[nidaros] Add Keycloak

hosts/nidaros/default.nix

@@ -5,6 +5,7 @@
     (relativeToBase "modules")
     ./boot.nix
     ./hardware.nix
+    ./keycloak.nix
     ./postgres.nix
     ./security
   ];

hosts/nidaros/keycloak.nix

@@ -0,0 +1,27 @@
+{ config, common, ... }:
+let
+  port = 8081;
+  domain = "iam.${common.domain}";
+  dbPassKey = "keycloak/database-pass";
+in
+{
+
+  services = {
+    keycloak = {
+      enable = true;
+      settings = {
+        hostname = "https://${domain}";
+        http-port = port;
+        http-enabled = true;
+      };
+      database = {
+        type = "postgresql";
+        createLocally = true;
+        port = config.services.postgresql.settings.port;
+        passwordFile = config.sops.secrets.${dbPassKey}.path;
+      };
+      initialAdminPassword = "changeme";
+    };
+  };
+  sops.secrets.${dbPassKey} = { };
+}