From 79bfd80c0cda9e79ab31a14a1a0e1aa4a29fef46 Mon Sep 17 00:00:00 2001 From: daimond113 Date: Sun, 14 Dec 2025 13:27:46 +0000 Subject: [PATCH 1/5] nixos/oauth2-proxy: add support for -file options --- .../services/security/oauth2-proxy.nix | 39 ++++++++++++++++--- 1 file changed, 34 insertions(+), 5 deletions(-) diff --git a/nixos/modules/services/security/oauth2-proxy.nix b/nixos/modules/services/security/oauth2-proxy.nix index 658a356cc51c..954ba7485535 100644 --- a/nixos/modules/services/security/oauth2-proxy.nix +++ b/nixos/modules/services/security/oauth2-proxy.nix @@ -47,6 +47,7 @@ let basic-auth-password = basicAuthPassword; client-id = clientID; client-secret = clientSecret; + client-secret-file = if clientSecretFile != null then "%d/client-secret" else null; custom-templates-dir = customTemplatesDir; email-domain = email.domains; http-address = httpAddress; @@ -74,6 +75,7 @@ let secret refresh ; + secret-file = if cookie.secretFile != null then "%d/cookie-secret" else null; httponly = cookie.httpOnly; }; set-xauthrequest = setXauthrequest; @@ -181,6 +183,15 @@ in ''; }; + clientSecretFile = lib.mkOption { + type = lib.types.nullOr lib.types.path; + default = null; + description = '' + Alternative to `clientSecret`: path to a file containing the OAuth Client Secret. + ''; + example = "/run/keys/oauth2-client-secret"; + }; + skipAuthRegexes = lib.mkOption { type = lib.types.listOf lib.types.str; default = [ ]; @@ -430,6 +441,15 @@ in ''; }; + secretFile = lib.mkOption { + type = lib.types.nullOr lib.types.path; + default = null; + description = '' + Alternative to `secret`: path to a file containing the cookie secret. + ''; + example = "/run/keys/oauth2-cookie-secret"; + }; + secure = lib.mkOption { type = lib.types.bool; default = true; @@ -598,11 +618,17 @@ in ]; config = lib.mkIf cfg.enable { - services.oauth2-proxy = lib.mkIf (cfg.keyFile != null) { - clientID = lib.mkDefault null; - clientSecret = lib.mkDefault null; - cookie.secret = lib.mkDefault null; - }; + services.oauth2-proxy = lib.mkMerge [ + (lib.mkIf (cfg.keyFile != null || cfg.clientSecretFile != null) { + clientSecret = lib.mkDefault null; + }) + (lib.mkIf (cfg.keyFile != null || cfg.cookie.secretFile != null) { + cookie.secret = lib.mkDefault null; + }) + (lib.mkIf (cfg.keyFile != null) { + clientID = lib.mkDefault null; + }) + ]; users.users.oauth2-proxy = { description = "OAuth2 Proxy"; @@ -633,6 +659,9 @@ in Restart = "always"; ExecStart = "${lib.getExe cfg.package} ${configString}"; EnvironmentFile = lib.mkIf (cfg.keyFile != null) cfg.keyFile; + LoadCredential = + lib.optional (cfg.clientSecretFile != null) "client-secret:${cfg.clientSecretFile}" + ++ lib.optional (cfg.cookie.secretFile != null) "cookie-secret:${cfg.cookie.secretFile}"; }; }; }; From 6ec00ed3889d217b32f6a93b9de9f14b098927f7 Mon Sep 17 00:00:00 2001 From: dai Date: Sat, 10 Jan 2026 16:28:36 +0100 Subject: [PATCH 2/5] nixos/oauth2-proxy: document new options as alternatives to `keyFile` Co-authored-by: Sandro --- nixos/modules/services/security/oauth2-proxy.