feat: Improved config further further
This commit is contained in:
parent
e810bca085
commit
35f6d63c10
2 changed files with 215 additions and 224 deletions
|
|
@ -7,49 +7,26 @@
|
|||
with lib; let
|
||||
cfg = config.services.bitwarden_directory_connector;
|
||||
|
||||
ldap_data = builtins.toJSON {
|
||||
ssl = cfg.ldap.ssl;
|
||||
startTls = cfg.ldap.startTls;
|
||||
sslAllowUnauthorized = cfg.ldap.sslAllowUnauthorized;
|
||||
port = cfg.ldap.port;
|
||||
currentUser = false;
|
||||
ad = cfg.ldap.ad;
|
||||
pagedSearch = true;
|
||||
password = "to_be_replaced";
|
||||
hostname = cfg.ldap.hostname;
|
||||
rootPath = cfg.ldap.root;
|
||||
username = cfg.ldap.username;
|
||||
};
|
||||
ldap_data = builtins.toJSON cfg.ldap;
|
||||
sync_data = builtins.toJSON cfg.sync;
|
||||
|
||||
sync_data =
|
||||
builtins.toJSON
|
||||
({
|
||||
removeDisabled = cfg.sync.removeDisabled;
|
||||
overwriteExisting = cfg.sync.overwriteExisting;
|
||||
largeImport = cfg.sync.largeImport;
|
||||
creationDateAttribute = cfg.sync.creationDateAttribute;
|
||||
memberAttribute = cfg.sync.memberAttribute;
|
||||
interval = 5;
|
||||
useEmailPrefixSuffix = cfg.sync.emailPrefixSuffix.enable;
|
||||
users = cfg.sync.users.enable;
|
||||
groups = cfg.sync.groups.enable;
|
||||
}
|
||||
// optionalAttrs cfg.sync.emailPrefixSuffix.enable {
|
||||
emailPrefixAttribute = cfg.sync.emailPrefixSuffix.prefixAttribute;
|
||||
emailSuffix = cfg.sync.emailPrefixSuffix.suffix;
|
||||
}
|
||||
// optionalAttrs cfg.sync.users.enable {
|
||||
userPath = cfg.sync.users.path;
|
||||
userObjectClass = cfg.sync.users.objectClass;
|
||||
userEmailAttribute = cfg.sync.users.emailAttribute;
|
||||
userFilter = cfg.sync.users.filter;
|
||||
}
|
||||
// optionalAttrs cfg.sync.groups.enable {
|
||||
groupPath = cfg.sync.groups.path;
|
||||
groupObjectClass = cfg.sync.groups.objectClass;
|
||||
groupNameAttribute = cfg.sync.groups.nameAttribute;
|
||||
groupFilter = cfg.sync.groups.filter;
|
||||
});
|
||||
# coping directly from nix https://github.com/NixOS/nixpkgs/blob/da4024d0ead5d7820f6bd15147d3fe2a0c0cec73/nixos/modules/config/nix.nix#L62C1-L76C49
|
||||
semanticConfType = with types; let
|
||||
confAtom =
|
||||
nullOr
|
||||
(oneOf [
|
||||
bool
|
||||
int
|
||||
float
|
||||
str
|
||||
path
|
||||
package
|
||||
])
|
||||
// {
|
||||
description = "Nix config atom (null, bool, int, float, str, path or package)";
|
||||
};
|
||||
in
|
||||
attrsOf (either confAtom (listOf confAtom));
|
||||
|
||||
json_string = string: builtins.replaceStrings ["\""] ["\\\""] string;
|
||||
in {
|
||||
|
|
@ -90,7 +67,23 @@ in {
|
|||
default = "/etc/bitwarden/bwdc";
|
||||
};
|
||||
|
||||
ldap = {
|
||||
pw_env = mkOption {
|
||||
type = types.str;
|
||||
description = lib.mdDoc "The ENV var that the ldap password is stored.";
|
||||
default = "LDAP_PW";
|
||||
};
|
||||
interval = mkOption {
|
||||
type = types.str;
|
||||
default = "*:0,15,30,45";
|
||||
description = lib.mdDoc "When to run the connector, OnCalendar syntax.";
|
||||
};
|
||||
|
||||
ldap = mkOption {
|
||||
description = lib.mdDoc "Options to configurate LDAP.";
|
||||
type = types.submodule {
|
||||
freeformType = semanticConfType;
|
||||
|
||||
options = {
|
||||
ssl = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
|
|
@ -106,23 +99,34 @@ in {
|
|||
default = false;
|
||||
description = lib.mdDoc "";
|
||||
};
|
||||
ad = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = lib.mdDoc "Is Active Directory.";
|
||||
};
|
||||
port = mkOption {
|
||||
type = types.int;
|
||||
default = 389;
|
||||
description = lib.mdDoc "Port LDAP is accessable on";
|
||||
};
|
||||
currentUser = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = lib.mdDoc "Unknown what this does.";
|
||||
};
|
||||
ad = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = lib.mdDoc "Is Active Directory.";
|
||||
};
|
