Unverified Commit 8b72dae1 authored by Maximilian Bosch's avatar Maximilian Bosch Committed by GitHub
Browse files

Merge pull request #181528 from Ma27/privacyidea-ldap-proxy-secrets

nixos/privacyidea: better secret-handling ldap-proxy & RFC42-style settings for ldap-proxy
parents d9a59b22 949c334e
Loading
Loading
Loading
Loading
+59 −3
Original line number Diff line number Diff line
@@ -51,6 +51,16 @@ let
    ${cfg.extraConfig}
  '';

  renderValue = x:
    if isList x then concatMapStringsSep "," (x: ''"${x}"'') x
    else if isString x && hasInfix "," x then ''"${x}"''
    else x;

  ldapProxyConfig = pkgs.writeText "ldap-proxy.ini"
    (generators.toINI {}
      (flip mapAttrs cfg.ldap-proxy.settings
        (const (mapAttrs (const renderValue)))));

in

{
@@ -172,7 +182,8 @@ in
        enable = mkEnableOption "PrivacyIDEA LDAP Proxy";

        configFile = mkOption {
          type = types.path;
          type = types.nullOr types.path;
          default = null;
          description = ''
            Path to PrivacyIDEA LDAP Proxy configuration (proxy.ini).
          '';
@@ -189,6 +200,26 @@ in
          default = "pi-ldap-proxy";
          description = "Group account under which PrivacyIDEA LDAP proxy runs.";
        };

        settings = mkOption {
          type = with types; attrsOf (attrsOf (oneOf [ str bool int (listOf str) ]));
          default = {};
          description = ''
            Attribute-set containing the settings for <package>privacyidea-ldap-proxy</package>.
            It's possible to pass secrets using env-vars as substitutes and
            use the option <xref linkend="opt-services.privacyidea.ldap-proxy.environmentFile" />
            to inject them via <package>envsubst</package>.
          '';
        };

        environmentFile = mkOption {
          default = null;
          type = types.nullOr types.str;
          description = ''
            Environment file containing secrets to be substituted into
            <xref linkend="opt-services.privacyidea.ldap-proxy.settings" />.
          '';
        };
      };
    };
  };
@@ -276,6 +307,18 @@ in

    (mkIf cfg.ldap-proxy.enable {

      assertions = [
        { assertion = let
            xor = a: b: a && !b || !a && b;
          in xor (cfg.ldap-proxy.settings == {}) (cfg.ldap-proxy.configFile == null);
          message = "configFile & settings are mutually exclusive for services.privacyidea.ldap-proxy!";
        }
      ];

      warnings = mkIf (cfg.ldap-proxy.configFile != null) [
        "Using services.privacyidea.ldap-proxy.configFile is deprecated! Use the RFC42-style settings option instead!"
      ];

      systemd.services.privacyidea-ldap-proxy = let
        ldap-proxy-env = pkgs.python3.withPackages (ps: [ ps.privacyidea-ldap-proxy ]);
      in {
@@ -284,14 +327,27 @@ in
        serviceConfig = {
          User = cfg.ldap-proxy.user;
          Group = cfg.ldap-proxy.group;
          ExecStart = ''
          StateDirectory = "privacyidea-ldap-proxy";
          EnvironmentFile = mkIf (cfg.ldap-proxy.environmentFile != null)
            [ cfg.ldap-proxy.environmentFile ];
          ExecStartPre =
            "${pkgs.writeShellScript "substitute-secrets-ldap-proxy" ''
              ${pkgs.envsubst}/bin/envsubst \
                -i ${ldapProxyConfig} \
                -o $STATE_DIRECTORY/ldap-proxy.ini
            ''}";
          ExecStart = let
            configPath = if cfg.ldap-proxy.settings != {}
              then "%S/privacyidea-ldap-proxy/ldap-proxy.ini"
              else cfg.ldap-proxy.configFile;
          in ''
            ${ldap-proxy-env}/bin/twistd \
              --nodaemon \
              --pidfile= \
              -u ${cfg.ldap-proxy.user} \
              -g ${cfg.ldap-proxy.group} \
              ldap-proxy \
              -c ${cfg.ldap-proxy.configFile}
              -c ${configPath}
          '';
          Restart = "always";
        };