From cf944bee376c65c878a3cfd8f44e505eb965ae9c Mon Sep 17 00:00:00 2001
From: ibizaman <ibizapeanut@gmail.com>
Date: Mon, 17 Mar 2025 00:59:13 +0100
Subject: [PATCH] add assertion to avoid issue with authelia and ldap

---
 demo/nextcloud/flake.nix    | 2 +-
 modules/blocks/authelia.nix | 6 ++++++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/demo/nextcloud/flake.nix b/demo/nextcloud/flake.nix
index 37ab426..6382bca 100644
--- a/demo/nextcloud/flake.nix
+++ b/demo/nextcloud/flake.nix
@@ -115,7 +115,7 @@
           subdomain = "auth";
           ssl = config.shb.certs.certs.selfsigned.n;
           ldapPort = config.shb.ldap.ldapPort;
-          ldapHostname = "ldap://127.0.0.1";
+          ldapHostname = "127.0.0.1";
           dcdomain = config.shb.ldap.dcdomain;
 
           secrets = {
diff --git a/modules/blocks/authelia.nix b/modules/blocks/authelia.nix
index 5d068fa..bb91b10 100644
--- a/modules/blocks/authelia.nix
+++ b/modules/blocks/authelia.nix
@@ -11,6 +11,8 @@ let
   fqdnWithPort = if isNull cfg.port then fqdn else "${fqdn}:${toString cfg.port}";
 
   autheliaCfg = config.services.authelia.instances.${fqdn};
+
+  inherit (lib) hasPrefix;
 in
 {
   options.shb.authelia = {
@@ -309,6 +311,10 @@ in
         assertion = builtins.length cfg.oidcClients > 0;
         message = "Must have at least one oidc client otherwise Authelia refuses to start.";
       }
+      {
+        assertion = !(hasPrefix "ldap://" cfg.ldapHostname);
+        message = "LDAP hostname should be the bare host name and not start with ldap://";
+      }
     ];
 
     # Overriding the user name so we don't allow any weird characters anywhere. For example, postgres users do not accept the '.'.