Revert auth to Zitadel

Still don't love it but let's get things into a working state.

Promising next steps:
- Authlib (Python)
- oidc-provider (Javascript)
- Vouch Proxy, Ory Oauthkeeper, or IdP built-in forward auth

Look at [[Authentication]]

1 files changed, 1 insertions, 16 deletions

diff --git a/hostnix/elmo/home-assistant.nix b/hostnix/elmo/home-assistant.nix
index 0b23db0..7c66951 100644
--- a/hostnix/elmo/home-assistant.nix
+++ b/hostnix/elmo/home-assistant.nix
@@ -63,14 +63,7 @@
         use_x_forwarded_for = true;
       };
       recorder.db_url = "postgresql://@/hass";
-      # FIXME doesn't authenticate
-      # auth_header.username_header = "X-Email";
-      auth_header.debug = true;
-      logger = {
-        default = "info";
-        logs."custom_components.auth_header" = "debug";
-      };
-
+      auth_header = { };
 
 #binary_sensor:
 #  - platform: template
@@ -658,14 +651,6 @@
         auth_request off;
       '';
     };
-    # FIXME testing shim
-    locations."/test" = {
-      proxyPass = "http://127.0.0.1:8000";
-      extraConfig = ''
-        proxy_set_header X-User $user;
-        proxy_set_header X-Email $email;
-      '';
-    };
     # Disable service worker caching that works improperly with reverse proxy.
     # https://github.com/home-assistant/frontend/issues/14836
     # https://community.home-assistant.io/t/disabling-service-worker-reverse-proxy-auth-causes-issues/167082