3 files changed, 50 insertions, 0 deletions
diff --git a/system/file_system_layouts/default.nix b/system/file_system_layouts/default.nix
index 31b0b0b..4cd9ff1 100644
--- a/system/file_system_layouts/default.nix
+++ b/system/file_system_layouts/default.nix
@@ -44,6 +44,10 @@ in {
         device = "/srv/acme";
         options = ["bind"];
       };
+      "/var/lib/postgresql" = {
+        device = "/srv/postgresql";
+        options = ["bind"];
+      };
     };
   };
 }
diff --git a/system/services/default.nix b/system/services/default.nix
index d80bdab..99b8fb6 100644
--- a/system/services/default.nix
+++ b/system/services/default.nix
@@ -2,6 +2,7 @@
   imports = [
     ./acme
     #  ./firewall
+    ./keycloak
     #./minecraft
     ./nginx
     ./nix
diff --git a/system/services/keycloak/default.nix b/system/services/keycloak/default.nix
new file mode 100644
index 0000000..dfeabc3
--- /dev/null
+++ b/system/services/keycloak/default.nix
@@ -0,0 +1,45 @@
+{config, ...}: {
+  services.nginx = {
+    enable = true;
+
+    # enable recommended settings
+    recommendedGzipSettings = true;
+    recommendedOptimisation = true;
+    recommendedTlsSettings = true;
+    recommendedProxySettings = true;
+
+    virtualHosts = {
+      "auth.vhack.eu" = {
+        forceSSL = true;
+        enableACME = true;
+        locations = {
+          "/" = {
+            proxyPass = "http://localhost:${toString config.services.keycloak.settings.http-port}/";
+          };
+        };
+      };
+    };
+  };
+
+  services.postgresql.enable = true;
+
+  services.keycloak = {
+    enable = true;
+
+    database = {
+      type = "postgresql";
+      createLocally = true;
+
+      username = "keycloak";
+      passwordFile = "/srv/keycloak/password";
+    };
+
+    settings = {
+      hostname = "auth.vhack.eu";
+      http-relative-path = "/";
+      http-port = 38080;
+      proxy = "passthrough";
+      http-enabled = true;
+    };
+  };
+}