From 798aa29b45f96e0d421be8f4bfb9283fba64e50e Mon Sep 17 00:00:00 2001
From: ibizaman <ibizaman@tiserbox.com>
Date: Mon, 22 Jun 2026 20:18:21 +0200
Subject: [PATCH] home-assistant: use mkDerivation for lldap-ha-auth

---
 modules/services/home-assistant.nix           | 17 ++-------
 .../services/home-assistant/lldap_ha_auth.nix | 37 +++++++++++++++++++
 2 files changed, 41 insertions(+), 13 deletions(-)
 create mode 100644 modules/services/home-assistant/lldap_ha_auth.nix

diff --git a/modules/services/home-assistant.nix b/modules/services/home-assistant.nix
index b9aca1c..7fc57d5 100644
--- a/modules/services/home-assistant.nix
+++ b/modules/services/home-assistant.nix
@@ -11,23 +11,13 @@ let
 
   fqdn = "${cfg.subdomain}.${cfg.domain}";
 
-  ldap_auth_script_repo = pkgs.fetchFromGitHub {
-    owner = "lldap";
-    repo = "lldap";
-    rev = "7d1f5abc137821c500de99c94f7579761fc949d8";
-    sha256 = "sha256-8D+7ww70Ja6Qwdfa+7MpjAAHewtCWNf/tuTAExoUrg0=";
-  };
-
-  ldap_auth_script = pkgs.writeShellScriptBin "ldap_auth.sh" ''
-    export PATH=${pkgs.gnused}/bin:${pkgs.curl}/bin:${pkgs.jq}/bin
-    exec ${pkgs.bash}/bin/bash ${ldap_auth_script_repo}/example_configs/lldap-ha-auth.sh $@
-  '';
-
   # Filter secrets from config. Secrets are those of the form { source = <path>; }
   secrets = lib.attrsets.filterAttrs (k: v: builtins.isAttrs v) cfg.config;
 
   nonSecrets = (lib.attrsets.filterAttrs (k: v: !(builtins.isAttrs v)) cfg.config);
 
+  lldap_ha_auth = pkgs.callPackage ./home-assistant/lldap_ha_auth.nix { };
+
   configWithSecretsIncludes = nonSecrets // (lib.attrsets.mapAttrs (k: v: "!secret ${k}") secrets);
 in
 {
@@ -280,9 +270,10 @@ in
               }
             ])
             ++ (lib.optionals cfg.ldap.enable [
+              # https://www.home-assistant.io/docs/authentication/providers/#command-line
               {
                 type = "command_line";
-                command = ldap_auth_script + "/bin/ldap_auth.sh";
+                command = lldap_ha_auth + "/bin/lldap-ha-auth";
                 args = [
                   "http://${cfg.ldap.host}:${toString cfg.ldap.port}"
                   cfg.ldap.userGroup
diff --git a/modules/services/home-assistant/lldap_ha_auth.nix b/modules/services/home-assistant/lldap_ha_auth.nix
new file mode 100644
index 0000000..82084e0
--- /dev/null
+++ b/modules/services/home-assistant/lldap_ha_auth.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  pkgs,
+  stdenvNoCC,
+}:
+stdenvNoCC.mkDerivation {
+  name = "lldap-ha-auth";
+
+  src = pkgs.fetchFromGitHub {
+    owner = "lldap";
+    repo = "lldap";
+    rev = "7d1f5abc137821c500de99c94f7579761fc949d8";
+    sha256 = "sha256-8D+7ww70Ja6Qwdfa+7MpjAAHewtCWNf/tuTAExoUrg0=";
+  };
+
+  nativeBuildInputs = [
+    pkgs.makeWrapper
+  ];
+
+  buildPhase = ''
+    mkdir -p $out/bin
+
+    cp example_configs/lldap-ha-auth.sh $out/bin/lldap-ha-auth
+    chmod a+x $out/bin/lldap-ha-auth
+  '';
+
+  installPhase = ''
+    wrapProgram $out/bin/lldap-ha-auth \
+      --prefix PATH : ${
+        lib.makeBinPath [
+          pkgs.gnused
+          pkgs.curl
+          pkgs.jq
+        ]
+      }
+  '';
+}