From 485e7474c43bbd4a79595e2673b3a51fb66ebc51 Mon Sep 17 00:00:00 2001
From: ibizaman <ibizaman@tiserbox.com>
Date: Wed, 13 Aug 2025 09:01:05 +0200
Subject: [PATCH] lldap: only enforce groups

---
 docs/redirects.json      |  9 +++++++++
 modules/blocks/lldap.nix | 22 ++++++++++++++++++++--
 2 files changed, 29 insertions(+), 2 deletions(-)

diff --git a/docs/redirects.json b/docs/redirects.json
index 54b1e15..e248824 100644
--- a/docs/redirects.json
+++ b/docs/redirects.json
@@ -365,6 +365,15 @@
   "blocks-lldap-options-shb.lldap.enable": [
     "blocks-lldap.html#blocks-lldap-options-shb.lldap.enable"
   ],
+  "blocks-lldap-options-shb.lldap.enforceGroups": [
+    "blocks-lldap.html#blocks-lldap-options-shb.lldap.enforceGroups"
+  ],
+  "blocks-lldap-options-shb.lldap.enforceUserMemberships": [
+    "blocks-lldap.html#blocks-lldap-options-shb.lldap.enforceUserMemberships"
+  ],
+  "blocks-lldap-options-shb.lldap.enforceUsers": [
+    "blocks-lldap.html#blocks-lldap-options-shb.lldap.enforceUsers"
+  ],
   "blocks-lldap-options-shb.lldap.ensureGroupFields": [
     "blocks-lldap.html#blocks-lldap-options-shb.lldap.ensureGroupFields"
   ],
diff --git a/modules/blocks/lldap.nix b/modules/blocks/lldap.nix
index 96f4c31..e40b801 100644
--- a/modules/blocks/lldap.nix
+++ b/modules/blocks/lldap.nix
@@ -163,7 +163,7 @@ in
       description = ''
         Create the users defined here on service startup.
 
-        If `enforceEnsure` option is `true`, the groups
+        If `enforceUsers` option is `true`, the groups
         users belong to must be present in the `ensureGroups` option.
 
         Non-default options must be added to the `ensureGroupFields` option.
@@ -302,6 +302,24 @@ in
         )
       );
     };
+
+    enforceUsers = mkOption {
+      description = "Delete users not set declaratively.";
+      type = types.bool;
+      default = false;
+    };
+
+    enforceUserMemberships = mkOption {
+      description = "Remove users from groups not set declaratively.";
+      type = types.bool;
+      default = false;
+    };
+
+    enforceGroups = mkOption {
+      description = "Remove groups not set declaratively.";
+      type = types.bool;
+      default = true;
+    };
   };
 
   imports = [
@@ -339,7 +357,7 @@ in
     services.lldap = {
       enable = true;
 
-      enforceEnsure = true;
+      inherit (cfg) enforceUsers enforceUserMemberships enforceGroups;
 
       environment = {
         RUST_LOG = lib.mkIf cfg.debug "debug";