diff options
Diffstat (limited to 'nixpkgs/nixos/modules/services/misc/sssd.nix')
| -rw-r--r-- | nixpkgs/nixos/modules/services/misc/sssd.nix | 86 |
1 files changed, 76 insertions, 10 deletions
diff --git a/nixpkgs/nixos/modules/services/misc/sssd.nix b/nixpkgs/nixos/modules/services/misc/sssd.nix index 386281e2b7cc..60d4a799d5d2 100644 --- a/nixpkgs/nixos/modules/services/misc/sssd.nix +++ b/nixpkgs/nixos/modules/services/misc/sssd.nix @@ -3,6 +3,10 @@ with lib; let cfg = config.services.sssd; nscd = config.services.nscd; + + dataDir = "/var/lib/sssd"; + settingsFile = "${dataDir}/sssd.conf"; + settingsFileUnsubstituted = pkgs.writeText "${dataDir}/sssd-unsubstituted.conf" cfg.config; in { options = { services.sssd = { @@ -10,7 +14,7 @@ in { config = mkOption { type = types.lines; - description = "Contents of <filename>sssd.conf</filename>."; + description = lib.mdDoc "Contents of {file}`sssd.conf`."; default = '' [sssd] config_file_version = 2 @@ -33,9 +37,42 @@ in { sshAuthorizedKeysIntegration = mkOption { type = types.bool; default = false; - description = '' + description = lib.mdDoc '' Whether to make sshd look up authorized keys from SSS. - For this to work, the <literal>ssh</literal> SSS service must be enabled in the sssd configuration. + For this to work, the `ssh` SSS service must be enabled in the sssd configuration. + ''; + }; + + kcm = mkOption { + type = types.bool; + default = false; + description = lib.mdDoc '' + Whether to use SSS as a Kerberos Cache Manager (KCM). + Kerberos will be configured to cache credentials in SSS. + ''; + }; + environmentFile = mkOption { + type = types.nullOr types.path; + default = null; + description = '' + Environment file as defined in <citerefentry> + <refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum> + </citerefentry>. + + Secrets may be passed to the service without adding them to the world-readable + Nix store, by specifying placeholder variables as the option value in Nix and + setting these variables accordingly in the environment file. + + <programlisting> + # snippet of sssd-related config + [domain/LDAP] + ldap_default_authtok = $SSSD_LDAP_DEFAULT_AUTHTOK + </programlisting> + + <programlisting> + # contents of the environment file + SSSD_LDAP_DEFAULT_AUTHTOK=verysecretpassword + </programlisting> ''; }; }; @@ -51,22 +88,29 @@ in { wants = [ "nss-user-lookup.target" ]; restartTriggers = [ config.environment.etc."nscd.conf".source - config.environment.etc."sssd/sssd.conf".source + settingsFileUnsubstituted ]; script = '' export LDB_MODULES_PATH+="''${LDB_MODULES_PATH+:}${pkgs.ldb}/modules/ldb:${pkgs.sssd}/modules/ldb" mkdir -p /var/lib/sss/{pubconf,db,mc,pipes,gpo_cache,secrets} /var/lib/sss/pipes/private /var/lib/sss/pubconf/krb5.include.d - ${pkgs.sssd}/bin/sssd -D + ${pkgs.sssd}/bin/sssd -D -c ${settingsFile} ''; serviceConfig = { Type = "forking"; PIDFile = "/run/sssd.pid"; + StateDirectory = baseNameOf dataDir; + # We cannot use LoadCredential here because it's not available in ExecStartPre + EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile; }; - }; - - environment.etc."sssd/sssd.conf" = { - text = cfg.config; - mode = "0400"; + preStart = '' + [ -f ${settingsFile} ] && rm -f ${settingsFile} + old_umask=$(umask) + umask 0177 + ${pkgs.envsubst}/bin/envsubst \ + -o ${settingsFile} \ + -i ${settingsFileUnsubstituted} + umask $old_umask + ''; }; system.nssModules = [ pkgs.sssd ]; @@ -79,6 +123,28 @@ in { services.dbus.packages = [ pkgs.sssd ]; }) + (mkIf cfg.kcm { + systemd.services.sssd-kcm = { + description = "SSSD Kerberos Cache Manager"; + requires = [ "sssd-kcm.socket" ]; + serviceConfig = { + ExecStartPre = "-${pkgs.sssd}/bin/sssd --genconf-section=kcm"; + ExecStart = "${pkgs.sssd}/libexec/sssd/sssd_kcm --uid 0 --gid 0"; + }; + restartTriggers = [ + config.environment.etc."sssd/sssd.conf".source + ]; + }; + systemd.sockets.sssd-kcm = { + description = "SSSD Kerberos Cache Manager responder socket"; + wantedBy = [ "sockets.target" ]; + # Matches the default in MIT krb5 and Heimdal: + # https://github.com/krb5/krb5/blob/krb5-1.19.3-final/src/include/kcm.h#L43 + listenStreams = [ "/var/run/.heim_org.h5l.kcm-socket" ]; + }; + krb5.libdefaults.default_ccache_name = "KCM:"; + }) + (mkIf cfg.sshAuthorizedKeysIntegration { # Ugly: sshd refuses to start if a store path is given because /nix/store is group-writable. # So indirect by a symlink. |