root/flake
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix lldap config

Browse source
This commit is contained in:
root 2025-11-09 00:24:18 +00:00
parent 4e1bcd6425
commit 9d0061fe6b
1 changed files with 13 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

17
services/lldap.nix
View file

@ -3,10 +3,13 @@
in {
age.secrets = {
"hidden_service/lldap".file = ../secrets/hidden_service/lldap;
"lldap_root_pass".file = ../secrets/lldap_root_pass;
}
"lldap_root_pass" = {
file = ../secrets/lldap_root_pass;
mode = "0440";
group = "lldap-secrets";
};
};
services.lldap = {
enable = true;
settings = {
@ -16,7 +19,7 @@ in {
ldap_user_dn = "root";
ldap_base_dn = "dc=distrust,dc=network";
ldap_user_pass_file = config.age.secrets."lldap_root_pass".path;
force_ldap_user_pass_reset = true;
force_ldap_user_pass_reset = "always";
};
};
@ -36,4 +39,10 @@ in {
];
};
};
# Creates a group for the LLDAP DynamicUser to read the secret
users.groups.lldap-secrets = {};
systemd.services.lldap.serviceConfig = {
SupplementaryGroups = [ "lldap-secrets" ];
};
}