From 3a8dc6fe7a3a2c7ea42b60a1b121e161e7b07b33 Mon Sep 17 00:00:00 2001
From: Marcus Ramberg <marcus@means.no>
Date: Sat, 20 Sep 2025 18:52:22 +0200
Subject: [PATCH] nixos/kanidm: allow unixd-tasks to read
 /etc/{passwd/group/shadow}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This seems needed to allow map_group to work

fixes
 process_etc_passwd_group [ 107µs | 100.00% ]
┕━ 🚨 [error]:  | err: Os { code: 2, kind: NotFound, message: "No such file or directory" }
---
 nixos/modules/services/security/kanidm.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/nixos/modules/services/security/kanidm.nix b/nixos/modules/services/security/kanidm.nix
index adab048c5bf1..12599379ff01 100644
--- a/nixos/modules/services/security/kanidm.nix
+++ b/nixos/modules/services/security/kanidm.nix
@@ -996,6 +996,9 @@ in
           "-/etc/resolv.conf"
           "-/etc/nsswitch.conf"
           "-/etc/hosts"
+          "-/etc/passwd"
+          "-/etc/group"
+          "-/etc/shadow"
           "-/etc/localtime"
           "-/etc/kanidm"
           "-/etc/static/kanidm"