From 878759cb7740908613e20f09a5fa9ce36a4c0546 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 30 Aug 2021 14:17:18 +0200
Subject: [PATCH] secrets: add sso

---
 secrets/default.nix                     |   2 ++
 secrets/sso/.gitattributes              |   1 +
 secrets/sso/ambroisie/password-hash.txt | Bin 0 -> 83 bytes
 secrets/sso/ambroisie/totp-secret.txt   | Bin 0 -> 75 bytes
 secrets/sso/auth-key.txt                | Bin 0 -> 151 bytes
 secrets/sso/default.nix                 |  21 +++++++++++++++++++++
 6 files changed, 24 insertions(+)
 create mode 100644 secrets/sso/.gitattributes
 create mode 100644 secrets/sso/ambroisie/password-hash.txt
 create mode 100644 secrets/sso/ambroisie/totp-secret.txt
 create mode 100644 secrets/sso/auth-key.txt
 create mode 100644 secrets/sso/default.nix

diff --git a/secrets/default.nix b/secrets/default.nix
index d0c891c..5b6c94b 100644
--- a/secrets/default.nix
+++ b/secrets/default.nix
@@ -58,6 +58,8 @@ throwOnCanary {
 
     podgrab.password = fileContents ./podgrab/password.txt;
 
+    sso = import ./sso { inherit lib; };
+
     transmission.password = fileContents ./transmission/password.txt;
 
     users = {
diff --git a/secrets/sso/.gitattributes b/secrets/sso/.gitattributes
new file mode 100644
index 0000000..d4bba55
--- /dev/null
+++ b/secrets/sso/.gitattributes
@@ -0,0 +1 @@
+/default.nix filter diff
diff --git a/secrets/sso/ambroisie/password-hash.txt b/secrets/sso/ambroisie/password-hash.txt
new file mode 100644
index 0000000000000000000000000000000000000000..9b2c759b3116766d1b2f9ca81a6cf31c5e1dbb1b
GIT binary patch
literal 83
zcmV-Z0IdH2M@dveQdv+`0QO7Jb4IU#&fimU=1__SruRsHjtFV=&@?F<GqU}Ks9B`d
pkN$_m!oe=3v9ZZFm=Yyl08!YK^pOSp{DqAAib1l-D)~XO3toa5De?dS

literal 0
HcmV?d00001

diff --git a/secrets/sso/ambroisie/totp-secret.txt b/secrets/sso/ambroisie/totp-secret.txt
new file mode 100644
index 0000000000000000000000000000000000000000..2a4d10a94ff22c470d542d3931eca5535d968be8
GIT binary patch
literal 75
zcmV-R0JQ%AM@dveQdv+`0C<j|{$-_tzBV4lNN>9WZfM@*={LN!s_o-%^D|Q(u<P+j
h9Wk-`E%rX_SRqbjq(fuOIk~j%#qx7h{%Ky{?=(*HCei=^

literal 0
HcmV?d00001

diff --git a/secrets/sso/auth-key.txt b/secrets/sso/auth-key.txt
new file mode 100644
index 0000000000000000000000000000000000000000..785d8d0f92f43a3dfa95dd856655a33beb176a20
GIT binary patch
literal 151
zcmV;I0BHXJM@dveQdv+`0G;PH+psdt`~GMOWA5PNO=<(Yn|3F_v+^47Pa@Yz=5`bG
zw-5-7V)4_6M43DZ@yG)4`pWw*YVXjL#kNf<f3*u93`Q(bneND!Jos|zf)#Yd5=f{?
z1s3~8;y55KNWGjDoLHHGXXt28=M)NYzjDegl<^|kxXsZ_M6Ri98lA`KM~adJhZUNI
F1fU9iN&Wx;

literal 0
HcmV?d00001

diff --git a/secrets/sso/default.nix b/secrets/sso/default.nix
new file mode 100644
index 0000000..e65a55b
--- /dev/null
+++ b/secrets/sso/default.nix
@@ -0,0 +1,21 @@
+{ lib }:
+let
+  inherit (lib) fileContents;
+  importUser = (user: {
+    # bcrypt hashed: `htpasswd -BnC 10 ""`
+    passwordHash = fileContents (./. + "/${user}/password-hash.txt");
+    # base32 encoded: `printf '<secret>' | base32  | tr -d =`
+    totpSecret = fileContents (./. + "/${user}/totp-secret.txt");
+  });
+in
+{
+  auth_key = fileContents ./auth-key.txt;
+
+  users = lib.flip lib.genAttrs importUser [
+    "ambroisie"
+  ];
+
+  groups = {
+    root = [ "ambroisie" ];
+  };
+}