root/flake
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix lldap config

Browse source
This commit is contained in:
root 2025-11-09 00:24:18 +00:00
parent 4e1bcd6425
commit 9d0061fe6b
1 changed files with 13 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

17
services/lldap.nix
View file

@ -3,10 +3,13 @@
in { in {
age.secrets = { age.secrets = {
"hidden_service/lldap".file = ../secrets/hidden_service/lldap; "hidden_service/lldap".file = ../secrets/hidden_service/lldap;
"lldap_root_pass".file = ../secrets/lldap_root_pass; "lldap_root_pass" = {
} file = ../secrets/lldap_root_pass;
mode = "0440";
group = "lldap-secrets";
};
};
services.lldap = { services.lldap = {
enable = true; enable = true;
settings = { settings = {
@ -16,7 +19,7 @@ in {
ldap_user_dn = "root"; ldap_user_dn = "root";
ldap_base_dn = "dc=distrust,dc=network"; ldap_base_dn = "dc=distrust,dc=network";
ldap_user_pass_file = config.age.secrets."lldap_root_pass".path; ldap_user_pass_file = config.age.secrets."lldap_root_pass".path;
force_ldap_user_pass_reset = true; force_ldap_user_pass_reset = "always";
}; };
}; };
@ -36,4 +39,10 @@ in {
]; ];
}; };
}; };
# Creates a group for the LLDAP DynamicUser to read the secret
users.groups.lldap-secrets = {};
systemd.services.lldap.serviceConfig = {
SupplementaryGroups = [ "lldap-secrets" ];
};
} }