diff options
author | Lara <lara@uwu.is> | 2021-09-20 08:53:29 +0200 |
---|---|---|
committer | Maximilian Bosch <maximilian@mbosch.me> | 2022-08-09 17:28:37 +0200 |
commit | 87942da08e3221f32c7a43a17b165fabfdb04082 (patch) | |
tree | 0e992d108a01b6e3ed0f610762058f02c3a5eb42 /nixos/modules/services/misc/sssd.nix | |
parent | 22562e9a1c8acf298f4f072f94794bcfc56000db (diff) |
nixos/sssd: Add secrets handling
Currently, it is not possible to supply sensitive credentials like `ldap_default_authtok` without writing them to the nix store. This This commit introduces a new option `environmentFile` where those credentials can be supplied via environment substitution.
Diffstat (limited to 'nixos/modules/services/misc/sssd.nix')
-rw-r--r-- | nixos/modules/services/misc/sssd.nix | 48 |
1 files changed, 41 insertions, 7 deletions
diff --git a/nixos/modules/services/misc/sssd.nix b/nixos/modules/services/misc/sssd.nix index 70afbe0433ae0..039c9737b1f48 100644 --- a/nixos/modules/services/misc/sssd.nix +++ b/nixos/modules/services/misc/sssd.nix @@ -3,6 +3,10 @@ with lib; let cfg = config.services.sssd; nscd = config.services.nscd; + + dataDir = "/var/lib/sssd"; + settingsFile = "${dataDir}/sssd.conf"; + settingsFileUnsubstituted = pkgs.writeText "${dataDir}/sssd-unsubsituted.conf" cfg.config; in { options = { services.sssd = { @@ -47,6 +51,30 @@ in { Kerberos will be configured to cache credentials in SSS. ''; }; + environmentFile = mkOption { + type = types.nullOr types.path; + default = null; + description = '' + Environment file as defined in <citerefentry> + <refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum> + </citerefentry>. + + Secrets may be passed to the service without adding them to the world-readable + Nix store, by specifying placeholder variables as the option value in Nix and + setting these variables accordingly in the environment file. + + <programlisting> + # snippet of sssd-related config + [domain/LDAP] + ldap_default_authtok = $SSSD_LDAP_DEFAULT_AUTHTOK + </programlisting> + + <programlisting> + # contents of the environment file + SSSD_LDAP_DEFAULT_AUTHTOK=verysecretpassword + </programlisting> + ''; + }; }; }; config = mkMerge [ @@ -60,22 +88,28 @@ in { wants = [ "nss-user-lookup.target" ]; restartTriggers = [ config.environment.etc."nscd.conf".source - config.environment.etc."sssd/sssd.conf".source + settingsFileUnsubstituted ]; script = '' export LDB_MODULES_PATH+="''${LDB_MODULES_PATH+:}${pkgs.ldb}/modules/ldb:${pkgs.sssd}/modules/ldb" mkdir -p /var/lib/sss/{pubconf,db,mc,pipes,gpo_cache,secrets} /var/lib/sss/pipes/private /var/lib/sss/pubconf/krb5.include.d - ${pkgs.sssd}/bin/sssd -D + ${pkgs.sssd}/bin/sssd -D -c ${settingsFile} ''; serviceConfig = { Type = "forking"; PIDFile = "/run/sssd.pid"; + StateDirectory = baseNameOf dataDir; + EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile; }; - }; - - environment.etc."sssd/sssd.conf" = { - text = cfg.config; - mode = "0400"; + preStart = '' + [ -f ${settingsFile} ] && rm -f ${settingsFile} + old_umask=$(umask) + umask 0177 + ${pkgs.envsubst}/bin/envsubst \ + -o ${settingsFile} \ + -i ${settingsFileUnsubstituted} + umask $old_umask + ''; }; system.nssModules = [ pkgs.sssd ]; |