public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #101224 from aanderse/ldap

Browse Source 
nixos/ldap: restart nslcd when configuration changes
This commit is contained in:
Aaron Andersen 2020-12-11 17:18:12 -05:00 committed by GitHub
commit 9826371e44
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 17 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
nixos/modules/config/ldap.nix
View File

@ -59,30 +59,28 @@ in
users.ldap = { users.ldap = {
enable = mkOption { enable = mkEnableOption "authentication against an LDAP server";
type = types.bool;
default = false;
description = "Whether to enable authentication against an LDAP server.";
};
loginPam = mkOption { loginPam = mkOption {
type = types.bool; type = types.bool;
default = true; default = true;
description = "Whether to include authentication against LDAP in login PAM"; description = "Whether to include authentication against LDAP in login PAM.";
}; };
nsswitch = mkOption { nsswitch = mkOption {
type = types.bool; type = types.bool;
default = true; default = true;
description = "Whether to include lookup against LDAP in NSS"; description = "Whether to include lookup against LDAP in NSS.";
}; };
server = mkOption { server = mkOption {
type = types.str;
example = "ldap://ldap.example.org/"; example = "ldap://ldap.example.org/";
description = "The URL of the LDAP server."; description = "The URL of the LDAP server.";
}; };
base = mkOption { base = mkOption {
type = types.str;
example = "dc=example,dc=org"; example = "dc=example,dc=org";
description = "The distinguished name of the search base."; description = "The distinguished name of the search base.";
}; };
@ -129,7 +127,7 @@ in
type = types.lines; type = types.lines;
description = '' description = ''
Extra configuration options that will be added verbatim at Extra configuration options that will be added verbatim at
the end of the nslcd configuration file (nslcd.conf). the end of the nslcd configuration file (<literal>nslcd.conf(5)</literal>).
'' ; '' ;
} ; } ;
@ -180,7 +178,7 @@ in
description = '' description = ''
Specifies the time limit (in seconds) to use when connecting Specifies the time limit (in seconds) to use when connecting
to the directory server. This is distinct from the time limit to the directory server. This is distinct from the time limit
specified in <literal>users.ldap.timeLimit</literal> and affects specified in <option>users.ldap.timeLimit</option> and affects
the initial server connection only. the initial server connection only.
''; '';
}; };
@ -197,7 +195,7 @@ in
actually contact the directory server, and it is possible that actually contact the directory server, and it is possible that
a malformed configuration file will trigger reconnection. If a malformed configuration file will trigger reconnection. If
<literal>soft</literal> is specified, then <literal>soft</literal> is specified, then
<literal>nss_ldap</literal> will return immediately on server <package>nss_ldap</package> will return immediately on server
failure. All hard reconnect policies block with exponential failure. All hard reconnect policies block with exponential
backoff before retrying. backoff before retrying.
''; '';
@ -209,10 +207,10 @@ in
type = types.lines; type = types.lines;
description = '' description = ''
Extra configuration options that will be added verbatim at Extra configuration options that will be added verbatim at
the end of the ldap configuration file (ldap.conf). the end of the ldap configuration file (<literal>ldap.conf(5)</literal>).
If <literal>users.ldap.daemon</literal> is enabled, this If <option>users.ldap.daemon</option> is enabled, this
configuration will not be used. In that case, use configuration will not be used. In that case, use
<literal>users.ldap.daemon.extraConfig</literal> instead. <option>users.ldap.daemon.extraConfig</option> instead.
'' ; '' ;
}; };
@ -276,7 +274,12 @@ in
} >"$conf" } >"$conf"
mv -fT "$conf" /run/nslcd/nslcd.conf mv -fT "$conf" /run/nslcd/nslcd.conf
''; '';
restartTriggers = [ "/run/nslcd/nslcd.conf" ];
restartTriggers = [
nslcdConfig
cfg.bind.passwordFile
cfg.daemon.rootpwmodpwFile
];
serviceConfig = { serviceConfig = {
ExecStart = "${nslcdWrapped}/bin/nslcd"; ExecStart = "${nslcdWrapped}/bin/nslcd";