||||
pagedSearch = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = lib.mdDoc "The LDAP server paginates search results.";
|
||||
};
|
||||
|
||||
hostname = mkOption {
|
||||
type = types.str;
|
||||
description = lib.mdDoc "The host the LDAP is accessable on.";
|
||||
example = "ldap.example.com";
|
||||
};
|
||||
|
||||
root = mkOption {
|
||||
rootPath = mkOption {
|
||||
type = types.str;
|
||||
description = lib.mdDoc "Root path for LDAP";
|
||||
example = "dc=example,dc=com";
|
||||
|
|
@ -133,19 +137,16 @@ in {
|
|||
description = lib.mdDoc "The user to authenticate as.";
|
||||
example = "cn=admin,dc=example,dc=com";
|
||||
};
|
||||
pw_env = mkOption {
|
||||
type = types.str;
|
||||
description = lib.mdDoc "The ENV var that the ldap password is stored.";
|
||||
default = "LDAP_PW";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
sync = {
|
||||
interval = mkOption {
|
||||
type = types.str;
|
||||
default = "*:0,15,30,45";
|
||||
description = lib.mdDoc "When to run the connector, OnCalendar syntax.";
|
||||
};
|
||||
sync = mkOption {
|
||||
description = lib.mdDoc "Options to configurate what gets synced.";
|
||||
type = types.submodule {
|
||||
freeformType = semanticConfType;
|
||||
|
||||
options = {
|
||||
removeDisabled = mkOption {
|
||||
type = types.bool;
|
||||
default = true;
|
||||
|
|
@ -175,76 +176,75 @@ in {
|
|||
example = "whenCreated";
|
||||
};
|
||||
|
||||
emailPrefixSuffix = {
|
||||
enable = mkOption {
|
||||
useEmailPrefixSuffix = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = lib.mdDoc "If a user has no email address, combine a username prefix with a suffix value to form an email.";
|
||||
};
|
||||
prefixAttribute = mkOption {
|
||||
emailPrefixAttribute = mkOption {
|
||||
type = types.str;
|
||||
description = lib.mdDoc "Attribute that has a users username.";
|
||||
example = "accountName";
|
||||
default = "accountName";
|
||||
};
|
||||
suffix = mkOption {
|
||||
emailSuffix = mkOption {
|
||||
type = types.str;
|
||||
description = lib.mdDoc "Suffix for the email, normally @example.com.";
|
||||
example = "@example.com";
|
||||
};
|
||||
default = "@example.com";
|
||||
};
|
||||
|
||||
users = {
|
||||
enable = mkOption {
|
||||
users = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = lib.mdDoc "Sync users.";
|
||||
};
|
||||
path = mkOption {
|
||||
userPath = mkOption {
|
||||
type = types.str;
|
||||
description = lib.mdDoc "User directory, relative to root.";
|
||||
example = "ou=users";
|
||||
default = "ou=users";
|
||||
};
|
||||
objectClass = mkOption {
|
||||
userObjectClass = mkOption {
|
||||
type = types.str;
|
||||
description = lib.mdDoc "A class that users will have.";
|
||||
example = "inetOrgPerson";
|
||||
default = "inetOrgPerson";
|
||||
};
|
||||
emailAttribute = mkOption {
|
||||
userEmailAttribute = mkOption {
|
||||
type = types.str;
|
||||
description = lib.mdDoc "Attribute for a users email.";
|
||||
example = "mail";
|
||||
default = "mail";
|
||||
};
|
||||
filter = mkOption {
|
||||
userFilter = mkOption {
|
||||
type = types.str;
|
||||
description = lib.mdDoc "Filter for users.";
|
||||
example = "(memberOf=cn=sales,ou=groups,dc=example,dc=com)";
|
||||
default = "";
|
||||
};
|
||||
};
|
||||
groups = {
|
||||
enable = mkOption {
|
||||
|
||||
groups = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = lib.mdDoc "Sync groups.";
|
||||
};
|
||||
path = mkOption {
|
||||
groupPath = mkOption {
|
||||
type = types.str;
|
||||
description = lib.mdDoc "Group directory, relative to root.";
|
||||
example = "ou=groups";
|
||||
default = "ou=groups";
|
||||
};
|
||||
objectClass = mkOption {
|
||||
groupObjectClass = mkOption {
|
||||
type = types.str;
|
||||
description = lib.mdDoc "A class that groups will have.";
|
||||
example = "groupOfNames";
|
||||
default = "groupOfNames";
|
||||
};
|
||||
nameAttribute = mkOption {
