Merge pull request #227916 from IndeedNotJames/lldap (f81a619c) · Commits · nix / nixpkgs

nixos/doc/manual/release-notes/rl-2305.section.md

+2 −0

Original line number	Diff line number	Diff line
		@@ -117,6 +117,8 @@ In addition to numerous new and upgraded packages, this release has the followin

		- [woodpecker-server](https://woodpecker-ci.org/), a simple CI engine with great extensibility. Available as [services.woodpecker-server](#opt-services.woodpecker-server.enable).

		- [lldap](https://github.com/lldap/lldap), a lightweight authentication server that provides an opinionated, simplified LDAP interface for authentication. Available as [services.lldap](#opt-services.lldap.enable).

		- [ReGreet](https://github.com/rharish101/ReGreet), a clean and customizable greeter for greetd. Available as [programs.regreet](#opt-programs.regreet.enable).

		- [v4l2-relayd](https://git.launchpad.net/v4l2-relayd), a streaming relay for v4l2loopback using gstreamer. Available as [services.v4l2-relayd](#opt-services.v4l2-relayd.instances._name_.enable).

nixos/modules/module-list.nix

+1 −0

Original line number	Diff line number	Diff line
		@@ -396,6 +396,7 @@
		./services/databases/hbase-standalone.nix
		./services/databases/influxdb.nix
		./services/databases/influxdb2.nix
		./services/databases/lldap.nix
		./services/databases/memcached.nix
		./services/databases/monetdb.nix
		./services/databases/mongodb.nix

nixos/modules/services/databases/lldap.nix

0 → 100644

+121 −0

Original line number	Diff line number	Diff line
		{ config, lib, pkgs, utils, ... }:

		let
		cfg = config.services.lldap;
		format = pkgs.formats.toml { };
		in
		{
		options.services.lldap = with lib; {
		enable = mkEnableOption (mdDoc "lldap");

		package = mkPackageOptionMD pkgs "lldap" { };

		environment = mkOption {
		type = with types; attrsOf str;
		default = { };
		example = {
		LLDAP_JWT_SECRET_FILE = "/run/lldap/jwt_secret";
		LLDAP_LDAP_USER_PASS_FILE = "/run/lldap/user_password";
		};
		description = lib.mdDoc ''
		Environment variables passed to the service.
		Any config option name prefixed with `LLDAP_` takes priority over the one in the configuration file.
		'';
		};

		environmentFile = mkOption {
		type = types.nullOr types.path;
		default = null;
		description = lib.mdDoc ''
		Environment file as defined in {manpage}`systemd.exec(5)` passed to the service.
		'';
		};

		settings = mkOption {
		description = mdDoc ''
		Free-form settings written directly to the `lldap_config.toml` file.
		Refer to <https://github.com/lldap/lldap/blob/main/lldap_config.docker_template.toml> for supported values.
		'';

		default = { };

		type = types.submodule {
		freeformType = format.type;
		options = {
		ldap_host = mkOption {
		type = types.str;
		description = mdDoc "The host address that the LDAP server will be bound to.";
		default = "::";
		};

		ldap_port = mkOption {
		type = types.port;
		description = mdDoc "The port on which to have the LDAP server.";
		default = 3890;
		};

		http_host = mkOption {
		type = types.str;
		description = mdDoc "The host address that the HTTP server will be bound to.";
		default = "::";
		};

		http_port = mkOption {
		type = types.port;
		description = mdDoc "The port on which to have the HTTP server, for user login and administration.";
		default = 17170;
		};

		http_url = mkOption {
		type = types.str;
		description = mdDoc "The public URL of the server, for password reset links.";
		default = "http://localhost";
		};

		ldap_base_dn = mkOption {
		type = types.str;
		description = mdDoc "Base DN for LDAP.";
		example = "dc=example,dc=com";
		};

		ldap_user_dn = mkOption {
		type = types.str;
		description = mdDoc "Admin username";
		default = "admin";
		};

		ldap_user_email = mkOption {
		type = types.str;
		description = mdDoc "Admin email.";
		default = "admin@example.com";
		};

		database_url = mkOption {
		type = types.str;
		description = mdDoc "Database URL.";
		default = "sqlite://./users.db?mode=rwc";
		example = "postgres://postgres-user:password@postgres-server/my-database";
		};
		};
		};
		};
		};

		config = lib.mkIf cfg.enable {
		systemd.services.lldap = {
		description = "Lightweight LDAP server (lldap)";
		after = [ "network-online.target" ];
		wantedBy = [ "multi-user.target" ];
		serviceConfig = {
		ExecStart = "${lib.getExe cfg.package} run --config-file ${format.generate "lldap_config.toml" cfg.settings}";
		StateDirectory = "lldap";
		WorkingDirectory = "%S/lldap";
		User = "lldap";
		Group = "lldap";
		DynamicUser = true;
		EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
		};
		inherit (cfg) environment;
		};
		};
		}

nixos/tests/all-tests.nix

+1 −0

Original line number	Diff line number	Diff line
		@@ -379,6 +379,7 @@ in {
		limesurvey = handleTest ./limesurvey.nix {};
		listmonk = handleTest ./listmonk.nix {};
		litestream = handleTest ./litestream.nix {};
		lldap = handleTest ./lldap.nix {};
		locate = handleTest ./locate.nix {};
		login = handleTest ./login.nix {};
		logrotate = handleTest ./logrotate.nix {};

nixos/tests/lldap.nix

0 → 100644

+26 −0

Original line number	Diff line number	Diff line
		import ./make-test-python.nix ({ ... }: {
		name = "lldap";

		nodes.machine = { pkgs, ... }: {
		services.lldap = {
		enable = true;
		settings = {
		verbose = true;
		ldap_base_dn = "dc=example,dc=com";
		};
		};
		environment.systemPackages = [ pkgs.openldap ];
		};

		testScript = ''
		machine.wait_for_unit("lldap.service")
		machine.wait_for_open_port(3890)
		machine.wait_for_open_port(17170)

		machine.succeed("curl --location --fail http://localhost:17170/")

		print(
		machine.succeed('ldapsearch -H ldap://localhost:3890 -D uid=admin,ou=people,dc=example,dc=com -b "ou=people,dc=example,dc=com" -w password')
		)
		'';
		})

Admin message