added flake

derivation.nix

@@ -0,0 +1,11 @@
+{ pkgs, cargoToml, ... }:
+let
+  manifest = (pkgs.lib.importTOML cargoToml).package;
+in
+pkgs.rustPlatform.buildRustPackage {
+  pname = manifest.name;
+  version = manifest.version;
+  cargoLock.lockFile = ./Cargo.lock;
+  src = pkgs.lib.cleanSource ./.;
+  cargoBuildFlags = "-p ${manifest.name}";
+}

flake.nix

@@ -0,0 +1,33 @@
+{
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-23.11";
+    flake-utils.url = "github:numtide/flake-utils";
+  };
+
+  outputs = { self, nixpkgs, flake-utils }:
+    flake-utils.lib.eachDefaultSystem
+      (system:
+        let
+          pkgs = (import nixpkgs) {
+            inherit system;
+          };
+        in
+        {
+          packages = rec {
+            jitsi-openid = pkgs.callPackage ./derivation.nix {
+              cargoToml = ./Cargo.toml;
+            };
+            default = jitsi-openid;
+          };
+        }
+      ) // {
+      overlays.default = _: prev: {
+        jitsi-openid = self.packages."${prev.system}".default;
+      };
+
+      nixosModules = rec {
+        jitsi-openid = import ./nixos-modules/default.nix;
+        default = jitsi-openid;
+      };
+    };
+}

module.nix

@@ -0,0 +1,99 @@
+{ config, pkgs, lib, ... }:
+
+let
+  cfg = config.services.jitsi-openid;
+in
+{
+  options = {
+    services.jitsi-openid = {
+      package = lib.mkOption {
+        type = lib.types.package;
+        default = pkgs.jitsi-openid;
+        defaultText = lib.literalExpression "pkgs.jitsi-openid";
+        description = lib.mdDoc "Which Jitsi OpenID derivation to use.";
+      };
+      enable = lib.mkEnableOption (lib.mdDoc "Jitsi OpenID");
+      listen = {
+        addr = lib.mkOption {
+          type = lib.types.str;
+          description = lib.mdDoc "The ip address Jitsi OpenID should be listening on.";
+          default = "0.0.0.0";
+        };
+        port = lib.mkOption {
+          type = lib.types.port;
+          description = lib.mdDoc "The port Jitsi OpenID shuld be listening on.";
+          default = 6031;
+        };
+      };
+      jitsiSecretFile = lib.mkOption {
+        type = lib.types.str;
+        description = lib.mdDoc "The socket address of the udp upstream zia should redirect all traffic to.";
+        default = null;
+      };
+      jitsiUrl = lib.mkOption {
+        type = lib.types.str;
+        description = lib.mdDoc "The socket address of the udp upstream zia should redirect all traffic to.";
+        default = null;
+      };
+      jitsiSub = lib.mkOption {
+        type = lib.types.str;
+        description = lib.mdDoc "The socket address of the udp upstream zia should redirect all traffic to.";
+        default = null;
+      };
+      issuerUrl = lib.mkOption {
+        type = lib.types.str;
+        description = lib.mdDoc "The socket address of the udp upstream zia should redirect all traffic to.";
+        default = null;
+      };
+      baseUrl = lib.mkOption {
+        type = lib.types.str;
+        description = lib.mdDoc "The socket address of the udp upstream zia should redirect all traffic to.";
+        default = null;
+      };
+      clientId = lib.mkOption {
+        type = lib.types.str;
+        description = lib.mdDoc "The socket address of the udp upstream zia should redirect all traffic to.";
+        default = null;
+      };
+      clientSecretFile = lib.mkOption {
+        type = lib.types.str;
+        description = lib.mdDoc "The socket address of the udp upstream zia should redirect all traffic to.";
+        default = null;
+      };
+      openFirewall = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = lib.mdDoc "Whether to open ports in the firewall for the server.";
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+    networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ cfg.listen.port ];
+
+    systemd.services.jitsi-openid = {
+      description = "Jitsi OpenID";
+
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+
+      serviceConfig = {
+        ExecStart = "${cfg.package}/bin/jitsi-openid";
+        DynamicUser = true;
+        User = "jitsi-openid";
+
+        Environment = [
+          "JITSI_OPENID_LISTEN_ADDR=${cfg.listen.addr}:${toString cfg.listen.port}"
+          "JITSI_OPENID_JITSI_SECRET_FILE=${cfg.jitsiSecretFile}"
+          "JITSI_OPENID_JITSI_URL=${cfg.jitsiUrl}"
+          "JITSI_OPENID_JITSI_SUB=${cfg.jitsiSub}"
+          "JITSI_OPENID_ISSUER_URL=${cfg.issuerUrl}"
+          "JITSI_OPENID_BASE_URL=${cfg.baseUrl}"
+          "JITSI_OPENID_CLIENT_ID=${cfg.clientId}"
+          "JITSI_OPENID_CLIENT_SECRET_FILE=${cfg.clientSecretFile}"
+        ];
+      };
+    };
+  };
+}

