public
/
paris-container
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Don't launch if it's not enabled

This commit is contained in:
niten 2024-06-01 09:18:28 -07:00
parent d387167dec
commit e9e7d25ba8
1 changed files with 54 additions and 35 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

89
paris-container.nix
View File

@ -25,6 +25,12 @@ in {
default = [ ];
};
ssh-keys = mkOption {
type = listOf str;
description = "List of SSH keys to use.";
default = [ ];
};
ldap = {
image = mkOption {
type = str;
@ -126,7 +132,7 @@ in {
};
};
config = {
config = mkIf cfg.enable {
systemd.tmpfiles.rules =
[ "d ${cfg.state-directory}/home 0700 root root - -" ];
@ -168,48 +174,61 @@ in {
environment.systemPackages = packages;
services.sssd = {
enable = true;
kcm = true;
environmentFile = hostSecrets.parisSssdEnv.target-file;
config = lib.generators.toINI { } {
sssd = {
config_file_version = 2;
reconnection_retries = 3;
sbus_timeout = 30;
services = concatStringsSep " " [ "nss" "pam" "ssh" ];
domains = concatStringsSep " " [ cfg.ldap.domain ];
services = {
opensssh = {
enable = true;
startWhenNeeded = true;
hostKeys = FIXME;
settings = {
UseDns = true;
PermitRootLogin = "no";
};
};
pam = { reconnection_retries = 3; };
sssd = {
enable = true;
kcm = true;
environmentFile = hostSecrets.parisSssdEnv.target-file;
config = lib.generators.toINI { } {
sssd = {
config_file_version = 2;
reconnection_retries = 3;
sbus_timeout = 30;
services = concatStringsSep " " [ "nss" "pam" "ssh" ];
domains = concatStringsSep " " [ cfg.ldap.domain ];
};
nss = {
filter_groups = "root";
filter_users = "root";
reconnection_retries = 3;
};
pam = { reconnection_retries = 3; };
"domain/${cfg.ldap.domain}" = {
cache_credentials = true;
id_provider = "ldap";
chpass_provider = "ldap";
auth_provider = "ldap";
access_provider = "ldap";
nss = {
filter_groups = "root";
filter_users = "root";
reconnection_retries = 3;
};
ldap_uri = "ldap://localhost:${toString cfg.ldap.port}";
ldap_schema = "rfc2307bis";
"domain/${cfg.ldap.domain}" = {
cache_credentials = true;
id_provider = "ldap";
chpass_provider = "ldap";
auth_provider = "ldap";
access_provider = "ldap";
ldap_search_base = cfg.ldap.base;
ldap_user_search_base = "${cfg.ldap.user-ou},${cfg.ldap.base}";
ldap_group_search_base = "${cfg.ldap.group-ou},${cfg.ldap.base}";
ldap_uri = "ldap://localhost:${toString cfg.ldap.port}";
ldap_schema = "rfc2307bis";
ladp_user_object_class = "user";
ldap_user_cn = "cn";
ldap_group_object_class = "group";
ldap_group_name = "cn";
ldap_search_base = cfg.ldap.base;
ldap_user_search_base = "${cfg.ldap.user-ou},${cfg.ldap.base}";
ldap_group_search_base =
"${cfg.ldap.group-ou},${cfg.ldap.base}";
ldap_default_bind_dn = cfg.ldap.bind-dn;
ldap_default_authtok = "$LDAP_DEFAULT_AUTHTOKEN";
ladp_user_object_class = "user";
ldap_user_cn = "cn";
ldap_group_object_class = "group";
ldap_group_name = "cn";
ldap_default_bind_dn = cfg.ldap.bind-dn;
ldap_default_authtok = "$LDAP_DEFAULT_AUTHTOKEN";
};
};
};
};