
       
-
       
            {

     

       
486
       
486
       
-
       
              client_name = "Grafana Console";

     

       
487
       
487
       
-
       
              client_id = "grafana";

     

       
488
       
488
       
-
       
              client_secret = "$pbkdf2-sha256$310000$UkwrqxTZodGMs9.Ca2cXAA$HCWFgQbFHGXZpuz.I3HHdkTZLUevRVGlhKEFaOlPmKs";

     

       
506
       
506
       
+
       
              redirect_uris = [ "https://${headscale-hostname}/oidc/callback" ];

     

       
489
       
507
       
 
       


     

       
490
       
490
       
-
       
              redirect_uris = [ "https://console.wiro.world/login/generic_oauth" ];

     

       
508
       
508
       
+
       
              authorization_policy = "headscale";

     

       
491
       
509
       
 
       
            }

     

       
492
       
510
       
 
       
            {

     

       
493
       
511
       
 
       
              client_name = "Tailscale";

     

       
494
       
512
       
 
       
              client_id = "tailscale";

     

       
495
       
513
       
 
       
              client_secret = "$pbkdf2-sha256$310000$PcUaup9aWKI9ZLeCF6.avw$FpsTxkDaxcoQlBi8aIacegXpjEDiCI6nXcaHyZ2Sxyc";

     

       
514
       
514
       
+
       
              redirect_uris = [ "https://login.tailscale.com/a/oauth_response" ];

     

       
496
       
515
       
 
       


     

       
497
       
497
       
-
       
              redirect_uris = [ "https://login.tailscale.com/a/oauth_response" ];

     

       
516
       
516
       
+
       
              authorization_policy = "headscale";

     

       
517
       
517
       
+
       
            }

     

       
518
       
518
       
+
       
            {

     

       
519
       
519
       
+
       
              client_name = "Grafana Console";

     

       
520
       
520
       
+
       
              client_id = "grafana";

     

       
521
       
521
       
+
       
              client_secret = "$pbkdf2-sha256$310000$UkwrqxTZodGMs9.Ca2cXAA$HCWFgQbFHGXZpuz.I3HHdkTZLUevRVGlhKEFaOlPmKs";

     

       
522
       
522
       
+
       
              redirect_uris = [ "https://${grafana-hostname}/login/generic_oauth" ];

     

       
523
       
523
       
+
       


     

       
524
       
524
       
+
       
              authorization_policy = "grafana";

     

       
498
       
525
       
 
       
            }

     

       
499
       
526
       
 
       
            {

     

       
500
       
527
       
 
       
              client_name = "Miniflux";

     

       
501
       
528
       
 
       
              client_id = "miniflux";

     

       
502
       
529
       
 
       
              client_secret = "$pbkdf2-sha256$310000$uPqbWfCOBXDY6nV1vsx3uA$HOWG2hL.c/bs9Dwaee3b9DxjH7KFO.SaZMbasXV9Vdw";

     

       
530
       
530
       
+
       
              redirect_uris = [ "https://${miniflux-hostname}/oauth2/oidc/callback" ];

     

       
503
       
531
       
 
       


     

       
504
       
504
       
-
       
              redirect_uris = [ "https://${miniflux-hostname}/oauth2/oidc/callback" ];

     

       
532
       
532
       
+
       
              authorization_policy = "miniflux";

     

       
505
       
533
       
 
       
            }

     

       
506
       
534
       
 
       
          ];

     

       
507
       
535
       
 
       
        };

     
···

       
576
       
604
       
 
       
      enable = true;

     

       
577
       
605
       
 
       


     

       
578
       
606
       
 
       
      createDatabaseLocally = true;

     

       
579
       
579
       
-
       
      adminCredentialsFile = config.age.secrets.miniflux-oidc-secret.path;

     

       
580
       
607
       
 
       
      config = {

     

       
581
       
608
       
 
       
        BASE_URL = "https://${miniflux-hostname}/";

     

       
582
       
609
       
 
       
        LISTEN_ADDR = "127.0.0.1:${toString miniflux-port}";

     

       
610
       
610
       
+
       
        CREATE_ADMIN = 0;

     

       
583
       
611
       
 
       


     

       
584
       
612
       
 
       
        # TODO: scrape metrics endpoint with prometheus

     

       
585
       
613
       
 
       


     
···

       
591
       
619
       
 
       
        OAUTH2_OIDC_DISCOVERY_ENDPOINT = "https://auth.wiro.world";

     

       
592
       
620
       
 
       
        OAUTH2_USER_CREATION = 1;

     

       
593
       
621
       
 
       
        DISABLE_LOCAL_AUTH = 1;

     

       
622
       
622
       
+
       


     

       
623
       
623
       
+
       
        RUN_MIGRATIONS = 1;

     

       
594
       
624
       
 
       


     

       
595
       
625
       
 
       
        # NetNewsWire is a very good iOS oss client that integrates well

     

       
596
       
626
       
 
       
        # https://b.j4.lc/2025/05/05/setting-up-netnewswire-with-miniflux/