nixos/hosts/architect/openid.nix

{ lib }:

{
  openresty_oidc_block =
    { access_role ? "", whitelisted_ips ? [ ] }: ''
      
    '';
    #   access_by_lua_block {
    #     local opts = {
    #       discovery = "https://auth.giugl.io/realms/master/.well-known/openid-configuration",
    #       client_id = "nginx",
    #       client_secret = "9C6BYxPhTbrRS4DIwd3Smk7e11ABmnt8",
    #       logout_path = "/logout",
    #       redirect_after_logout_uri = "/",
    #       redirect_uri = "/redirect_uri",
    #       keepalive = "yes",
    #       accept_none_alg = true,
    #       revoke_tokens_on_logout = true,
    #       -- access token valid for a day
    #       access_token_expires_in = 86400
    #     }

    #     ${lib.optionalString (whitelisted_ips != []) ''
    #       local whitelist = {${lib.strings.concatMapStringsSep "," (x: "\"${x}\"") whitelisted_ips}}          
                      
    #       if is_ip_whitelisted(ngx.var.remote_addr, whitelist) then
    #         return
    #       end
    #     ''}
       
    #     -- call introspect for OAuth 2.0 Bearer Access Token validation
    #     local res, err = require("resty.openidc").authenticate(opts)

    #     if err then
    #       ngx.status = 403
    #       ngx.say(err)
    #       ngx.exit(ngx.HTTP_FORBIDDEN)
    #     end

    #     ${lib.optionalString (access_role != "") ''
    #       if not check_role(res, "${access_role}") then
    #         ngx.status = 401
    #         ngx.header.content_type = 'text/html';
    #         ngx.say("You are not authorized to access this page. Please contact Er Pepotto.")
    #         ngx.exit(ngx.HTTP_UNAUTHORIZED)
    #       end
    #     ''}
    #   }
    # '';
}