authelia: init at 4.37.5

Co-authored-by: Mostly Void <7rat13@gmail.com>

pkgs/servers/authelia/change-web-out-dir.patch

@@ -0,0 +1,13 @@
+diff --git a/vite.config.ts b/vite.config.ts
+index 659ba3e1..1f0afa5c 100644
+--- a/vite.config.ts
++++ b/vite.config.ts
+@@ -37,7 +37,7 @@ export default defineConfig(({ mode }) => {
+         base: "./",
+         build: {
+             sourcemap,
+-            outDir: "../internal/server/public_html",
++            outDir: "dist",
+             emptyOutDir: true,
+             assetsDir: "static",
+             rollupOptions: {

pkgs/servers/authelia/default.nix

@@ -0,0 +1,110 @@
+{ lib, fetchFromGitHub, buildGoModule, installShellFiles, buildNpmPackage }:
+
+buildGoModule rec {
+  pname = "authelia";
+  version = "4.37.5";
+
+  src = fetchFromGitHub {
+    owner = "authelia";
+    repo = "authelia";
+    rev = "v${version}";
+    sha256 = "sha256-xsdBnyPHFIimhp2rcudWqvVR36WN4vBXbxRmvgqMcDw=";
+  };
+  vendorSha256 = "sha256-mzGE/T/2TT4+7uc2axTqG3aeLMnt1r9Ya7Zj2jIkw/w=";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  web = buildNpmPackage {
+    inherit src version;
+
+    pname = "authelia-web";
+    sourceRoot = "source/web";
+
+    patches = [
+      ./change-web-out-dir.patch
+    ];
+
+    postPatch = ''
+      cp ${./package-lock.json} ./package-lock.json
+    '';
+
+    npmDepsHash = "sha256-MGs6UAxT5QZd8S3AO75mxuCb6U0UdRkGEjenOVj+Oqs=";
+
+    npmFlags = [ "--legacy-peer-deps" ];
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/share
+      mv dist $out/share/authelia-web
+
+      runHook postInstall
+    '';
+  };
+
+
+  postPatch = ''
+    cp -r ${web}/share/authelia-web/* internal/server/public_html
+  '';
+
+  subPackages = [ "cmd/authelia" ];
+
+  ldflags =
+    let
+      p = "github.com/authelia/authelia/v${lib.versions.major version}/internal/utils";
+    in
+    [
+      "-s"
+      "-w"
+      "-X ${p}.BuildTag=v${version}"
+      "-X '${p}.BuildState=tagged clean'"
+      "-X ${p}.BuildBranch=v${version}"
+      "-X ${p}.BuildExtra=nixpkgs"
+    ];
+
+  # several tests with networking and several that want chromium
+  doCheck = false;
+
+  postInstall = ''
+    mkdir -p $out/etc/authelia
+    cp config.template.yml $out/etc/authelia
+
+    installShellCompletion --cmd authelia \
+      --bash <($out/bin/authelia completion bash) \
+      --fish <($out/bin/authelia completion fish) \
+      --zsh <($out/bin/authelia completion zsh)
+  '';
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    $out/bin/authelia --help
+    $out/bin/authelia --version | grep "v${version}"
+    $out/bin/authelia build-info | grep 'v${version}\|nixpkgs'
+
+    runHook postInstallCheck
+  '';
+
+  passthru = {
+    # if overriding replace the postPatch to put your web UI output in internal/server/public_html
+    inherit web;
+    updateScript = ./update.sh;
+  };
+
+  meta = with lib; {
+    homepage = "https://www.authelia.com/";
+    changelog = "https://github.com/authelia/authelia/releases/tag/v${version}";
+    description = "A Single Sign-On Multi-Factor portal for web apps";
+    longDescription = ''
+      Authelia is an open-source authentication and authorization server
+      providing two-factor authentication and single sign-on (SSO) for your
+      applications via a web portal. It acts as a companion for reverse proxies
+      like nginx, Traefik, caddy or HAProxy to let them know whether requests
+      should either be allowed or redirected to Authelia's portal for
+      authentication.
+    '';
+    license = licenses.asl20;
+    maintainers = with maintainers; [ jk raitobezarius dit7ya ];
+  };
+}

pkgs/servers/authelia/update.sh

@@ -0,0 +1,59 @@
+#! /usr/bin/env nix-shell
+#! nix-shell -I nixpkgs=./. -i bash -p coreutils gnused nix nix-update nodePackages.npm
+set -euo pipefail
+
+DRV_DIR="$(dirname "${BASH_SOURCE[0]}")"
+DRV_DIR=$(realpath $DRV_DIR)
+NIXPKGS_ROOT="$DRV_DIR/../../.."
+NIXPKGS_ROOT=$(realpath $NIXPKGS_ROOT)
+
+instantiateClean() {
+    nix-instantiate --eval --strict -E "with import ./. {}; $1" | cut -d\" -f2
+}
+fetchNewSha() {
+    set +eo pipefail
+    nix-build -A "$1" 2>&1 >/dev/null | grep "got:" | cut -d':' -f2 | sed 's| ||g'
+    set -eo pipefail
+}
+replace() {
+    sed -i "s@$1@$2@g" "$3"
+}
+
+grab_version() {
+    instantiateClean "authelia.version"
+}
+
+OLD_VERSION=$(instantiateClean "authelia.version")
+
+nix-update authelia
+
+NEW_VERSION=$(instantiateClean "authelia.version")
+if [[ "$OLD_VERSION" == "$NEW_VERSION" ]]; then
+    echo "already up to date"
+    exit
+fi
+
+# build package-lock.json since authelia uses pnpm
+# since they hard pin dependencies in package.json we can be pretty confident that versions will match
+WEB_DIR=$(mktemp -d)
+clean_up() {
+  rm -rf "$WEB_DIR"
+}
+trap clean_up EXIT
+
+OLD_PWD=$PWD
+cd $WEB_DIR
+OUT=$(nix-build -E "with import $NIXPKGS_ROOT {}; authelia.src" --no-out-link)
+cp -r $OUT/web/package.json .
+npm install --package-lock-only --legacy-peer-deps --ignore-scripts
+mv package-lock.json "$DRV_DIR/"
+
+cd $OLD_PWD
+OLD_HASH="$(instantiateClean authelia.web.npmDepsHash)"
+echo "Old hash $OLD_HASH"
+TMP_HASH="sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="
+replace "$OLD_HASH" "$TMP_HASH" "$DRV_DIR/default.nix"
+NEW_HASH="$(fetchNewSha authelia.web)"
+echo "New hash $NEW_HASH"
+replace "$TMP_HASH" "$NEW_HASH" "$DRV_DIR/default.nix"
+clean_up

pkgs/top-level/all-packages.nix

@@ -2830,6 +2830,8 @@ with pkgs;
     wrapGAppsHook4 = wrapGAppsHook.override { gtk3 = gtk4; };
    };
 
+  authelia = callPackage ../servers/authelia { };
+
   autoflake = with python3.pkgs; toPythonApplication autoflake;
 
   autospotting = callPackage ../applications/misc/autospotting { };