From c4f052c08ae5724614fda2913280233cb3c142f0 Mon Sep 17 00:00:00 2001 From: Flakebi Date: Wed, 21 May 2025 08:49:52 +0200 Subject: [PATCH] nixos/kanidm: Fix bind paths MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 1. We bound the directory of certificates, this lead to forced read-only binds of these directories, even if they should have been bound read-write for other files in there. Looking at the history, there seems to be no compelling reason for this, so switch to binding the files directly. 2. `/run/kanidmd` is configured as `RuntimeDirectory` so bound automatically and we don’t need to specify it explicitly. --- nixos/modules/services/security/kanidm.nix | 17 +++++------------ 1 file changed, 5 insertions(+), 12 deletions(-) diff --git a/nixos/modules/services/security/kanidm.nix b/nixos/modules/services/security/kanidm.nix index 67b219595458..9e624abf599b 100644 --- a/nixos/modules/services/security/kanidm.nix +++ b/nixos/modules/services/security/kanidm.nix @@ -54,15 +54,10 @@ let ++ optional (cfg.provision.extraJsonFile != null) cfg.provision.extraJsonFile ++ mapAttrsToList (_: x: x.basicSecretFile) cfg.provision.systems.oauth2 ); - secretDirectories = unique ( - map builtins.dirOf ( - [ - cfg.serverSettings.tls_chain - cfg.serverSettings.tls_key - ] - ++ optionals cfg.provision.enable provisionSecretFiles - ) - ); + secretPaths = [ + cfg.serverSettings.tls_chain + cfg.serverSettings.tls_key + ] ++ optionals cfg.provision.enable provisionSecretFiles; # Merge bind mount paths and remove paths where a prefix is already mounted. # This makes sure that if e.g. the tls_chain is in the nix store and /nix/store is already in the mount @@ -881,7 +876,7 @@ in ( defaultServiceConfig // { - BindReadOnlyPaths = mergePaths (defaultServiceConfig.BindReadOnlyPaths ++ secretDirectories); + BindReadOnlyPaths = mergePaths (defaultServiceConfig.BindReadOnlyPaths ++ secretPaths); } ) { @@ -895,8 +890,6 @@ in BindPaths = [ - # To create the socket - "/run/kanidmd:/run/kanidmd" # To store backups cfg.serverSettings.online_backup.path ]