src/cfg.rs

@@ -1,4 +1,5 @@
 use std::net::SocketAddr;
+use std::path::PathBuf;
 
 use openidconnect::{AuthenticationContextClass, ClientId, IssuerUrl};
 use serde::{Deserialize, Deserializer};
@@ -8,15 +9,17 @@ use crate::ClientSecret;
 
 #[derive(Deserialize, Clone)]
 pub(crate) struct Cfg {
-  pub(crate) jitsi_secret: String,
+  pub(crate) jitsi_secret: Option<String>,
+  pub(crate) jitsi_secret_file: Option<PathBuf>,
   pub(crate) jitsi_url: Url,
   pub(crate) jitsi_sub: String,
   #[serde(alias = "issuer_base_url")]
   pub(crate) issuer_url: IssuerUrl,
   pub(crate) base_url: Url,
   pub(crate) client_id: ClientId,
   #[serde(alias = "secret")]
-  pub(crate) client_secret: ClientSecret,
+  pub(crate) client_secret: Option<ClientSecret>,
+  pub(crate) client_secret_path: Option<PathBuf>,
   #[serde(default = "default_listen_addr")]
   pub(crate) listen_addr: SocketAddr,
   #[serde(default)]

src/main.rs

@@ -37,6 +37,8 @@ mod error;
 mod routes;
 
 type Store = Arc<RwLock<HashMap<Uuid, Session>>>;
+#[derive(Clone)]
+pub(crate) struct JitsiSecret(pub(crate) String);
 
 struct Session {
   room: String,
@@ -84,6 +86,14 @@ type MyClient = Client<
   CoreRevocationErrorResponse,
 >;
 
+#[derive(Clone)]
+pub(crate) struct JitsiState {
+  store: Store,
+  client: MyClient,
+  config: Cfg,
+  jitsi_secret: JitsiSecret,
+}
+
 #[tokio::main]
 async fn main() -> anyhow::Result<()> {
   let subscriber = FmtSubscriber::builder()
@@ -117,20 +127,46 @@ async fn main() -> anyhow::Result<()> {
   let provider_metadata: CoreProviderMetadata =
     CoreProviderMetadata::discover_async(config.issuer_url.clone(), async_http_client).await?;
 
+  let client_secret = config
+    .client_secret
+    .clone()
+    .or(
+      config
+        .client_secret_path
+        .clone()
+        .map(|path| ClientSecret::new(std::fs::read_to_string(path).unwrap())),
+    )
+    .expect("Client secret not specified.");
+
   let client = MyClient::from_provider_metadata(
     provider_metadata,
     config.client_id.clone(),
-    Some(config.client_secret.clone()),
+    Some(client_secret),
   )
   .set_redirect_uri(RedirectUrl::from_url(config.base_url.join("callback")?));
   // TODO: .set_revocation_uri ?
 
   info!("Successfully queried identity provider metadata");
 
-  let app = build_routes()
-    .layer(Extension(store))
-    .layer(Extension(client))
-    .layer(Extension(config.clone()));
+  let jitsi_secret = JitsiSecret(
+    config
+      .jitsi_secret
+      .clone()
+      .or(
+        config
+          .jitsi_secret_file
+          .clone()
+          .map(|path| std::fs::read_to_string(path).unwrap()),
+      )
+      .expect("Jitsi secret not specified."),
+  );
+
+  let app = build_routes().with_state(JitsiState {
+    store,
+    client,
+    config: config.clone(),
+    jitsi_secret: jitsi_secret.clone(),
+  });
 
   let listener = TcpListener::bind(config.listen_addr).await?;