From 7140d09f8f9ed7cefa0ca8e5cb8a5fdef8e966ba Mon Sep 17 00:00:00 2001
From: ibizaman <ibizaman@tiserbox.com>
Date: Mon, 12 Jan 2026 09:13:53 +0100
Subject: [PATCH] forgejo: accept users only part of the admin group

---
 modules/services/forgejo.nix | 4 ++--
 test/services/forgejo.nix    | 1 +
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/modules/services/forgejo.nix b/modules/services/forgejo.nix
index 0253de9..10fd26b 100644
--- a/modules/services/forgejo.nix
+++ b/modules/services/forgejo.nix
@@ -493,7 +493,7 @@ in
               --bind-password       $(tr -d '\n' < ${cfg.ldap.adminPassword.result.path}) \
               --security-protocol   Unencrypted \
               --user-search-base    ou=people,${cfg.ldap.dcdomain} \
-              --user-filter         '(&(memberof=cn=${cfg.ldap.userGroup},ou=groups,${cfg.ldap.dcdomain})(|(uid=%[1]s)(mail=%[1]s)))' \
+              --user-filter         '(&(|(memberof=cn=${cfg.ldap.userGroup},ou=groups,${cfg.ldap.dcdomain})(memberof=cn=${cfg.ldap.adminGroup},ou=groups,${cfg.ldap.dcdomain}))(|(uid=%[1]s)(mail=%[1]s)))' \
               --admin-filter        '(memberof=cn=${cfg.ldap.adminGroup},ou=groups,${cfg.ldap.dcdomain})' \
               --username-attribute  uid \
               --firstname-attribute givenName \
@@ -512,7 +512,7 @@ in
               --bind-password       $(tr -d '\n' < ${cfg.ldap.adminPassword.result.path}) \
               --security-protocol   Unencrypted \
               --user-search-base    ou=people,${cfg.ldap.dcdomain} \
-              --user-filter         '(&(memberof=cn=${cfg.ldap.userGroup},ou=groups,${cfg.ldap.dcdomain})(|(uid=%[1]s)(mail=%[1]s)))' \
+              --user-filter         '(&(|(memberof=cn=${cfg.ldap.userGroup},ou=groups,${cfg.ldap.dcdomain})(memberof=cn=${cfg.ldap.adminGroup},ou=groups,${cfg.ldap.dcdomain}))(|(uid=%[1]s)(mail=%[1]s)))' \
               --admin-filter        '(memberof=cn=${cfg.ldap.adminGroup},ou=groups,${cfg.ldap.dcdomain})' \
               --username-attribute  uid \
               --firstname-attribute givenName \
diff --git a/test/services/forgejo.nix b/test/services/forgejo.nix
index bf68b17..ac9c843 100644
--- a/test/services/forgejo.nix
+++ b/test/services/forgejo.nix
@@ -149,6 +149,7 @@ let
           waitForSystemdServices = [ "lldap.service" ];
 
           userGroup = "user_group";
+          adminGroup = "admin_group";
         };
       };