nordic-dev.net/nixpkgs
nordic-dev.net/nixpkgs
2
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2024-11-22 06:53:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

nixos/kanidm: add provisioning secret directories to BindReadOnlyPaths

Browse Source 
(cherry picked from commit 3e29e0560d)
This commit is contained in:
oddlama 2024-11-20 01:40:06 +01:00 committed by github-actions[bot]
parent b9dc4f3cfc
commit 48be85e7c7
1 changed files with 18 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
nixos/modules/services/security/kanidm.nix
View File

@ -31,6 +31,7 @@ let
mkOption mkOption
mkPackageOption mkPackageOption
optional optional
optionals
optionalString optionalString
splitString splitString
subtractLists subtractLists
@ -45,10 +46,22 @@ let
serverConfigFile = settingsFormat.generate "server.toml" (filterConfig cfg.serverSettings); serverConfigFile = settingsFormat.generate "server.toml" (filterConfig cfg.serverSettings);
clientConfigFile = settingsFormat.generate "kanidm-config.toml" (filterConfig cfg.clientSettings); clientConfigFile = settingsFormat.generate "kanidm-config.toml" (filterConfig cfg.clientSettings);
unixConfigFile = settingsFormat.generate "kanidm-unixd.toml" (filterConfig cfg.unixSettings); unixConfigFile = settingsFormat.generate "kanidm-unixd.toml" (filterConfig cfg.unixSettings);
certPaths = builtins.map builtins.dirOf [ provisionSecretFiles = filter (x: x != null) (
cfg.serverSettings.tls_chain [
cfg.serverSettings.tls_key cfg.provision.idmAdminPasswordFile
]; cfg.provision.adminPasswordFile
]
++ mapAttrsToList (_: x: x.basicSecretFile) cfg.provision.systems.oauth2
);
secretDirectories = unique (
map builtins.dirOf (
[
cfg.serverSettings.tls_chain
cfg.serverSettings.tls_key
]
++ optionals cfg.provision.enable provisionSecretFiles
)
);
# Merge bind mount paths and remove paths where a prefix is already mounted. # Merge bind mount paths and remove paths where a prefix is already mounted.
# This makes sure that if e.g. the tls_chain is in the nix store and /nix/store is already in the mount # This makes sure that if e.g. the tls_chain is in the nix store and /nix/store is already in the mount
@ -817,7 +830,7 @@ in
( (
defaultServiceConfig defaultServiceConfig
// { // {
BindReadOnlyPaths = mergePaths (defaultServiceConfig.BindReadOnlyPaths ++ certPaths); BindReadOnlyPaths = mergePaths (defaultServiceConfig.BindReadOnlyPaths ++ secretDirectories);
} }
) )
{ {