got sso working

modules/machine/yshtola/configuration.nix

@@ -1,4 +1,5 @@
 {
+  lib,
   pkgs,
   config,
   userName,
@@ -17,8 +18,10 @@
   # After deploying Mastodon, register an OAuth application at
   # https://social.wyattjmiller.com/settings/applications and write the
   # client ID / secret to these paths (chmod 400, owned by the tuwunel user):
-  mastodonOauthClientIdFile = "/var/lib/tuwunel/mastodon-oauth-client-id";
+  mastodonOauthClientIdFile = "/var/lib/private/tuwunel/matrix-oauth-client-id";
-  mastodonOauthClientSecretFile = "/var/lib/tuwunel/mastodon-oauth-client-secret";
+  mastodonOauthClientSecretFile = "/var/lib/private/tuwunel/matrix-oauth-client-secret";
+  mastodonOauthClientId = builtins.readFile mastodonOauthClientIdFile;
+  mastodonOauthClientSecret = builtins.readFile mastodonOauthClientSecretFile;
 in {
   imports = [
     ../../pwrMgmt
@@ -129,11 +132,14 @@ in {
   services.mastodon = {
     enable = true;
     localDomain = mastodonFqdn;
+    webPort = 3000;
+    enableUnixSocket = false;
     configureNginx = false;
     secretKeyBaseFile = "${mastodonSecretsDir}/secret_key_base";
-    otpSecretFile = "${mastodonSecretsDir}/otp_secret";
+    # otpSecretFile = "${mastodonSecretsDir}/otp_secret";
     vapidPrivateKeyFile = "${mastodonSecretsDir}/vapid_private_key";
     vapidPublicKeyFile = "${mastodonSecretsDir}/vapid_public_key";
+    streamingProcesses = 3;
     # Configure SMTP after initial deploy via mastodonSecretsDir or a separate
     # NixOS secrets manager (sops-nix / agenix).
     smtp = {
@@ -189,18 +195,21 @@ in {
         #   1. Visit https://social.wyattjmiller.com/settings/applications
         #   2. Create a new application with the redirect URI:
         #        https://chat.wyattjmiller.com/_matrix/client/v3/login/sso/redirect/oidc-mastodon
-        #      and scopes: read:accounts
+        #      and scopes: profile
-        #   3. Write the Application ID  → /var/lib/tuwunel/mastodon-oauth-client-id  (chmod 400, owned by tuwunel)
+        #   3. Write the Client Key      → /var/lib/private/tuwunel/matrix-oauth-client-id  (chmod 400, owned by tuwunel)
-        #      Write the Client Secret   → /var/lib/tuwunel/mastodon-oauth-client-secret
+        #      Write the Client Secret   → /var/lib/private/tuwunel/matrix-oauth-client-secret
         #   4. nixos-rebuild switch (or restart tuwunel.service)
         identity_provider = [
           {
             brand = "Mastodon";
             issuer_url = "https://${mastodonFqdn}";
-            id = "oidc-mastodon";
+            # id = mastodonOauthClientId;
-            client_id = mastodonOauthClientIdFile;
+            callback_url = "https://${matrixFqdn}/_matrix/client/unstable/login/sso/callback/${lib.removeSuffix "\n" (mastodonOauthClientId)}";
-            client_secret = mastodonOauthClientSecretFile;
+            discovery_url = "https://${mastodonFqdn}/.well-known/oauth-authorization-server";
-            scope = ["openid" "read:accounts"];
+            client_id = lib.removeSuffix "\n" (mastodonOauthClientId);
+            client_secret = lib.removeSuffix "\n" (mastodonOauthClientSecret);
+            scope = ["profile"];
+            userid_claims = ["preferred_username"];
           }
         ];
       };