danvics/selfhostblocks
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

lldap: only enforce groups

Browse source
This commit is contained in:
ibizaman 2025-08-13 09:01:05 +02:00 committed by Pierre Penninckx
parent 154fab216e
commit 485e7474c4
2 changed files with 29 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
docs/redirects.json
View file

@ -365,6 +365,15 @@
"blocks-lldap-options-shb.lldap.enable": [ "blocks-lldap-options-shb.lldap.enable": [
"blocks-lldap.html#blocks-lldap-options-shb.lldap.enable" "blocks-lldap.html#blocks-lldap-options-shb.lldap.enable"
], ],
"blocks-lldap-options-shb.lldap.enforceGroups": [
"blocks-lldap.html#blocks-lldap-options-shb.lldap.enforceGroups"
],
"blocks-lldap-options-shb.lldap.enforceUserMemberships": [
"blocks-lldap.html#blocks-lldap-options-shb.lldap.enforceUserMemberships"
],
"blocks-lldap-options-shb.lldap.enforceUsers": [
"blocks-lldap.html#blocks-lldap-options-shb.lldap.enforceUsers"
],
"blocks-lldap-options-shb.lldap.ensureGroupFields": [ "blocks-lldap-options-shb.lldap.ensureGroupFields": [
"blocks-lldap.html#blocks-lldap-options-shb.lldap.ensureGroupFields" "blocks-lldap.html#blocks-lldap-options-shb.lldap.ensureGroupFields"
], ],

22
modules/blocks/lldap.nix
View file

@ -163,7 +163,7 @@ in
description = '' description = ''
Create the users defined here on service startup. Create the users defined here on service startup.
If `enforceEnsure` option is `true`, the groups If `enforceUsers` option is `true`, the groups
users belong to must be present in the `ensureGroups` option. users belong to must be present in the `ensureGroups` option.
Non-default options must be added to the `ensureGroupFields` option. Non-default options must be added to the `ensureGroupFields` option.
@ -302,6 +302,24 @@ in
) )
); );
}; };
enforceUsers = mkOption {
description = "Delete users not set declaratively.";
type = types.bool;
default = false;
};
enforceUserMemberships = mkOption {
description = "Remove users from groups not set declaratively.";
type = types.bool;
default = false;
};
enforceGroups = mkOption {
description = "Remove groups not set declaratively.";
type = types.bool;
default = true;
};
}; };
imports = [ imports = [
@ -339,7 +357,7 @@ in
services.lldap = { services.lldap = {
enable = true; enable = true;
enforceEnsure = true; inherit (cfg) enforceUsers enforceUserMemberships enforceGroups;
environment = { environment = {
RUST_LOG = lib.mkIf cfg.debug "debug"; RUST_LOG = lib.mkIf cfg.debug "debug";