Grafana is onboarded as the first OIDC relying party. The public TLS
certificate is issued to nginx by ACME and copied into /var/lib/kanidm by
the certificate's postRun hook, because kanidm has no plaintext listener
and haproxy forwards 443 by SNI.

@@ -9,0 +12,4 @@
+  oauthRoles = {
+    editors = [ "Editor" ];
+    admins = [ "Admin" ];
+    server-admins = [ "GrafanaAdmin" ];

@@ -124,2 +141,4 @@
       };
 
+    # Single sign-on through kanidm. The local admin account stays available as a fallback.
+    qois.kanidm.oauth2Clients.grafana = mkIf kanidm.enable {

@@ -81,12 +82,30 @@ in
         qois.prometheus.enable = true;
         qois.loki.enable = true;
 
+        qois.kanidm = {

@@ -0,0 +2,4 @@
+
+[Kanidm](https://kanidm.github.io/kanidm/stable/) runs on `lindberg-webapps` and serves
+[id.qo.is](https://id.qo.is). It is the identity provider for services that support OIDC;
+Grafana is currently the only relying party.

@@ -0,0 +4,4 @@
+[id.qo.is](https://id.qo.is). It is the identity provider for services that support OIDC;
+Grafana is currently the only relying party.
+
+Persons are **not** provisioned from this repository — create them in the web UI. Groups

@@ -0,0 +21,4 @@
+  '["kanidm"]["oauth2"]["grafana"]' "\"$(tr -dc 'A-Za-z0-9' </dev/urandom | head -c 48)\""
+```
+
+Afterwards publish the submodule as described in [the README](../../README.md):

@@ -0,0 +36,4 @@
+
+Both passwords are re-applied on every start, so changing them in sops is enough.
+
+## First Deploy

@@ -0,0 +52,4 @@
+
+## Administration
+
+Log in at [id.qo.is/ui](https://id.qo.is/ui) as `idm_admin` with the password from sops to

@@ -0,0 +59,4 @@
+Group membership is appended by provisioning, never overwritten, so members added in the
+UI survive a redeploy. Removing a declared group from the repository does delete it.
+
+## Onboarding a Service

@@ -0,0 +78,4 @@
+and a sops secret `kanidm/oauth2/<service>` readable by kanidm and the service. Add the
+secret as shown above before deploying.
+
+## LDAP

@@ -0,0 +94,4 @@
+## Backup / Restore
+
+`/var/lib/kanidm` is part of the borg backup and holds both the live database and the
+nightly online backups kanidm writes to `/var/lib/kanidm/backups` (7 versions kept). Only

@@ -0,0 +29,4 @@
+
+  cfg = config.qois.kanidm;
+
+  stateDir = "/var/lib/kanidm";

@@ -0,0 +92,4 @@
+
+    package = mkOption {
+      type = package;
+      default = pkgs.kanidmWithSecretProvisioning_1_11;

@@ -0,0 +236,4 @@
+          tls_key = tlsKey;
+          http_client_address_info.x-forward-for = [ "::1" ];
+          # Consistent database snapshots; copying the live sqlite file is not restore-safe.
+          online_backup.versions = 7;

@@ -0,0 +266,4 @@
+
+    # The certificate only appears once ACME has issued it for the first time, so kanidm
+    # keeps retrying until nginx' certificate has been copied over.
+    systemd.services.kanidm.serviceConfig = {

@@ -0,0 +271,4 @@
+      RestartSec = 60;
+    };
+
+    systemd.tmpfiles.settings."10-qois-kanidm".${stateDir}.d = {

@@ -0,0 +48,4 @@
+          };
+        };
+
+        # TODO: Migrate this to the testing helper acme server

@@ -17,2 +17,4 @@
         private.nixosModules.default
       ];
+
+      qois.kanidm.secretsFile = "${private}/nixos-modules/kanidm/${config.networking.hostName}.sops.yaml";

@@ -77,2 +77,4 @@
           enable = true;
           domain = serverDomain;
+          # Single sign-on is covered by the kanidm-grafana module test.
+          sso.enable = false;

@@ -0,0 +4,4 @@
+  ...
+}:
+# Binds grafana to kanidm as an OIDC relying party. Both sides may live on different
+# hosts, so each half activates on its own and the shared client secret is declared here.

@@ -0,0 +86,4 @@
+  };
+
+  config = mkIf cfg.enable (mkMerge [
+    # The client is provisioned wherever kanidm runs, even if grafana runs on another host.

@@ -0,0 +91,4 @@
+    })
+
+    (mkIf configureGrafana {
+      qois.grafana.sso.secretFile = config.sops.secrets.${secretName}.path;

@@ -0,0 +125,4 @@
+      sops.secrets.${secretName} = {
+        sopsFile = kanidm.secretsFile;
+        mode = "0440";
+        owner = if kanidm.enable then "kanidm" else config.users.users.grafana.name;

@@ -0,0 +36,4 @@
+      };
+
+      qois.kanidm = {
+        enable = true;

@@ -0,0 +60,4 @@
+
+      qois.postgresql.package = pkgs.postgresql;
+
+      # Dummy sops file so secret paths resolve at eval time; nothing reads them at

@@ -0,0 +62,4 @@
+
+  installCert = pkgs.writeShellScript "kanidm-install-cert" ''
+    # Runs before kanidm's first start, so systemd has not created StateDirectory yet.
+    ${pkgs.coreutils}/bin/install -d -o kanidm -g kanidm -m 0700 ${stateDir}

@@ -0,0 +93,4 @@
+      type = port;
+      default = 636;
+      description = ''
+        Port of the LDAPS interface. No firewall port is opened for it, so it is only

@@ -0,0 +182,4 @@
+            '';
+          };
+
+          extraSettings = mkOption {

@@ -0,0 +231,4 @@
+      "kanidm/idm-admin-password".owner = "kanidm";
+    };
+
+    # postRun of this unit installs the certificate kanidm needs to start.

@@ -0,0 +240,4 @@
+    };
+
+    security.acme.certs.${cfg.domain} = {
+      postRun = "${installCert}";

@@ -0,0 +250,4 @@
+      { sources = [ "https://${cfg.domain}:443" ]; }
+    ];
+
+    networking.hosts."127.0.0.1" = [ cfg.domain ];

@@ -0,0 +62,4 @@
+
+        sops.secrets = mkForce { };
+        # Covered by the kanidm-grafana module test, and it would need a sops secret here.
+        qois.grafana.sso.enable = false;

@@ -0,0 +69,4 @@
+          443
+        ];
+
+        qois.telegraf.enable = mkForce true;

@@ -0,0 +34,4 @@
+    download_ca(client, caDomain)
+
+    with subtest("acme-certificate"):
+        # postRun installed the issued certificate where kanidm reads it.

@@ -0,0 +80,4 @@
+    with subtest("ldaps-port-isolation"):
+        client.fail(ldapsearch(serverDomain))
+
+    with subtest("telegraf-metrics"):

@@ -0,0 +7,4 @@
+  inherit (lib.types) path;
+in
+{
+  options.qois.sharedSecretsFile = mkOption {