danvics/selfhostblocks
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

lldap: only enforce groups

Browse source
This commit is contained in:
ibizaman 2025-08-13 09:01:05 +02:00 committed by Pierre Penninckx
parent 154fab216e
commit 485e7474c4
2 changed files with 29 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
docs/redirects.json
View file

@ -365,6 +365,15 @@
"blocks-lldap-options-shb.lldap.enable": [
"blocks-lldap.html#blocks-lldap-options-shb.lldap.enable"
],
"blocks-lldap-options-shb.lldap.enforceGroups": [
"blocks-lldap.html#blocks-lldap-options-shb.lldap.enforceGroups"
],
"blocks-lldap-options-shb.lldap.enforceUserMemberships": [
"blocks-lldap.html#blocks-lldap-options-shb.lldap.enforceUserMemberships"
],
"blocks-lldap-options-shb.lldap.enforceUsers": [
"blocks-lldap.html#blocks-lldap-options-shb.lldap.enforceUsers"
],
"blocks-lldap-options-shb.lldap.ensureGroupFields": [
"blocks-lldap.html#blocks-lldap-options-shb.lldap.ensureGroupFields"
],

22
modules/blocks/lldap.nix
View file

@ -163,7 +163,7 @@ in
description = ''
Create the users defined here on service startup.
If `enforceEnsure` option is `true`, the groups
If `enforceUsers` option is `true`, the groups
users belong to must be present in the `ensureGroups` option.
Non-default options must be added to the `ensureGroupFields` option.
@ -302,6 +302,24 @@ in
)
);
};
enforceUsers = mkOption {
description = "Delete users not set declaratively.";
type = types.bool;
default = false;
};
enforceUserMemberships = mkOption {
description = "Remove users from groups not set declaratively.";
type = types.bool;
default = false;
};
enforceGroups = mkOption {
description = "Remove groups not set declaratively.";
type = types.bool;
default = true;
};
};
imports = [
@ -339,7 +357,7 @@ in
services.lldap = {
enable = true;
enforceEnsure = true;
inherit (cfg) enforceUsers enforceUserMemberships enforceGroups;
environment = {
RUST_LOG = lib.mkIf cfg.debug "debug";