thary/sp-config
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: various kanidm, jitsi and general fixes

Browse Source
This commit is contained in:
nhnn
2025-05-22 16:50:34 +03:00
parent eb29949a03
commit 14e8cf359d
12 changed files with 44 additions and 71 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
auth/auth-module.nix
View File

@@ -38,7 +38,7 @@ let
pkgs.writeShellScript "${oauthClientID}-kanidm-ExecStartPost-script.sh" ( pkgs.writeShellScript "${oauthClientID}-kanidm-ExecStartPost-script.sh" (
'' ''
export HOME=$RUNTIME_DIRECTORY/client_home export HOME=$RUNTIME_DIRECTORY/client_home
readonly KANIDM="${pkgs.kanidm}/bin/kanidm" readonly KANIDM="${config.services.kanidm.package}/bin/kanidm"
# try to get existing Kanidm service account # try to get existing Kanidm service account
KANIDM_SERVICE_ACCOUNT="$($KANIDM service-account list --name idm_admin | grep -E "^name: ${kanidmServiceAccountName}$")" KANIDM_SERVICE_ACCOUNT="$($KANIDM service-account list --name idm_admin | grep -E "^name: ${kanidmServiceAccountName}$")"

4
auth/auth.nix
View File

@@ -62,7 +62,7 @@ lib.mkIf config.selfprivacy.sso.enable {
enableServer = true; enableServer = true;
# kanidm with Rust code patches for OAuth and admin passwords provisioning # kanidm with Rust code patches for OAuth and admin passwords provisioning
package = pkgs.kanidm.withSecretProvisioning; package = pkgs.kanidm_1_5.withSecretProvisioning;
serverSettings = { serverSettings = {
inherit domain; inherit domain;
@@ -158,7 +158,7 @@ lib.mkIf config.selfprivacy.sso.enable {
systemd.services.kanidm.serviceConfig.ExecStartPre = systemd.services.kanidm.serviceConfig.ExecStartPre =
# idempotent script to run on each startup only for kanidm v1.5.0 # idempotent script to run on each startup only for kanidm v1.5.0
lib.mkIf (pkgs.kanidm.version == "1.5.0") (lib.mkBefore [ kanidmMigrateDbScript ]); lib.mkIf (lib.versionAtLeast config.services.kanidm.package.version "1.5.0") (lib.mkBefore [ kanidmMigrateDbScript ]);
selfprivacy.passthru.auth = { selfprivacy.passthru.auth = {
inherit inherit

2
configuration.nix
View File

@@ -233,7 +233,7 @@ in
environment.memoryAllocator.provider = "libc"; # Scudo has problems with PHP, which may cause PHP to segfault... environment.memoryAllocator.provider = "libc"; # Scudo has problems with PHP, which may cause PHP to segfault...
security.sudo.enable = false; security.sudo.enable = false;
boot.kernel.sysctl = { boot.kernel.sysctl = {
"net.ipv4.ip_forward" = 1; # TODO why is it here by default, for VPN only? "net.ipv4.ip_forward" = 1; # TODO why is it here by default, for VPN only?
"kernel.core_pattern" = "|${pkgs.coreutils}/bin/false"; # Ignore coredumps "kernel.core_pattern" = "|${pkgs.coreutils}/bin/false"; # Ignore coredumps

43
flake.lock generated
View File

@@ -1,39 +1,23 @@
{ {
"nodes": { "nodes": {
"nixos-unstable": {
"locked": {
"lastModified": 1745930157,
"narHash": "sha256-y3h3NLnzRSiUkYpnfvnS669zWZLoqqI6NprtLQ+5dck=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "46e634be05ce9dc6d4db8e664515ba10b78151ae",
"type": "github"
},
"original": {
"owner": "nixos",
"ref": "nixos-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"nixpkgs": { "nixpkgs": {
"locked": { "locked": {
"lastModified": 1746055187, "lastModified": 1747676747,
"narHash": "sha256-3dqArYSMP9hM7Qpy5YWhnSjiqniSaT2uc5h2Po7tmg0=", "narHash": "sha256-LXkWBVqilgx7Pohwqu/ABxDVw+Cmi5/Mj2S2mpUH0Fw=",
"owner": "nixos", "owner": "NixOS",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "3e362ce63e16b9572d8c2297c04f7c19ab6725a5", "rev": "72841a4a8761d1aed92ef6169a636872c986c76d",
"type": "github" "type": "github"
}, },
"original": { "original": {
"owner": "nixos", "owner": "NixOS",
"ref": "nixos-24.11",
"repo": "nixpkgs", "repo": "nixpkgs",
"type": "github" "type": "github"
} }
}, },
"root": { "root": {
"inputs": { "inputs": {
"nixos-unstable": "nixos-unstable",
"nixpkgs": "nixpkgs", "nixpkgs": "nixpkgs",
"selfprivacy-api": "selfprivacy-api" "selfprivacy-api": "selfprivacy-api"
} }
@@ -45,17 +29,18 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1746195080, "lastModified": 1747923731,
"narHash": "sha256-WIqCd8unsDW8QboNMVrqtsXYbsL2BF9L4uJ7DfmAsGo=", "narHash": "sha256-vh1VdbWVq85ZTOTb5snYCwnWG21pdt1Wn6CW9QTSuQE=",
"ref": "inex/nixos-24.11", "ref": "nhnn/nixos-25.05",
"rev": "8146a556fbac2180e009916ac2b459c5a5040574", "rev": "7e3526547923215a068fb7d9c2e81f8b9631a60c",
"revCount": 1776, "revCount": 1777,
"type": "git", "type": "git",
"url": "https://git.selfprivacy.org/SelfPrivacy/selfprivacy-rest-api.git" "url": "https://git.selfprivacy.org/nhnn/selfprivacy-rest-api.git"
}, },
"original": { "original": {
"ref": "nhnn/nixos-25.05",
"type": "git", "type": "git",
"url": "https://git.selfprivacy.org/SelfPrivacy/selfprivacy-rest-api.git" "url": "https://git.selfprivacy.org/nhnn/selfprivacy-rest-api.git"
} }
} }
}, },

