From 51d26cc134a74881200e613d2df82affca637d20 Mon Sep 17 00:00:00 2001 From: Lemon Lam Date: Sun, 4 Jan 2026 19:32:03 +0800 Subject: [PATCH 01/10] warpgate: 0.18.0 -> 0.19.0 Upstream fixed dependency issue, nodejs v22 still works fine, so removing the fix from npmFlags. --- pkgs/by-name/wa/warpgate/package.nix | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/pkgs/by-name/wa/warpgate/package.nix b/pkgs/by-name/wa/warpgate/package.nix index 34ac736aca9b..17933367b810 100644 --- a/pkgs/by-name/wa/warpgate/package.nix +++ b/pkgs/by-name/wa/warpgate/package.nix @@ -20,9 +20,7 @@ rustPlatform.buildRustPackage ( patches = [ ./web-ui-package-json.patch ]; - npmDepsHash = "sha256-jgsNF93DkEVgPGzdi192HKoSHPYhdrtog28jZvOLK6E="; - # Fix peer dependency conflicts with ESLint 9. - npmFlags = [ "--legacy-peer-deps" ]; + npmDepsHash = "sha256-bsVlE0uOJu3JRAn5Hjt2PUhpgJXbQBUKO+6nl0EZkyc="; nativeBuildInputs = [ openapi-generator-cli ]; @@ -37,16 +35,16 @@ rustPlatform.buildRustPackage ( in { pname = "warpgate"; - version = "0.18.0"; + version = "0.19.0"; src = fetchFromGitHub { owner = "warp-tech"; repo = "warpgate"; tag = "v${finalAttrs.version}"; - hash = "sha256-GLY/VGEKB6gFNTbBlbhpmqQZ62pk2wd6JwWwy4Tz0FE="; + hash = "sha256-PBDAZDoCFwrO1/zfQwy1MOhDDx4xHHOSvKsIYk2ayM8="; }; - cargoHash = "sha256-hwAtj8tTDsYgzuDobMg97wepKKIpohSVClyRiaDd+8w="; + cargoHash = "sha256-8m2NznKIME1UywQxmaQm+TJhhro095oU0WM7JxIyMxU="; patches = [ (replaceVars ./hardcode-version.patch { inherit (finalAttrs) version; }) From 147c25bcef02bfb19af23b7604b46588599cb3e6 Mon Sep 17 00:00:00 2001 From: Lemon Lam Date: Sun, 4 Jan 2026 19:59:44 +0800 Subject: [PATCH 02/10] nixos/warpgate: add `settings.log.format` --- nixos/modules/services/security/warpgate.nix | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/nixos/modules/services/security/warpgate.nix b/nixos/modules/services/security/warpgate.nix index a52d0eefcb42..7d6f2ca2596c 100644 --- a/nixos/modules/services/security/warpgate.nix +++ b/nixos/modules/services/security/warpgate.nix @@ -283,6 +283,14 @@ in }; }; log = { + format = mkOption { + description = "The format Warpgate emits logs in."; + default = "text"; + type = enum [ + "text" + "json" + ]; + }; retention = mkOption { description = "How long Warpgate keep its logs."; default = "7days"; From 174c6333d15e8179dc6b65e257cdc414afcdbb1c Mon Sep 17 00:00:00 2001 From: Lemon Lam Date: Sun, 4 Jan 2026 20:06:23 +0800 Subject: [PATCH 03/10] nixos/warpgate: drop `settings.config_provider` Actually it ceased to exist since 0.14.0 --- nixos/modules/services/security/warpgate.nix | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-) diff --git a/nixos/modules/services/security/warpgate.nix b/nixos/modules/services/security/warpgate.nix index 7d6f2ca2596c..a9fb7ed438f6 100644 --- a/nixos/modules/services/security/warpgate.nix +++ b/nixos/modules/services/security/warpgate.nix @@ -305,17 +305,6 @@ in type = nullOr str; }; }; - config_provider = mkOption { - description = '' - Source of truth of users. - DO NOT change this, Warpgate only implemented database provider. - ''; - default = "database"; - type = enum [ - "file" - "database" - ]; - }; }; }; default = { }; @@ -380,6 +369,10 @@ in assertion = !((cfg.databaseUrlFile == null) && (cfg.settings.database_url == null)); message = "Either databaseUrlFile or settings.database_url must be set; Set the other to null."; } + { + assertion = !