From dda17ad20cc35c65b1147f16bae76f0dc3c5c5da Mon Sep 17 00:00:00 2001 From: "Adam C. Stephens" Date: Tue, 3 Dec 2024 15:07:30 +0000 Subject: [PATCH 1/3] kanidm: support multiple versions, 1.4 and 1.3 --- pkgs/by-name/ka/kanidm/1_3.nix | 15 +++ pkgs/by-name/ka/kanidm/1_4.nix | 5 + pkgs/by-name/ka/kanidm/generic.nix | 148 +++++++++++++++++++++++++++++ pkgs/by-name/ka/kanidm/package.nix | 134 +------------------------- pkgs/top-level/all-packages.nix | 11 ++- 5 files changed, 179 insertions(+), 134 deletions(-) create mode 100644 pkgs/by-name/ka/kanidm/1_3.nix create mode 100644 pkgs/by-name/ka/kanidm/1_4.nix create mode 100644 pkgs/by-name/ka/kanidm/generic.nix diff --git a/pkgs/by-name/ka/kanidm/1_3.nix b/pkgs/by-name/ka/kanidm/1_3.nix new file mode 100644 index 000000000000..e9d7b1cd8211 --- /dev/null +++ b/pkgs/by-name/ka/kanidm/1_3.nix @@ -0,0 +1,15 @@ +import ./generic.nix { + version = "1.3.3"; + hash = "sha256-W5G7osV4du6w/BfyY9YrDzorcLNizRsoz70RMfO2AbY="; + cargoHash = "sha256-gJrzOK6vPPBgsQFkKrbMql00XSfKGjgpZhYJLTURxoI="; + extraMeta = { + knownVulnerabilities = [ + '' + kanidm 1.3.x has reached EOL as of 2024-12-01. + + Please upgrade by verifying `kanidmd domain upgrade-check` and setting `services.kanidm.package = pkgs.kanidm_1_4;` + See upgrade guide at https://kanidm.github.io/kanidm/master/server_updates.html + '' + ]; + }; +} diff --git a/pkgs/by-name/ka/kanidm/1_4.nix b/pkgs/by-name/ka/kanidm/1_4.nix new file mode 100644 index 000000000000..f0820e203a74 --- /dev/null +++ b/pkgs/by-name/ka/kanidm/1_4.nix @@ -0,0 +1,5 @@ +import ./generic.nix { + version = "1.4.4"; + hash = "sha256-AXgq9ohnSeQvq1IIhxMhe+FhX6/hyvRsJCI4VaiN/MQ="; + cargoHash = "sha256-/PsQ9yqyhSub1Qg2A3wOsgucq4rM0CU4uA8tEOJhtAU="; +} diff --git a/pkgs/by-name/ka/kanidm/generic.nix b/pkgs/by-name/ka/kanidm/generic.nix new file mode 100644 index 000000000000..5c56898aae55 --- /dev/null +++ b/pkgs/by-name/ka/kanidm/generic.nix @@ -0,0 +1,148 @@ +{ + version, + hash, + cargoHash, + extraMeta ? { }, +}: + +{ + stdenv, + lib, + formats, + nixosTests, + rustPlatform, + fetchFromGitHub, + installShellFiles, + nix-update-script, + pkg-config, + udev, + openssl, + sqlite, + pam, + bashInteractive, + rust-jemalloc-sys, + kanidm, + # If this is enabled, kanidm will be built with two patches allowing both + # oauth2 basic secrets and admin credentials to be provisioned. + # This is NOT officially supported (and will likely never be), + # see https://github.com/kanidm/kanidm/issues/1747. + # Please report any provisioning-related errors to + # https://github.com/oddlama/kanidm-provision/issues/ instead. + enableSecretProvisioning ? false, +}: + +let + arch = if stdenv.hostPlatform.isx86_64 then "x86_64" else "generic"; +in +rustPlatform.buildRustPackage rec { + pname = "kanidm"; + inherit version cargoHash; + + src = fetchFromGitHub { + owner = pname; + repo = pname; + rev = "refs/tags/v${version}"; + inherit hash; + }; + + KANIDM_BUILD_PROFILE = "release_nixos_${arch}"; + + patches = lib.optionals enableSecretProvisioning [ + ./patches/oauth2-basic-secret-modify.patch + ./patches/recover-account.patch + ]; + + postPatch = + let + format = (formats.toml { }).generate "${KANIDM_BUILD_PROFILE}.toml"; + profile = { + admin_bind_path = "/run/kanidmd/sock"; + cpu_flags = if stdenv.hostPlatform.isx86_64 then "x86_64_legacy" else "none"; + default_config_path = "/etc/kanidm/server.toml"; + default_unix_shell_path = "${lib.getBin bashInteractive}/bin/bash"; + htmx_ui_pkg_path = "@htmx_ui_pkg_path@"; + }; + in + '' + cp ${format profile} libs/profiles/${KANIDM_BUILD_PROFILE}.toml + substituteInPlace libs/profiles/${KANIDM_BUILD_PROFILE}.toml \ + --replace-fail '@htmx_ui_pkg_path@' "$out/ui/hpkg" + ''; + + nativeBuildInputs = [ + pkg-config + installShellFiles + ]; + + buildInputs = [ + udev + openssl + sqlite + pam + rust-jemalloc-sys + ]; + + # The UI needs to be in place before the tests are run. + postBuild = '' + mkdir -p $out/ui + cp -r server/core/static $out/ui/hpkg + ''; + + # Upstream runs with the Rust equivalent of -Werror, + # which breaks when we upgrade to new Rust before them. + # Just allow warnings. It's fine, really. + env.RUSTFLAGS = "--cap-lints warn"; + + # Not sure what pathological case it hits when compiling tests with LTO, + # but disabling it takes the total `cargo check` time from 40 minutes to + # around 5 on a 16-core machine. + cargoTestFlags = [ + "--config" + ''profile.release.lto="off"'' + ]; + + preFixup = '' + installShellCompletion \ + --bash $releaseDir/build/completions/*.bash \ + --zsh $releaseDir/build/completions/_* + + # PAM and NSS need fix library names + mv $out/lib/libnss_kanidm.so $out/lib/libnss_kanidm.so.2 + mv $out/lib/libpam_kanidm.so $out/lib/pam_kanidm.so + ''; + + passthru = { + tests = { + inherit (nixosTests) kanidm kanidm-provisioning; + }; + + updateScript = nix-update-script { + # avoid spurious releases and tags such as "debs" + extraArgs = [ + "-vr" + "v(.*)" + ]; + }; + + inherit enableSecretProvisioning; + withSecretProvisioning = kanidm.override { enableSecretProvisioning = true; }; + }; + + # can take over 4 hours on 2 cores and needs 16GB+ RAM + requiredSystemFeatures = [ "big-parallel" ]; + + meta = + with lib; + { + changelog = "https://github.com/kanidm/kanidm/releases/tag/v${version}"; + description = "Simple, secure and fast identity management platform"; + homepage = "https://github.com/kanidm/kanidm"; + license = licenses.mpl20; + platforms = platforms.linux; + maintainers = with maintainers; [ + adamcstephens + Flakebi + ]; + } + // extraMeta; +} diff --git a/pkgs/by-name/ka/kanidm/package.nix b/pkgs/by-name/ka/kanidm/package.nix index 8d7afc8663eb..a7bf92b6be6d 100644 --- a/pkgs/by-name/ka/kanidm/package.nix +++ b/pkgs/by-name/ka/kanidm/package.nix @@ -1,133 +1 @@ -{ stdenv -, lib -, formats -, nixosTests -, rustPlatform -, fetchFromGitHub -, installShellFiles -, nix-update-script -, pkg-config -, udev -, openssl -, sqlite -, pam -, bashInteractive -, rust-jemalloc-sys -, kanidm -# If this is enabled, kanidm will be built with two patches allowing both -# oauth2 basic secrets and admin credentials to be provisioned. -# This is NOT officially supported (and will likely never be), -# see https://github.com/kanidm/kanidm/issues/1747. -# Please report any provisioning-related errors to -# https://github.com/oddlama/kanidm-provision/issues/ instead. -, enableSecretProvisioning ? false -}: - -let - arch = if stdenv.hostPlatform.isx86_64 then "x86_64" else "generic"; -in -rustPlatform.buildRustPackage rec { - pname = "kanidm"; - version = "1.4.4"; - - src = fetchFromGitHub { - owner = pname; - repo = pname; - rev = "refs/tags/v${version}"; - hash = "sha256-AXgq9ohnSeQvq1IIhxMhe+FhX6/hyvRsJCI4VaiN/MQ="; - }; - - cargoHash = "sha256-/PsQ9yqyhSub1Qg2A3wOsgucq4rM0CU4uA8tEOJhtAU="; - - KANIDM_BUILD_PROFILE = "release_nixos_${arch}"; - - patches = lib.optionals enableSecretProvisioning [ - ./patches/oauth2-basic-secret-modify.patch - ./patches/recover-account.patch - ]; - - postPatch = - let - format = (formats.toml { }).generate "${KANIDM_BUILD_PROFILE}.toml"; - profile = { - admin_bind_path = "/run/kanidmd/sock"; - cpu_flags = if stdenv.hostPlatform.isx86_64 then "x86_64_legacy" else "none"; - default_config_path = "/etc/kanidm/server.toml"; - default_unix_shell_path = "${lib.getBin bashInteractive}/bin/bash"; - htmx_ui_pkg_path = "@htmx_ui_pkg_path@"; - }; - in - '' - cp ${format profile} libs/profiles/${KANIDM_BUILD_PROFILE}.toml - substituteInPlace libs/profiles/${KANIDM_BUILD_PROFILE}.toml \ - --replace-fail '@htmx_ui_pkg_path@' "$out/ui/hpkg" - ''; - - nativeBuildInputs = [ - pkg-config - installShellFiles - ]; - - buildInputs = [ - udev - openssl - sqlite - pam - rust-jemalloc-sys - ]; - - # The UI needs to be in place before the tests are run. - postBuild = '' - mkdir -p $out/ui - cp -r server/core/static $out/ui/hpkg - ''; - - # Upstream runs with the Rust equivalent of -Werror, - # which breaks when we upgrade to new Rust before them. - # Just allow warnings. It's fine, really. - env.RUSTFLAGS = "--cap-lints warn"; - - # Not sure what pathological case it hits when compiling tests with LTO, - # but disabling it takes the total `cargo check` time from 40 minutes to - # around 5 on a 16-core machine. - cargoTestFlags = ["--config" ''profile.release.lto="off"'']; - - preFixup = '' - installShellCompletion \ - --bash $releaseDir/build/completions/*.bash \ - --zsh $releaseDir/build/completions/_* - - # PAM and NSS need fix library names - mv $out/lib/libnss_kanidm.so $out/lib/libnss_kanidm.so.2 - mv $out/lib/libpam_kanidm.so $out/lib/pam_kanidm.so - ''; - - passthru = { - tests = { - inherit (nixosTests) kanidm kanidm-provisioning; - }; - - updateScript = nix-update-script { - # avoid spurious releases and tags such as "debs" - extraArgs = [ - "-vr" - "v(.*)" - ]; - }; - - inherit enableSecretProvisioning; - withSecretProvisioning = kanidm.override { enableSecretProvisioning = true; }; - }; - - # can take over 4 hours on 2 cores and needs 16GB+ RAM - requiredSystemFeatures = [ "big-parallel" ]; - - meta = with lib; { - changelog = "https://github.com/kanidm/kanidm/releases/tag/v${version}"; - description = "Simple, secure and fast identity management platform"; - homepage = "https://github.com/kanidm/kanidm"; - license = licenses.mpl20; - platforms = platforms.linux; - maintainers = with maintainers; [ adamcstephens Flakebi ]; - }; -} +import ./1_4.nix diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 02fe78d397cc..bac140ad2ae1 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -11694,7 +11694,16 @@ with pkgs; jitsi-videobridge = callPackage ../servers/jitsi-videobridge { }; - kanidmWithSecretProvisioning = callPackage ../by-name/ka/kanidm/package.nix { + kanidm_1_3 = callPackage ../by-name/ka/kanidm/1_3.nix { }; + kanidm_1_4 = callPackage ../by-name/ka/kanidm/1_4.nix { }; + + kanidmWithSecretProvisioning = kanidmWithSecretProvisioning_1_4; + + kanidmWithSecretProvisioning_1_3 = callPackage ../by-name/ka/kanidm/1_3.nix { + enableSecretProvisioning = true; + }; + + kanidmWithSecretProvisioning_1_4 = callPackage ../by-name/ka/kanidm/1_4.nix { enableSecretProvisioning = true; }; From 90840cdb052d76d53fe9cdfbf3741db67f04ae9a Mon Sep 17 00:00:00 2001 From: "Adam C. Stephens" Date: Tue, 3 Dec 2024 15:33:05 +0000 Subject: [PATCH 2/3] nixos/kanidm: set default package version based on stateVersion --- nixos/modules/services/security/kanidm.nix | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/nixos/modules/services/security/kanidm.nix b/nixos/modules/services/security/kanidm.nix index ab85eed34eea..a54471c0b956 100644 --- a/nixos/modules/services/security/kanidm.nix +++ b/nixos/modules/services/security/kanidm.nix @@ -231,7 +231,10 @@ in enableServer = mkEnableOption "the Kanidm server"; enablePam = mkEnableOption "the Kanidm PAM and NSS integration"; - package = mkPackageOption pkgs "kanidm" { }; + package = mkPackageOption pkgs "kanidm" { + example = "kanidm_1_4"; + extraDescription = "If not set will receive a specific version based on stateVersion. Set to `pkgs.kanidm` to always receive the latest version, with the understanding that this could introduce breaking changes."; + }; serverSettings = mkOption { type = types.submodule { @@ -811,6 +814,16 @@ in ) ); + services.kanidm.package = + let + pkg = + if lib.versionAtLeast config.system.stateVersion "24.11" then + pkgs.kanidm_1_4 + else + lib.warn "No default kanidm package found for stateVersion = '${config.system.stateVersion}'. Using unpinned version. Consider setting `services.kanidm.package = pkgs.kanidm_1_x` to avoid upgrades introducing breaking changes." pkgs.kanidm; + in + lib.mkDefault pkg; + environment.systemPackages = mkIf cfg.enableClient [ cfg.package ]; systemd.tmpfiles.settings."10-kanidm" = { From efab2bbe79c1aed8a0492ce5a1b7a57fb4a44378 Mon Sep 17 00:00:00 2001 From: "Adam C. Stephens" Date: Tue, 3 Dec 2024 16:13:13 +0000 Subject: [PATCH 3/3] kandim: fix update script and limit to main package --- pkgs/by-name/ka/kanidm/generic.nix | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/ka/kanidm/generic.nix b/pkgs/by-name/ka/kanidm/generic.nix index 5c56898aae55..5bbf2a135eab 100644 --- a/pkgs/by-name/ka/kanidm/generic.nix +++ b/pkgs/by-name/ka/kanidm/generic.nix @@ -116,13 +116,17 @@ rustPlatform.buildRustPackage rec { inherit (nixosTests) kanidm kanidm-provisioning; }; - updateScript = nix-update-script { + updateScript = lib.optionals (!enableSecretProvisioning) (nix-update-script { # avoid spurious releases and tags such as "debs" extraArgs = [ "-vr" "v(.*)" + "--override-filename" + "pkgs/by-name/ka/kanidm/${ + builtins.replaceStrings [ "." ] [ "_" ] (lib.versions.majorMinor kanidm.version) + }.nix" ]; - }; + }); inherit enableSecretProvisioning; withSecretProvisioning = kanidm.override { enableSecretProvisioning = true; };