diff options
Diffstat (limited to 'modules/services')
| -rw-r--r-- | modules/services/akkoma/0001-fix-scope.patch | 28 | ||||
| -rw-r--r-- | modules/services/akkoma/default.nix | 17 |
2 files changed, 42 insertions, 3 deletions
diff --git a/modules/services/akkoma/0001-fix-scope.patch b/modules/services/akkoma/0001-fix-scope.patch new file mode 100644 index 0000000..a0f8780 --- /dev/null +++ b/modules/services/akkoma/0001-fix-scope.patch @@ -0,0 +1,28 @@ +From a72bafca8fae2d0663127fa07f44284598a3631a Mon Sep 17 00:00:00 2001 +From: sefidel <contact@sefidel.net> +Date: Tue, 20 Feb 2024 18:52:01 +0900 +Subject: [PATCH] fix scope + +Signed-off-by: sefidel <contact@sefidel.net> +--- + lib/ueberauth/strategy/keycloak.ex | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/lib/ueberauth/strategy/keycloak.ex b/lib/ueberauth/strategy/keycloak.ex +index fa6e84b..413b3d5 100644 +--- a/lib/ueberauth/strategy/keycloak.ex ++++ b/lib/ueberauth/strategy/keycloak.ex +@@ -71,8 +71,8 @@ defmodule Ueberauth.Strategy.Keycloak do + require Logger + + use Ueberauth.Strategy, +- uid_field: :id, +- default_scope: "api read_user read_registry", ++ uid_field: :preferred_username, ++ default_scope: "openid profile email", + oauth2_module: Ueberauth.Strategy.Keycloak.OAuth + + alias Ueberauth.Auth.Info +-- +2.43.0 + diff --git a/modules/services/akkoma/default.nix b/modules/services/akkoma/default.nix index 3671cb4..c2e9347 100644 --- a/modules/services/akkoma/default.nix +++ b/modules/services/akkoma/default.nix @@ -1,4 +1,4 @@ -{ config, lib, pkgs, ... }: +{ config, lib, pkgs, inputs, ... }: with lib; let @@ -12,6 +12,8 @@ in { options.modules.services.akkoma = { enable = mkEnableOption "Akkoma instance"; + package = mkOption { type = types.package; default = pkgs.akkoma; }; + domain = mkOption { type = types.str; }; realHost = mkOption { type = types.str; }; instanceName = mkOption { type = types.str; default = "Akkoma on ${cfg.domain}"; }; @@ -25,7 +27,7 @@ in services.akkoma = { enable = true; - package = pkgs.akkoma.overrideAttrs (old: { + package = cfg.package.overrideAttrs (old: { # Akkoma doesn't include OAuth2 dependencies by default # This can be obtained by running `OAUTH_CONSUMER_STRATEGIES="..." mix deps.get`. # The server should also be launched with the same environment variable set. @@ -56,6 +58,13 @@ in sha256 = "06r10w0azlpypjgggar1lf7h2yazn2dpyicy97zxkjyxgf9jfc60"; }; + # There must be a way to configure this using config.exs and patchPhase, + # But just applying a patch is easier since patching ueberauth and + # this package didn't do the trick. + patches = [ + ./0001-fix-scope.patch + ]; + beamDeps = [ oauth2 oldMixDeps.ueberauth ]; }; }; @@ -76,6 +85,7 @@ in let inherit ((pkgs.formats.elixirConf { }).lib) mkRaw mkMap mkTuple; in { ":pleroma"."Pleroma.Web.Endpoint".url.host = cfg.realHost; + ":pleroma"."Pleroma.Web.Endpoint".extra_cookie_attrs = [ "SameSite=Lax" ]; ":pleroma"."Pleroma.Web.WebFinger".domain = cfg.domain; ":pleroma".":media_proxy".enabled = false; ":pleroma".":instance" = { @@ -86,6 +96,7 @@ in notify_email = poorObfuscation cfg.domain "postmaster"; registrations_open = false; + account_approval_required = true; invites_enabled = true; limit = 5000; @@ -95,7 +106,7 @@ in logo = "/static/logo.png"; # FIXME: https://akkoma.dev/AkkomaGang/akkoma/pulls/668 # TODO: enable on next release - # loginMethod = "token"; + loginMethod = "token"; }; }; ":pleroma".":mrf" = { |