wurzel/fruitbasket
9
1
Fork 0
Code Issues 5 Pull requests Packages Projects Releases Wiki Activity

hydra: ldap fixes

Browse source
This commit is contained in:
quitte 2023-08-23 17:12:08 +02:00
parent d90e705738
commit 0eeb60a281
1 changed files with 6 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
modules/hydra.nix
View file

@ -3,7 +3,7 @@ let
domain = "hydra.ifsr.de"; domain = "hydra.ifsr.de";
in in
{ {
sops.secrets."hydra_ldap_search".owner = "hydra"; sops.secrets."hydra_ldap_search" = { owner = "hydra"; group = "hydra"; mode = "440"; };
services.hydra = { services.hydra = {
enable = true; enable = true;
port = 4000; port = 4000;
@ -12,7 +12,7 @@ in
buildMachinesFiles = [ ]; buildMachinesFiles = [ ];
useSubstitutes = true; useSubstitutes = true;
extraConfig = '' extraConfig = ''
ldap> <ldap>
<config> <config>
<credential> <credential>
class = Password class = Password
@ -25,16 +25,16 @@ in
<ldap_server_options> <ldap_server_options>
timeout = 30 timeout = 30
</ldap_server_options> </ldap_server_options>
binddn = "cn=search,dc=ifsr,dc=de" binddn = "uid=search,ou=users,dc=ifsr,dc=de"
include ${config.sops.secrets.hydra_ldap_search.path} include ${config.sops.secrets.hydra_ldap_search.path}
start_tls = 0 start_tls = 0
<start_tls_options> <start_tls_options>
verify = none verify = none
</start_tls_options> </start_tls_options>
user_basedn = "ou=users,dc=ifsr,dc=de" user_basedn = "ou=users,dc=ifsr,dc=de"
user_filter = "(&(objectClass=posixAccount)(cn=%s))" user_filter = "(&(objectClass=posixAccount)(uid=%s))"
user_scope = one user_scope = one
user_field = cn user_field = uid
<user_search_options> <user_search_options>
deref = always deref = always
</user_search_options> </user_search_options>
@ -48,6 +48,7 @@ in
<role_search_options> <role_search_options>
deref = always deref = always
</role_search_options> </role_search_options>
</store>
</config> </config>
<role_mapping> <role_mapping>
# Make all users in the hydra_admin group Hydra admins # Make all users in the hydra_admin group Hydra admins