15
flake.nix
View File

@@ -2,10 +2,9 @@
description = "SelfPrivacy NixOS configuration flake"; description = "SelfPrivacy NixOS configuration flake";
inputs = { inputs = {
nixpkgs.url = "github:nixos/nixpkgs"; nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11";
nixos-unstable.url = "github:nixos/nixpkgs/nixos-unstable";
selfprivacy-api.url = "git+https://git.selfprivacy.org/SelfPrivacy/selfprivacy-rest-api.git"; selfprivacy-api.url = "git+https://git.selfprivacy.org/nhnn/selfprivacy-rest-api.git?ref=nhnn/nixos-25.05";
# make selfprivacy-api use the same shared nixpkgs # make selfprivacy-api use the same shared nixpkgs
selfprivacy-api.inputs.nixpkgs.follows = "nixpkgs"; selfprivacy-api.inputs.nixpkgs.follows = "nixpkgs";
}; };
@@ -14,7 +13,6 @@
{ {
self, self,
nixpkgs, nixpkgs,
nixos-unstable,
selfprivacy-api, selfprivacy-api,
}: }:
{ {
@@ -35,15 +33,6 @@
./configuration.nix ./configuration.nix
./auth/auth.nix ./auth/auth.nix
{ {
nixpkgs.overlays = [
(_final: prev: {
inherit (nixos-unstable.legacyPackages.${prev.system})
kanidm
kanidm-provision
;
selfprivacy_nix_2_26 = nixos-unstable.legacyPackages.${prev.system}.nixVersions.nix_2_26;
})
];
disabledModules = [ "services/security/kanidm.nix" ]; disabledModules = [ "services/security/kanidm.nix" ];
imports = [ ./auth/kanidm.nix ]; imports = [ ./auth/kanidm.nix ];
} }

12
sp-modules/vikunja/flake.lock → sp-modules/jitsi-meet/flake.lock generated
View File

@@ -1,24 +1,24 @@
{ {
"nodes": { "nodes": {
"nixpkgs-24-11": { "nixpkgs-2405": {
"locked": { "locked": {
"lastModified": 1744440957, "lastModified": 1735563628,
"narHash": "sha256-FHlSkNqFmPxPJvy+6fNLaNeWnF1lZSgqVCl/eWaJRc4=", "narHash": "sha256-OnSAY7XDSx7CtDoqNh8jwVwh4xNL/2HaJxGjryLWzX8=",
"owner": "NixOS", "owner": "NixOS",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "26d499fc9f1d567283d5d56fcf367edd815dba1d", "rev": "b134951a4c9f3c995fd7be05f3243f8ecd65d798",
"type": "github" "type": "github"
}, },
"original": { "original": {
"owner": "NixOS", "owner": "NixOS",
"ref": "nixos-24.11", "ref": "nixos-24.05",
"repo": "nixpkgs", "repo": "nixpkgs",
"type": "github" "type": "github"
} }
}, },
"root": { "root": {
"inputs": { "inputs": {
"nixpkgs-24-11": "nixpkgs-24-11" "nixpkgs-2405": "nixpkgs-2405"
} }
} }
}, },

6
sp-modules/jitsi-meet/flake.nix
View File

@@ -1,10 +1,12 @@
{ {
description = "PoC SP module for Jitsi Meet video conferences server"; description = "PoC SP module for Jitsi Meet video conferences server";
inputs.nixpkgs-2405.url = "github:NixOS/nixpkgs/nixos-24.05";
outputs = outputs =
{ self }: { self, nixpkgs-2405 }:
{ {
nixosModules.default = import ./module.nix; nixosModules.default = import ./module.nix nixpkgs-2405.legacyPackages.x86_64-linux;
configPathsNeeded = builtins.fromJSON (builtins.readFile ./config-paths-needed.json); configPathsNeeded = builtins.fromJSON (builtins.readFile ./config-paths-needed.json);
meta = meta =
{ lib, ... }: { lib, ... }:

14
sp-modules/jitsi-meet/module.nix
View File

@@ -1,4 +1,4 @@
{ config, lib, ... }: oldPkgs: { config, lib, ... }:
let let
domain = config.selfprivacy.domain; domain = config.selfprivacy.domain;
cfg = config.selfprivacy.modules.jitsi-meet; cfg = config.selfprivacy.modules.jitsi-meet;
@@ -46,13 +46,13 @@ in
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
nixpkgs.overlays = [ nixpkgs.overlays = [
(_: prev: { (final: prev: {
# We disable E2E for clients below jicofo = oldPkgs.jicofo;
jitsi-meet = prev.jitsi-meet.overrideAttrs (old: { jitsi-meet = oldPkgs.jitsi-meet.overrideAttrs (old: {
meta = old.meta // { meta = old.meta // { knownVulnerabilities = [ ]; };
knownVulnerabilities = [ ];
};
}); });
jitsi-videobridge = oldPkgs.jitsi-videobridge;
jitsi-meet-prosody = oldPkgs.jitsi-meet-prosody;
}) })
]; ];

2
sp-modules/simple-nixos-mailserver/auth-dovecot.nix
View File

@@ -25,7 +25,7 @@ let
# create service account token, needed for LDAP # create service account token, needed for LDAP
kanidmExecStartPostScript = pkgs.writeShellScript "mailserver-kanidm-ExecStartPost-script.sh" '' kanidmExecStartPostScript = pkgs.writeShellScript "mailserver-kanidm-ExecStartPost-script.sh" ''
export HOME=$RUNTIME_DIRECTORY/client_home export HOME=$RUNTIME_DIRECTORY/client_home
readonly KANIDM="${pkgs.kanidm}/bin/kanidm" readonly KANIDM="${config.services.kanidm.package}/bin/kanidm"
# get Kanidm service account for mailserver # get Kanidm service account for mailserver
KANIDM_SERVICE_ACCOUNT="$($KANIDM service-account list --name idm_admin | grep -E "^name: ${mailserver-service-account-name}$")" KANIDM_SERVICE_ACCOUNT="$($KANIDM service-account list --name idm_admin | grep -E "^name: ${mailserver-service-account-name}$")"

3
sp-modules/simple-nixos-mailserver/config-paths-needed.json
View File

@@ -30,5 +30,6 @@
[ "services", "redis", "servers", "rspamd", "bind" ], [ "services", "redis", "servers", "rspamd", "bind" ],
[ "services", "redis", "servers", "rspamd", "port" ], [ "services", "redis", "servers", "rspamd", "port" ],
[ "services", "redis", "servers", "rspamd", "requirePass" ], [ "services", "redis", "servers", "rspamd", "requirePass" ],
[ "services", "rspamd" ] [ "services", "rspamd" ],
[ "services", "kanidm", "package" ]
] ]

8
sp-modules/vikunja/flake.nix
View File

@@ -1,14 +1,10 @@
{ {
description = "PoC SP module for Vikunja service"; description = "PoC SP module for Vikunja service";
inputs = {
nixpkgs-24-11.url = "github:NixOS/nixpkgs/nixos-24.11";
};
outputs = outputs =
{ nixpkgs-24-11, ... }: { ... }:
{ {
nixosModules.default = import ./module.nix nixpkgs-24-11.legacyPackages.x86_64-linux; nixosModules.default = import ./module.nix;
configPathsNeeded = builtins.fromJSON (builtins.readFile ./config-paths-needed.json); configPathsNeeded = builtins.fromJSON (builtins.readFile ./config-paths-needed.json);
meta = meta =
{ lib, ... }: { lib, ... }:

4
sp-modules/vikunja/module.nix
View File

@@ -1,7 +1,7 @@
latestPkgs:
{ {
config, config,
lib, lib,
pkgs,
... ...
}: }:
let let
@@ -17,7 +17,7 @@ let
oauthClientSecretFP = auth-passthru.mkOAuth2ClientSecretFP oauthClientID; oauthClientSecretFP = auth-passthru.mkOAuth2ClientSecretFP oauthClientID;
vikunjaPackage = latestPkgs.vikunja.overrideAttrs (old: { vikunjaPackage = pkgs.vikunja.overrideAttrs (old: {
doCheck = false; # Tests are slow. doCheck = false; # Tests are slow.
patches = (old.patches or [ ]) ++ [ patches = (old.patches or [ ]) ++ [
./load-client-secret-from-env.patch ./load-client-secret-from-env.patch