133 lines
4.5 KiB
Diff
133 lines
4.5 KiB
Diff
From f898e786bfb07399abf4e8173ee525c57eb41984 Mon Sep 17 00:00:00 2001
|
|
From: ibizaman <ibizaman@tiserbox.com>
|
|
Date: Wed, 16 Jul 2025 03:04:44 +0200
|
|
Subject: [PATCH 2/3] lldap: add options to set important secrets
|
|
|
|
---
|
|
nixos/modules/services/databases/lldap.nix | 64 ++++++++++++++++++++++
|
|
nixos/tests/lldap.nix | 16 +++++-
|
|
2 files changed, 77 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/nixos/modules/services/databases/lldap.nix b/nixos/modules/services/databases/lldap.nix
|
|
index a9fbe8f7e11a..518b39ba7a86 100644
|
|
--- a/nixos/modules/services/databases/lldap.nix
|
|
+++ b/nixos/modules/services/databases/lldap.nix
|
|
@@ -37,6 +37,47 @@ in
|
|
'';
|
|
};
|
|
|
|
+ adminPasswordFile = mkOption {
|
|
+ type = types.nullOr types.str;
|
|
+ default = null;
|
|
+ description = ''
|
|
+ Path to a file containing the default admin password.
|
|
+ '';
|
|
+ };
|
|
+
|
|
+ resetAdminPassword = mkOption {
|
|
+ type = types.nullOr (
|
|
+ types.oneOf [
|
|
+ types.bool
|
|
+ (types.enum [ "always" ])
|
|
+ ]
|
|
+ );
|
|
+ default = false;
|
|
+ description = ''
|
|
+ Force reset of the admin password.
|
|
+
|
|
+ Break glass in case of emergency: if you lost the admin password, you
|
|
+ can set this to true to force a reset of the admin password to the value
|
|
+ of `adminPasswordFile`.
|
|
+
|
|
+ Alternatively, you can set it to `"always"` to reset every time the server starts
|
|
+ which makes for a more declarative configuration.
|
|
+
|
|
+ The difference between `true` and `"always"` is the former is intended for a one time fix
|
|
+ while the latter is intended for a declarative workflow. In practice, the result
|
|
+ is the same: the password gets reset. The only practical difference is the former
|
|
+ outputs a warning message while the latter outputs an info message.
|
|
+ '';
|
|
+ };
|
|
+
|
|
+ jwtSecretFile = mkOption {
|
|
+ type = types.nullOr types.str;
|
|
+ default = null;
|
|
+ description = ''
|
|
+ Path to a file containing the default admin password.
|
|
+ '';
|
|
+ };
|
|
+
|
|
settings = mkOption {
|
|
description = ''
|
|
Free-form settings written directly to the `lldap_config.toml` file.
|
|
@@ -108,6 +149,29 @@ in
|
|
};
|
|
|
|
config = lib.mkIf cfg.enable {
|
|
+ assertions = [
|
|
+ {
|
|
+ assertion = cfg.adminPasswordFile == null || cfg.resetAdminPassword != false;
|
|
+ message = ''
|
|
+ The default admin password is set declaratively with `adminPasswordFile` option but the `resetAdminPassword` is set to `false`.
|
|
+ This means the admin password can be changed through the UI and will drift from the one defined in your nix config.
|
|
+ Please set the `resetAdminPassword` option to `true` or `"always"`.
|
|
+ '';
|
|
+ }
|
|
+ ];
|
|
+
|
|
+ services.lldap.environment = {
|
|
+ LLDAP_JWT_SECRET_FILE = lib.mkIf (cfg.jwtSecretFile != null) cfg.jwtSecretFile;
|
|
+ LLDAP_LDAP_USER_PASS_FILE = lib.mkIf (cfg.adminPasswordFile != null) cfg.adminPasswordFile;
|
|
+ LLDAP_FORCE_LDAP_USER_PASS_RESET =
|
|
+ if builtins.isString cfg.resetAdminPassword then
|
|
+ cfg.resetAdminPassword
|
|
+ else if cfg.resetAdminPassword then
|
|
+ "true"
|
|
+ else
|
|
+ "false";
|
|
+ };
|
|
+
|
|
systemd.services.lldap = {
|
|
description = "Lightweight LDAP server (lldap)";
|
|
wants = [ "network-online.target" ];
|
|
diff --git a/nixos/tests/lldap.nix b/nixos/tests/lldap.nix
|
|
index c2e48525a5f3..e88fa37ab83d 100644
|
|
--- a/nixos/tests/lldap.nix
|
|
+++ b/nixos/tests/lldap.nix
|
|
@@ -1,4 +1,7 @@
|
|
{ ... }:
|
|
+let
|
|
+ adminPassword = "mySecretPassword";
|
|
+in
|
|
{
|
|
name = "lldap";
|
|
|
|
@@ -7,6 +10,11 @@
|
|
{
|
|
services.lldap = {
|
|
enable = true;
|
|
+
|
|
+ adminPasswordFile = toString (pkgs.writeText "adminPasswordFile" adminPassword);
|
|
+ resetAdminPassword = "always";
|
|
+ enforceEnsure = true;
|
|
+
|
|
settings = {
|
|
verbose = true;
|
|
ldap_base_dn = "dc=example,dc=com";
|
|
@@ -22,8 +30,10 @@
|
|
|
|
machine.succeed("curl --location --fail http://localhost:17170/")
|
|
|
|
- print(
|
|
- machine.succeed('ldapsearch -H ldap://localhost:3890 -D uid=admin,ou=people,dc=example,dc=com -b "ou=people,dc=example,dc=com" -w password')
|
|
- )
|
|
+ response = machine.fail('ldapsearch -H ldap://localhost:3890 -D uid=admin,ou=people,dc=example,dc=com -b "ou=people,dc=example,dc=com" -w password')
|
|
+ print(response)
|
|
+
|
|
+ response = machine.succeed('ldapsearch -H ldap://localhost:3890 -D uid=admin,ou=people,dc=example,dc=com -b "ou=people,dc=example,dc=com" -w ${adminPassword}')
|
|
+ print(response)
|
|
'';
|
|
}
|
|
--
|
|
2.49.0
|
|
|