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/nixos/modules/services/security/oauth2-proxy.nix b/nixos/modules/services/security/oauth2-proxy.nix index 954ba7485535..452c61b60b54 100644 --- a/nixos/modules/services/security/oauth2-proxy.nix +++ b/nixos/modules/services/security/oauth2-proxy.nix @@ -187,7 +187,7 @@ in type = lib.types.nullOr lib.types.path; default = null; description = '' - Alternative to `clientSecret`: path to a file containing the OAuth Client Secret. + Alternative to `clientSecret` and `keyFile`: path to a file containing the OAuth Client Secret. ''; example = "/run/keys/oauth2-client-secret"; }; @@ -445,7 +445,7 @@ in type = lib.types.nullOr lib.types.path; default = null; description = '' - Alternative to `secret`: path to a file containing the cookie secret. + Alternative to `secret` and `keyFile`: path to a file containing the cookie secret. ''; example = "/run/keys/oauth2-cookie-secret"; }; From fcba91360a9d574382d4758ba0d6fb35881e2b45 Mon Sep 17 00:00:00 2001 From: daimond113 Date: Sat, 10 Jan 2026 21:53:38 +0000 Subject: [PATCH 3/5] nixos/oauth2-proxy: require secure secret passing --- .../services/security/oauth2-proxy.nix | 52 +++++++++---------- 1 file changed, 24 insertions(+), 28 deletions(-) diff --git a/nixos/modules/services/security/oauth2-proxy.nix b/nixos/modules/services/security/oauth2-proxy.nix index 452c61b60b54..f33c572c484a 100644 --- a/nixos/modules/services/security/oauth2-proxy.nix +++ b/nixos/modules/services/security/oauth2-proxy.nix @@ -46,7 +46,6 @@ let approval-prompt = approvalPrompt; basic-auth-password = basicAuthPassword; client-id = clientID; - client-secret = clientSecret; client-secret-file = if clientSecretFile != null then "%d/client-secret" else null; custom-templates-dir = customTemplatesDir; email-domain = email.domains; @@ -72,7 +71,6 @@ let secure expire name - secret refresh ; secret-file = if cookie.secretFile != null then "%d/cookie-secret" else null; @@ -161,6 +159,7 @@ in clientID = lib.mkOption { type = lib.types.nullOr lib.types.str; + default = null; description = '' The OAuth Client ID. ''; @@ -176,18 +175,11 @@ in example = "https://login.microsoftonline.com/{TENANT_ID}/v2.0"; }; - clientSecret = lib.mkOption { - type = lib.types.nullOr lib.types.str; - description = '' - The OAuth Client Secret. - ''; - }; - clientSecretFile = lib.mkOption { type = lib.types.nullOr lib.types.path; default = null; description = '' - Alternative to `clientSecret` and `keyFile`: path to a file containing the OAuth Client Secret. + The path to a file containing the OAuth Client Secret. ''; example = "/run/keys/oauth2-client-secret"; }; @@ -434,18 +426,11 @@ in example = "168h0m0s"; }; - secret = lib.mkOption { - type = lib.types.nullOr lib.types.str; - description = '' - The seed string for secure cookies. - ''; - }; - secretFile = lib.mkOption { type = lib.types.nullOr lib.types.path; default = null; description = '' - Alternative to `secret` and `keyFile`: path to a file containing the cookie secret. + The path to a file containing the seed string for secure cookies. ''; example = "/run/keys/oauth2-cookie-secret"; }; @@ -615,19 +600,30 @@ in imports = [ (lib.mkRenamedOptionModule [ "services" "oauth2_proxy" ] [ "services" "oauth2-proxy" ]) + (lib.mkRemovedOptionModule [ "services" "oauth2-proxy" "clientSecret" ] '' + This option has been removed as it made the client secret world-readable. + Use services.oauth2-proxy.clientSecretFile instead. + '') + (lib.mkRemovedOptionModule [ "services" "oauth2-proxy" "cookie" "secret" ] '' + This option has been removed as it made the cookie secret world-readable. + Use services.oauth2-proxy.cookie.secretFile instead. + '') ]; config = lib.mkIf cfg.enable { - services.oauth2-proxy = lib.mkMerge [ - (lib.mkIf (cfg.keyFile != null || cfg.clientSecretFile != null) { - clientSecret = lib.mkDefault null; - }) - (lib.mkIf (cfg.keyFile != null || cfg.cookie.secretFile != null) { - cookie.secret = lib.mkDefault null; - }) - (lib.mkIf (cfg.keyFile != null) { - clientID = lib.mkDefault null; - }) + assertions = [ + { + assertion = cfg.clientID != null || cfg.keyFile != null; + message = "Either services.oauth2-proxy.clientID or services.oauth2-proxy.keyFile must be specified."; + } + { + assertion = cfg.clientSecretFile != null || cfg.keyFile != null; + message = "Either services.oauth2-proxy.clientSecretFile or services.oauth2-proxy.keyFile must be specified."; + } + { + assertion = cfg.cookie.secretFile != null || cfg.keyFile != null; + message = "Either services.oauth2-proxy.cookie.secretFile or services.oauth2-proxy.keyFile must be specified."; + } ]; users.users.oauth2-proxy = { From d4d72cce75df0fd0ff2657dfd8764add31ebab85 Mon Sep 17 00:00:00 2001 From: daimond113 Date: Sat, 10 Jan 2026 22:07:07 +0000 Subject: [PATCH 4/5] nixos/oauth2-proxy: document breaking change in release notes --- nixos/doc/manual/release-notes/rl-2605.section.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md index d1fe153f0df1..f663fb9a6522 100644 --- a/nixos/doc/manual/release-notes/rl-2605.section.md +++ b/nixos/doc/manual/release-notes/rl-2605.section.md @@ -82,6 +82,8 @@ of pulling the upstream container image from Docker Hub. If you want the old beh - `systemd.services.stalwart` owned by `stalwart:stalwart`. The `user` and `group` are configurable via `services.stalwart.user` and `services.stalwart.group`, respectively. By default, if `stateVersion` is older than `26.05`, will fallback to legacy value of `stalwart-mail` for both `user` and `group`. - Default value for `services.stalwart.dataDir` has changed to `/var/lib/stalwart`. If `stateVersion` is older than `26.05`, will fallback to legacy value of `/var/lib/stalwart-mail`. +- `services.oauth2-proxy.clientSecret` and `services.oauth2-proxy.cookie.secret` have been replaced with `services.oauth2-proxy.clientSecretFile` and `services.oauth2-proxy.cookie.secretFile` respectively. This was done to ensure secrets don't get made world-readable. + - Ethercalc and its associated module have been removed, as the package is unmaintained and cannot be installed from source with npm now. - `services.cgit` before always had the git-http-backend and its "export all" setting enabled, which sidestepped any access control configured in cgit's settings. Now you have to make a decision and either enable or disable `services.cgit.gitHttpBackend.checkExportOkFiles` (or disable the git-http-backend). From 0f7f3caa32a780eb25c265904b9d020e834bab08 Mon Sep 17 00:00:00 2001 From: daimond113 Date: Sat, 10 Jan 2026 22:59:29 +0000 Subject: [PATCH 5/5] nixos/oauth2-proxy: remove *secretFile requirement --- nixos/modules/services/security/oauth2-proxy.nix | 8 -------- 1 file changed, 8 deletions(-) diff --git a/nixos/modules/services/security/oauth2-proxy.nix b/nixos/modules/services/security/oauth2-proxy.nix index f33c572c484a..a691bd03a77c 100644 --- a/nixos/modules/services/security/oauth2-proxy.nix +++ b/nixos/modules/services/security/oauth2-proxy.nix @@ -616,14 +616,6 @@ in assertion = cfg.clientID != null || cfg.keyFile != null; message = "Either services.oauth2-proxy.clientID or services.oauth2-proxy.keyFile must be specified."; } - { - assertion = cfg.clientSecretFile != null || cfg.keyFile != null; - message = "Either services.oauth2-proxy.clientSecretFile or services.oauth2-proxy.keyFile must be specified."; - } - { - assertion = cfg.cookie.secretFile != null || cfg.keyFile != null; - message = "Either services.oauth2-proxy.cookie.secretFile or services.oauth2-proxy.keyFile must be specified."; - } ]; users.users.oauth2-proxy = {