feat(modules/akkoma): support OAuth login

1 files changed, 67 insertions, 1 deletions

diff --git a/modules/services/akkoma/default.nix b/modules/services/akkoma/default.nix
index 91aa2e8..3671cb4 100644
--- a/modules/services/akkoma/default.nix
+++ b/modules/services/akkoma/default.nix
@@ -15,6 +15,9 @@ in
     domain = mkOption { type = types.str; };
     realHost = mkOption { type = types.str; };
     instanceName = mkOption { type = types.str; default = "Akkoma on ${cfg.domain}"; };
+
+    oauthBaseUrl = mkOption { type = types.str; default = "Base URL of the OAuth provider"; };
+    secrets.akkoma-envs = mkOption { type = types.str; default = "Path to the akkoma environment file"; };
   };
 
   config = mkIf cfg.enable {
@@ -22,6 +25,43 @@ in
 
     services.akkoma = {
       enable = true;
+      package = pkgs.akkoma.overrideAttrs (old: {
+        # Akkoma doesn't include OAuth2 dependencies by default
+        # This can be obtained by running `OAUTH_CONSUMER_STRATEGIES="..." mix deps.get`.
+        # The server should also be launched with the same environment variable set.
+        nativeBuildInputs = let
+          inherit (pkgs.beamPackages) fetchHex buildMix;
+          oldMixDeps = old.passthru.mixNixDeps;
+        in old.nativeBuildInputs ++ builtins.attrValues rec {
+          # TODO: This needs to be bumped from time to time
+          oauth2 = buildMix rec {
+            name = "oauth2";
+            version = "2.1.0";
+
+            src = fetchHex {
+              pkg = name;
+              inherit version;
+              sha256 = "0h9bps7gq7bac5gc3q0cgpsj46qnchpqbv5hzsnd2z9hnf2pzh4a";
+            };
+
+            beamDeps = [ oldMixDeps.tesla ];
+          };
+          ueberauth_keycloak_strategy = buildMix rec {
+            name = "ueberauth_keycloak_strategy";
+            version = "0.4.0";
+
+            src = fetchHex {
+              pkg = name;
+              inherit version;
+              sha256 = "06r10w0azlpypjgggar1lf7h2yazn2dpyicy97zxkjyxgf9jfc60";
+            };
+
+            beamDeps = [ oauth2 oldMixDeps.ueberauth ];
+          };
+        };
+        OAUTH_CONSUMER_STRATEGIES = "keycloak:ueberauth_keycloak_strategy";
+      });
+
       initDb.enable = true;
 
       extraStatic = {
@@ -33,7 +73,7 @@ in
         "favicon.png" = wrapFile "favicon.png" ./favicon-withbg.png;
       };
       config =
-        let inherit ((pkgs.formats.elixirConf { }).lib) mkRaw mkMap;
+        let inherit ((pkgs.formats.elixirConf { }).lib) mkRaw mkMap mkTuple;
         in {
           ":pleroma"."Pleroma.Web.Endpoint".url.host = cfg.realHost;
           ":pleroma"."Pleroma.Web.WebFinger".domain = cfg.domain;
@@ -53,6 +93,9 @@ in
           ":pleroma".":frontend_configurations" = {
             pleroma_fe = mkMap {
               logo = "/static/logo.png";
+              # FIXME: https://akkoma.dev/AkkomaGang/akkoma/pulls/668
+              # TODO: enable on next release
+              # loginMethod = "token";
             };
           };
           ":pleroma".":mrf" = {
@@ -67,6 +110,23 @@ in
             enabled = true;
             method = mkRaw "Pleroma.Captcha.Kocaptcha";
           };
+          ":ueberauth" = {
+            "Ueberauth.Strategy.Keycloak.OAuth" = {
+              client_id = mkRaw ''System.get_env("AUTHENTIK_CLIENT_ID")'';
+              client_secret = mkRaw ''System.get_env("AUTHENTIK_CLIENT_SECRET")'';
+              site = cfg.oauthBaseUrl;
+              authorize_url = "${cfg.oauthBaseUrl}/application/o/authorize/";
+              token_url = "${cfg.oauthBaseUrl}/application/o/token/";
+              userinfo_url = "${cfg.oauthBaseUrl}/application/o/userinfo/";
+              token_method = mkRaw ":post";
+            };
+            Ueberauth.providers = {
+              keycloak = mkTuple [(mkRaw "Ueberauth.Strategy.Keycloak") {
+                default_scope = "openid profile email";
+                uid_field = mkRaw ":preferred_username";
+              }];
+            };
+          };
         };
 
       nginx = {
@@ -85,6 +145,12 @@ in
       };
     };
 
+    systemd.services.akkoma = {
+      after = [ "authentik.service" ];
+      environment.OAUTH_CONSUMER_STRATEGIES = "keycloak:ueberauth_keycloak_strategy";
+      serviceConfig.EnvironmentFile = cfg.secrets.akkoma-envs;
+    };
+
     services.nginx.virtualHosts.${cfg.domain} = {
       forceSSL = true;
       useACMEHost = cfg.domain;