(lib.hasAttr "config_provider" cfg.settings); + message = "`services.warpgate.settings.config_provider` is a legacy option that has been removed since 0.14.0. Please do not set this option."; + } ]; environment.systemPackages = [ cfg.package ]; From fd31a55c2e6fbc6625d4d12ab8f2933e55604c33 Mon Sep 17 00:00:00 2001 From: Lemon Lam Date: Tue, 6 Jan 2026 13:48:16 +0800 Subject: [PATCH 04/10] warpgate: 0.19.0 -> 0.19.1 --- pkgs/by-name/wa/warpgate/package.nix | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pkgs/by-name/wa/warpgate/package.nix b/pkgs/by-name/wa/warpgate/package.nix index 17933367b810..cb9921a369ea 100644 --- a/pkgs/by-name/wa/warpgate/package.nix +++ b/pkgs/by-name/wa/warpgate/package.nix @@ -20,7 +20,7 @@ rustPlatform.buildRustPackage ( patches = [ ./web-ui-package-json.patch ]; - npmDepsHash = "sha256-bsVlE0uOJu3JRAn5Hjt2PUhpgJXbQBUKO+6nl0EZkyc="; + npmDepsHash = "sha256-0AhbX+NhKGvWbOHwkIGE1pwJbD/ZLrOJCoWnCm8lYoY="; nativeBuildInputs = [ openapi-generator-cli ]; @@ -35,16 +35,16 @@ rustPlatform.buildRustPackage ( in { pname = "warpgate"; - version = "0.19.0"; + version = "0.19.1"; src = fetchFromGitHub { owner = "warp-tech"; repo = "warpgate"; tag = "v${finalAttrs.version}"; - hash = "sha256-PBDAZDoCFwrO1/zfQwy1MOhDDx4xHHOSvKsIYk2ayM8="; + hash = "sha256-0eaN91Uu1kCOZLblXmY9qLP8L8+UBlZWuArICQkBBk4="; }; - cargoHash = "sha256-8m2NznKIME1UywQxmaQm+TJhhro095oU0WM7JxIyMxU="; + cargoHash = "sha256-w6VMtqmo5TiMHY3x77UPXn0TJUT62/gBIVkjZ/WxgaE="; patches = [ (replaceVars ./hardcode-version.patch { inherit (finalAttrs) version; }) From bcb4fb4c35e25e4f4a08afbb062314074a4df3d4 Mon Sep 17 00:00:00 2001 From: Lemon Lam Date: Sat, 7 Mar 2026 23:35:52 +0800 Subject: [PATCH 05/10] warpgate: 0.19.1 -> 0.21.1 --- pkgs/by-name/wa/warpgate/package.nix | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pkgs/by-name/wa/warpgate/package.nix b/pkgs/by-name/wa/warpgate/package.nix index cb9921a369ea..1a88112c23f4 100644 --- a/pkgs/by-name/wa/warpgate/package.nix +++ b/pkgs/by-name/wa/warpgate/package.nix @@ -20,7 +20,7 @@ rustPlatform.buildRustPackage ( patches = [ ./web-ui-package-json.patch ]; - npmDepsHash = "sha256-0AhbX+NhKGvWbOHwkIGE1pwJbD/ZLrOJCoWnCm8lYoY="; + npmDepsHash = "sha256-MwcQL4nLN0kCMSubHbgtX3rGcA4xJjUuGv6nFgDXQtw="; nativeBuildInputs = [ openapi-generator-cli ]; @@ -35,16 +35,16 @@ rustPlatform.buildRustPackage ( in { pname = "warpgate"; - version = "0.19.1"; + version = "0.21.1"; src = fetchFromGitHub { owner = "warp-tech"; repo = "warpgate"; tag = "v${finalAttrs.version}"; - hash = "sha256-0eaN91Uu1kCOZLblXmY9qLP8L8+UBlZWuArICQkBBk4="; + hash = "sha256-j2F+Y3rEiAOybiNXD0vdo1kSdJQs78wnKD8n4JuR9VA="; }; - cargoHash = "sha256-w6VMtqmo5TiMHY3x77UPXn0TJUT62/gBIVkjZ/WxgaE="; + cargoHash = "sha256-HQdBBd+XX+7OgYrxuP+scmnG2unBVryPfA5/inflqMw="; patches = [ (replaceVars ./hardcode-version.patch { inherit (finalAttrs) version; }) From ee57154a67a835d09aaea385f6e5c9acba7ad3ab Mon Sep 17 00:00:00 2001 From: Lemon Lam Date: Sat, 7 Mar 2026 23:34:56 +0800 Subject: [PATCH 06/10] nixos/warpgate: add options for Kubernetes listener --- nixos/modules/services/security/warpgate.nix | 32 ++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/nixos/modules/services/security/warpgate.nix b/nixos/modules/services/security/warpgate.nix index