diff --git a/config/portunus_seeds.json b/config/portunus_seeds.json index b73bf07..802e799 100644 --- a/config/portunus_seeds.json +++ b/config/portunus_seeds.json @@ -42,13 +42,13 @@ "login_name": "admin", "given_name": "admin", "family_name": "admin", - "password": { "from_command": ["/usr/bin/env", "cat", "/run/secrets/portunus_admin"] } + "password": { "from_command": ["/usr/bin/env", "cat", "/run/secrets/portunus/users/search-password"] } }, { "login_name": "search", "given_name": "search", "family_name": "search", - "password": { "from_command": ["/usr/bin/env", "cat", "/run/secrets/portunus_search"] } + "password": { "from_command": ["/usr/bin/env", "cat", "/run/secrets/portunus/users/search-password"] } } ] } diff --git a/modules/hedgedoc.nix b/modules/hedgedoc.nix index debcdca..1c2ef0a 100644 --- a/modules/hedgedoc.nix +++ b/modules/hedgedoc.nix @@ -79,7 +79,7 @@ in postgres_hedgedoc.owner = user; hedgedoc_session_secret.owner = user; hedgedoc_ldap_search = { - key = "portunus_search"; + key = "portunus/users/search-password"; owner = user; }; }; diff --git a/modules/ldap.nix b/modules/ldap.nix index 2495c98..555ac53 100644 --- a/modules/ldap.nix +++ b/modules/ldap.nix @@ -63,7 +63,16 @@ in "${portunusGroup}" = { name = "${portunusGroup}"; - members = [ "${portunusUser}" ]; + members = [ + "${portunusUser}" + config.systemd.services."matrix-synapse".serviceConfig.User + config.systemd.services.sogo.serviceConfig.User + config.systemd.services.hedgedoc.serviceConfig.User + config.systemd.services.mailman.serviceConfig.User + config.systemd.services."mailman-web-setup".serviceConfig.User + config.systemd.services.hyperkitty.serviceConfig.User + config.systemd.services.nslcd.serviceConfig.User + ]; }; "${ldapGroup}" = { name = "${ldapGroup}"; diff --git a/modules/mailman.nix b/modules/mailman.nix index a133729..866ae57 100644 --- a/modules/mailman.nix +++ b/modules/mailman.nix @@ -1,7 +1,7 @@ { config, ... }: { sops.secrets.mailman_ldap_search = { - key = "portunus_search"; + key = "portunus/users/search-password"; owner = config.services.mailman.webUser; }; services.mailman = { diff --git a/modules/matrix.nix b/modules/matrix.nix index a09ba6c..a79e4a7 100644 --- a/modules/matrix.nix +++ b/modules/matrix.nix @@ -25,7 +25,7 @@ let in { sops.secrets.matrix_ldap_search = { - key = "portunus_search"; + key = "portunus/users/search-password"; owner = config.systemd.services.matrix-synapse.serviceConfig.User; }; diff --git a/modules/sogo.nix b/modules/sogo.nix index f60bba7..4ac2eb4 100644 --- a/modules/sogo.nix +++ b/modules/sogo.nix @@ -5,11 +5,14 @@ let pg-port = toString config.services.postgresql.port; in { - sops.secrets.ldap_search = { - owner = config.systemd.services.sogo.serviceConfig.User; - }; - sops.secrets.postgres_sogo = { - owner = config.systemd.services.sogo.serviceConfig.User; + sops.secrets = { + postgres_sogo = { + owner = config.systemd.services.sogo.serviceConfig.User; + }; + sogo_ldap_search = { + key = "portunus/users/search-password"; + owner = config.systemd.services.sogo.serviceConfig.User; + }; }; services = { @@ -35,7 +38,7 @@ in OCSSessionsFolderURL = "postgresql://sogo:POSTGRES_PASSWORD@localhost:${pg-port}/sogo/sogo_sessions_folder"; ''; # Hier ist bindPassword noch nicht vollständig configReplaces = { - "LDAP_SEARCH" = config.sops.secrets.ldap_search.path; + "LDAP_SEARCH" = config.sops.secrets.sogo_ldap_search.path; "POSTGRES_PASSWORD" = config.sops.secrets.postgres_sogo.path; }; vhostName = "${sogo-hostname}";