Working on raw-logs with OAuth support

systems/edge-nodes/modules/caddy.nix

@@ -93,34 +93,35 @@
       variables_order = EGPCS
     '';
     pools = {
-    php-caddy = {
-      user = "php-caddy";
-      group = "caddy";
-      phpPackage = pkgs.php83;
-      settings = {
-        "pm" = "dynamic";
-        "pm.max_children" = 75;
-        "pm.start_servers" = 10;
-        "pm.min_spare_servers" = 5;
-        "pm.max_spare_servers" = 20;
-        "pm.max_requests" = 500;
-        "listen.owner" = config.services.caddy.user;
-        "listen.group" = config.services.caddy.group;
+      php-caddy = {
+        user = "php-caddy";
+        group = "caddy";
+        phpPackage = pkgs.php83;
+        settings = {
+          "pm" = "dynamic";
+          "pm.max_children" = 75;
+          "pm.start_servers" = 10;
+          "pm.min_spare_servers" = 5;
+          "pm.max_spare_servers" = 20;
+          "pm.max_requests" = 500;
+          "listen.owner" = config.services.caddy.user;
+          "listen.group" = config.services.caddy.group;
+        };
       };
     };
   };
-  };
-  age.secrets.phpbb_db.file = ../secrets/phpbb_db.age;
+  age.secrets.caddy-edge.file = ../secrets/caddy.age;
   systemd.services.caddy = {
     serviceConfig = {
-      EnvironmentFile = config.age.secrets.phpbb_db.path;
+      EnvironmentFile = config.age.secrets.caddy-edge.path;
     };
   };
   services.caddy = {
     enable = true;
     package = pkgs-unstable.caddy.withPlugins {
       plugins = [
         "github.com/WeidiDeng/[email protected]" # Module to retrieve trusted proxy IPs from cloudflare
+        "github.com/greenpau/caddy-security" # Security module that provides OAuth
       ];
       hash = "sha256-o/A1YSVSfUvwaepb7IusiwCt2dAGmzZrtM3cb8i8Too=";
     };
@@ -146,6 +147,43 @@
         useACMEHost = "tgstation13.org";
         extraConfig = ''
           encode gzip zstd
+          order authenticate before respond
+          order authorize before basicauth
+          security {
+              oauth identity provider tgstation {
+                realm tg
+                driver generic
+                client_id {env.TG_OAUTH_RAWLOGS_CLIENT_ID}
+                client_secret {env.TG_OAUTH_RAWLOGS_CLIENT_SECRET}
+                scopes user user.groups
+                base_auth_url https://forums.tgstation13.org/app.php/tgapi/oauth/auth
+              }
+
+          authentication portal tgstation {
+                enable identity provider tgstation
+                cookie domain raw-logs.tgstation13.org
+                ui {
+                  links {
+                    "My Identity" "/whoami" icon "las la-user"
+                  }
+                }
+
+                transform user {
+                  match realm tg
+                  action add role authp/user
+                }
+
+                transform user {
+                  match realm tg
+                }
+              }
+              authorization policy raw-logs {
+                set auth url https://forums.tgstation13.org/app.php/tgapi/oauth/auth
+                allow roles authp/admin authp/user
+                validate bearer header
+                inject headers with claims
+              }
+          }
           root ${
             toString inputs.tgstation-website.packages.x86_64-linux.default
           }
@@ -159,6 +197,11 @@
             root /run/tgstation-website-v2/serverinfo.json
             file_server
           }
+          handle_path /raw-logs {
+            authorize with raw-logs
+            root /run/tgstation-website-v2/serverinfo.json
+            file_server
+          }
           redir /phpBB/ https://forums.tgstation13.org/
           redir /phpBB/*.php* https://forums.tgstation13.org/{http.request.orig_uri.path.file}?{http.request.orig_uri.query}{http.request.orig_uri.path.*/}
         '';

systems/edge-nodes/secrets/secrets.nix

@@ -21,5 +21,5 @@ in {
   # TODO: Move to a shared secret (somehow)
   "tgstation-pr-announcer.age".publicKeys = users ++ frontend_systems;
   "tailscaleAuthKey.age".publicKeys = users ++ systems;
-  "phpbb_db.age".publicKeys = users ++ frontend_systems;
+  "caddy.age".publicKeys = users ++ frontend_systems;
 }