a9fb7ed438f6..b7b7a886e9f9 100644 --- a/nixos/modules/services/security/warpgate.nix +++ b/nixos/modules/services/security/warpgate.nix @@ -282,6 +282,38 @@ in type = str; }; }; + kubernetes = { + enable = mkOption { + description = "Whether to enable Kubernetes listener."; + default = false; + type = bool; + }; + listen = mkOption { + description = "Listen endpoint of Kubernetes listener."; + default = "[::]:8443"; + type = str; + }; + external_port = mkOption { + description = "The Kubernetes listener is reachable via this port externally."; + default = null; + type = nullOr str; + }; + certificate = mkOption { + description = "Path to Kubernetes listener certificate."; + default = "/var/lib/warpgate/tls.certificate.pem"; + type = str; + }; + key = mkOption { + description = "Path to Kubernetes listener private key."; + default = "/var/lib/warpgate/tls.key.pem"; + type = str; + }; + session_max_age = mkOption { + description = "How long until a logged in session expires."; + default = "30m"; + type = str; + }; + }; log = { format = mkOption { description = "The format Warpgate emits logs in."; From 4296b8f8db26648a75ed006d75788a6cbe044c43 Mon Sep 17 00:00:00 2001 From: Lemon Lam Date: Tue, 21 Apr 2026 11:41:52 +0800 Subject: [PATCH 07/10] warpgate: 0.21.1 -> 0.23.1 --- .../wa/warpgate/hardcode-version.patch | 4 +-- pkgs/by-name/wa/warpgate/package.nix | 9 ++++--- .../warpgate/remove-nightly-rustflags.patch | 26 +++++++++++++++++++ 3 files changed, 33 insertions(+), 6 deletions(-) create mode 100644 pkgs/by-name/wa/warpgate/remove-nightly-rustflags.patch diff --git a/pkgs/by-name/wa/warpgate/hardcode-version.patch b/pkgs/by-name/wa/warpgate/hardcode-version.patch index a23cd10b01a8..8adadc7971dc 100644 --- a/pkgs/by-name/wa/warpgate/hardcode-version.patch +++ b/pkgs/by-name/wa/warpgate/hardcode-version.patch @@ -1,11 +1,11 @@ diff --git a/warpgate-common/src/version.rs b/warpgate-common/src/version.rs -index 07db547..2a7967f 100644 +index 0e7985a..62c2b67 100644 --- a/warpgate-common/src/version.rs +++ b/warpgate-common/src/version.rs @@ -1,8 +1,3 @@ -use git_version::git_version; - - pub fn warpgate_version() -> &'static str { + pub const fn warpgate_version() -> &'static str { - git_version!( - args = ["--tags", "--always", "--dirty=-modified"], - fallback = "unknown" diff --git a/pkgs/by-name/wa/warpgate/package.nix b/pkgs/by-name/wa/warpgate/package.nix index 1a88112c23f4..15e06f9e0fe9 100644 --- a/pkgs/by-name/wa/warpgate/package.nix +++ b/pkgs/by-name/wa/warpgate/package.nix @@ -20,7 +20,7 @@ rustPlatform.buildRustPackage ( patches = [ ./web-ui-package-json.patch ]; - npmDepsHash = "sha256-MwcQL4nLN0kCMSubHbgtX3rGcA4xJjUuGv6nFgDXQtw="; + npmDepsHash = "sha256-jRY3vR9rwqQc1WjxIuPb797ZXXrgDYNZ947fERxJ0zA="; nativeBuildInputs = [ openapi-generator-cli ]; @@ -35,19 +35,20 @@ rustPlatform.buildRustPackage ( in { pname = "warpgate"; - version = "0.21.1"; + version = "0.23.1"; src = fetchFromGitHub { owner = "warp-tech"; repo = "warpgate"; tag = "v${finalAttrs.version}"; - hash = "sha256-j2F+Y3rEiAOybiNXD0vdo1kSdJQs78wnKD8n4JuR9VA="; + hash = "sha256-GayjhHkD9LtuR7dz7tw1smz4fPwOl8R9X9QTgx9snnM="; }; - cargoHash = "sha256-HQdBBd+XX+7OgYrxuP+scmnG2unBVryPfA5/inflqMw="; + cargoHash = "sha256-Y3oVvQkZDmGmmxUYrWSP6qKZ4hgjly+t98PRmi88oaY="; patches = [ (replaceVars ./hardcode-version.patch { inherit (finalAttrs) version; }) + ./remove-nightly-rustflags.patch ]; env.RUSTFLAGS = "--cfg tokio_unstable"; diff --git a/pkgs/by-name/wa/warpgate/remove-nightly-rustflags.patch b/pkgs/by-name/wa/warpgate/remove-nightly-rustflags.patch new file mode 100644 index 000000000000..8046dce16f9e --- /dev/null +++ b/pkgs/by-name/wa/warpgate/remove-nightly-rustflags.patch @@ -0,0 +1,26 @@ +diff --git a/Cargo.toml b/Cargo.toml +index 0e92acb..d187ebc 100644 +--- a/Cargo.toml ++++ b/Cargo.toml +@@ -100,21 +100,3 @@ strip = "debuginfo" + [profile.coverage] + inherits = "dev" + # rustflags = ["-Cinstrument-coverage"] +- +-[profile.dev.package.aws-sdk-ec2] +-rustflags = ["-Zhint-mostly-unused"] +- +-[profile.release.package.aws-sdk-ec2] +-rustflags = ["-Zhint-mostly-unused"] +- +-[profile.dev.package.aws-sdk-rds] +-rustflags = ["-Zhint-mostly-unused"] +- +-[profile.release.package.aws-sdk-rds] +-rustflags = ["-Zhint-mostly-unused"] +- +-[profile.dev.package.aws-sdk-eks] +-rustflags = ["-Zhint-mostly-unused"] +- +-[profile.release.package.aws-sdk-eks] +-rustflags = ["-Zhint-mostly-unused"] From 36fa9a857f3f7d425f63009cf8c48219103a1508 Mon Sep 17 00:00:00 2001 From: Lemon Lam Date: Tue, 21 Apr 2026 12:17:00 +0800 Subject: [PATCH 08/10] nixos/warpgate: add protocol specific `external_host` --- nixos/modules/services/security/warpgate.nix | 26 ++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/nixos/modules/services/security/warpgate.nix b/nixos/modules/services/security/warpgate.nix index b7b7a886e9f9..2cb9d44e92a0 100644 --- a/nixos/modules/services/security/warpgate.nix +++ b/nixos/modules/services/security/warpgate.nix @@ -105,6 +105,7 @@ in description = '' Configure the domain name of this Warpgate instance. See [HTTP domain binding](https://warpgate.null.page/http-domain-binding/). + This option is considered legacy, please use protocol specific `external_host` instead. ''; default = null; type = nullOr str; @@ -128,6 +129,11 @@ in default = "[::]:2222"; type = str; }; + external_host = mkOption { + description = "The SSH listener is reachable via this domain name externally."; + default = null; + type = nullOr str; + }; external_port = mkOption { description = "The SSH listener is reachable via this port externally."; default = null; @@ -164,6 +170,11 @@ in default = "[::]:8888"; type = str; }; + external_host = mkOption { + description = "The HTTP listener is reachable via this domain name externally."; + default = null; + type = nullOr str; + }; external_port = mkOption { description = "The HTTP listener is reachable via this port externally."; default = null; @@ -239,6 +250,11 @@ in default = "[::]:33306"; type = str; }; + external_host = mkOption { + description = "The MySQL listener is reachable via this domain name externally."; + default = null; + type = nullOr str; + }; external_port = mkOption { description = "The MySQL listener is reachable via this port externally."; default = null; @@ -266,6 +282,11 @@ in default = "[::]:55432"; type = str; }; + external_host = mkOption { + description = "The PostgreSQL listener is reachable via this domain name externally."; + default = null; + type = nullOr str; + }; external_port = mkOption { description = "The PostgreSQL listener is reachable via this port externally."; default = null; @@ -293,6 +314,11 @@ in default = "[::]:8443"; type = str; }; + external_host = mkOption { + description = "The Kubernetes listener is reachable via this domain name externally."; + default = null; + type = nullOr str; + }; external_port = mkOption { description = "The Kubernetes listener is reachable via this port externally."; default = null; From 7688f7f735ca862264bcb4d8327170e67fb89782 Mon Sep 17 00:00:00 2001 From: Lemon Lam Date: Tue, 21 Apr 2026 12:18:18 +0800 Subject: [PATCH 09/10] nixos/warpgate: add `log.audit_retention` ... and clarify what `log.retention` does --- nixos/modules/services/security/warpgate.nix | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/nixos/modules/services/security/warpgate.nix b/nixos/modules/services/security/warpgate.nix index 2cb9d44e92a0..4ca994e70f31 100644 --- a/nixos/modules/services/security/warpgate.nix +++ b/nixos/modules/services/security/warpgate.nix @@ -349,8 +349,13 @@ in "json" ]; }; + audit_retention = mkOption { + description = "How long Warpgate keeps its audit logs."; + default = "1year"; + type = str; + }; retention = mkOption { - description = "How long Warpgate keep its logs."; + description = "How long Warpgate keeps its non-audit logs and session recordings."; default = "7days"; type = str; }; From 09e9c0110c0b8ed78aa9e33198a7323d298c52d1 Mon Sep 17 00:00:00 2001 From: Lemon Lam Date: Tue, 21 Apr 2026 12:25:28 +0800 Subject: [PATCH 10/10] nixos/warpgate: align `sso_providers` with config schema `default_credential_policy` is left out because it's not well defined in schema. --- nixos/modules/services/security/warpgate.nix | 37 ++++++++++++++++++-- 1 file changed, 34 insertions(+), 3 deletions(-) diff --git a/nixos/modules/services/security/warpgate.nix b/nixos/modules/services/security/warpgate.nix index 4ca994e70f31..3547d199cae0 100644 --- a/nixos/modules/services/security/warpgate.nix +++ b/nixos/modules/services/security/warpgate.nix @@ -51,7 +51,10 @@ in freeformType = yaml.type; options = { sso_providers = mkOption { - description = "Configure OIDC single sign-on providers."; + description = '' + Configure OIDC single sign-on providers. + Main documentation can be found [here](https://warpgate.null.page/sso). + ''; default = [ ]; type = listOf (submodule { freeformType = yaml.type; @@ -62,12 +65,40 @@ in }; label = mkOption { description = "SSO provider name displayed on login page."; - type = str; + default = null; + type = nullOr str; + }; + auto_create_users = mkOption { + description = "Whether to create user automatically at first SSO login."; + default = false; + type = bool; }; provider = mkOption { - description = "SSO provider configurations."; + description = '' + SSO provider configurations. + See [here](https://github.com/warp-tech/warpgate/blob/ffc755f0137944bd39cf4cbce90f4279da500943/config-schema.json#L430) for all acceptable options. + ''; type = attrsOf yaml.type; }; + return_domain_whitelist = mkOption { + description = '' + Controls the SSO return URL supplied to SSO provider. + This will also required you to connect to this instance via whitelisted domain when doing SSO login. + ''; + default = null; + type = nullOr (listOf str); + }; + return_url_prefix = mkOption { + description = '' + Controls the SSO return URL supplied to SSO provider. + Useful for providers that do not allow the @ sign in the URL (e.g. Azure). + ''; + default = "@"; + type = enum [ + "@" + "_" + ]; + }; }; }); example = literalExpression ''