|
||||
groupNameAttribute = mkOption {
|
||||
type = types.str;
|
||||
description = lib.mdDoc "Attribute for a name of group.";
|
||||
example = "cn";
|
||||
default = "cn";
|
||||
};
|
||||
filter = mkOption {
|
||||
groupFilter = mkOption {
|
||||
type = types.str;
|
||||
description = lib.mdDoc "Filter for groups.";
|
||||
example = "(cn=sales)";
|
||||
default = "";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
|
@ -252,7 +252,7 @@ in {
|
|||
env = {
|
||||
ldap = mkOption rec {
|
||||
type = types.str;
|
||||
description = "Auth for the LDAP, has value defined in {option}`ldap.pw_env";
|
||||
description = "Auth for the LDAP, has value defined in {option}`pw_env";
|
||||
};
|
||||
bitwarden = mkOption rec {
|
||||
type = types.str;
|
||||
|
|
@ -278,7 +278,7 @@ in {
|
|||
wantedBy = ["timers.target"];
|
||||
partOf = ["bitwarden_directory_connector.service"];
|
||||
timerConfig = {
|
||||
OnCalendar = cfg.sync.interval;
|
||||
OnCalendar = cfg.interval;
|
||||
Unit = "bitwarden_directory_connector.service";
|
||||
Persistent = true;
|
||||
};
|
||||
|
|
@ -309,27 +309,21 @@ in {
|
|||
# now login to set credentials
|
||||
${cfg.package}/bin/${cfg.binary_name} login
|
||||
|
||||
# set the ldap details
|
||||
account=$(jq '.authenticatedAccounts[0]?' ${cfg.directory}/data.json)
|
||||
jq ".[$account].directoryConfigurations.ldap |= ${json_string ldap_data}" ${cfg.directory}/data.json > ${cfg.directory}/data1.json
|
||||
jq '.authenticatedAccounts[0] as $account
|
||||
| .[$account].directoryConfigurations.ldap |= $ldap_data
|
||||
| .[$account].directorySettings.organizationId |= $orgID
|
||||
| .[$account].directorySettings.sync |= $sync_data' \
|
||||
--argjson ldap_data ${escapeShellArg ldap_data} \
|
||||
--arg orgID "''${BW_CLIENTID//organization.}" \
|
||||
--argjson sync_data ${escapeShellArg sync_data} \
|
||||
${escapeShellArg cfg.directory}/data.json \
|
||||
> ${escapeShellArg cfg.directory}/data.json.tmp
|
||||
|
||||
# remove the original
|
||||
rm -f ${cfg.directory}/data.json
|
||||
|
||||
# set the client id
|
||||
orgID=$(echo $BW_CLIENTID | sed 's/organization\.//g')
|
||||
jq ".[$account].directorySettings.organizationId |= \"$orgID\" " ${cfg.directory}/data1.json > ${cfg.directory}/data2.json
|
||||
|
||||
# and sync data
|
||||
jq ".[$account].directorySettings.sync |= ${json_string sync_data}" ${cfg.directory}/data2.json > ${cfg.directory}/data.json
|
||||
mv -f -- ${escapeShellArg cfg.directory}/data.json.tmp ${escapeShellArg cfg.directory}/data.json
|
||||
|
||||
# final config
|
||||
${cfg.package}/bin/${cfg.binary_name} config directory 0
|
||||
${cfg.package}/bin/${cfg.binary_name} config ldap.password --secretenv ${cfg.ldap.pw_env}
|
||||
|
||||
# cleanup temp files
|
||||
rm -f ${cfg.directory}/data1.json
|
||||
rm -f ${cfg.directory}/data2.json
|
||||
${cfg.package}/bin/${cfg.binary_name} config ldap.password --secretenv ${cfg.pw_env}
|
||||
'';
|
||||
|
||||
ExecStart = ''${cfg.package}/bin/${cfg.binary_name} sync'';
|
||||
|
|
|
|||
|
|
@ -22,6 +22,8 @@ in {
|
|||
|
||||
package = pkgs.callPackage ./_bitwarden-directory-connector.nix {};
|
||||
|
||||
pw_env = "LDAP_ADMIN_PW";
|
||||
|
||||
ldap = {
|
||||
ssl = false;
|
||||
startTls = false;
|
||||
|
|
@ -29,9 +31,8 @@ in {
|
|||
ad = false;
|
||||
port = 389;
|
||||
hostname = "account.skynet.ie";
|
||||
root = "dc=skynet,dc=ie";
|
||||
rootPath = "dc=skynet,dc=ie";
|
||||
username = "cn=admin,dc=skynet,dc=ie";
|
||||
pw_env = "LDAP_ADMIN_PW";
|
||||
};
|
||||
|
||||
sync = {
|
||||
|
|
@ -40,21 +41,17 @@ in {
|
|||
largeImport = false;
|
||||
memberAttribute = "member";
|
||||
creationDateAttribute = "skCreated";
|
||||
emailPrefixSuffix.enable = false;
|
||||
users = {
|
||||
enable = true;
|
||||
path = "ou=users";
|
||||
objectClass = "inetOrgPerson";
|
||||
emailAttribute = "skMail";
|
||||
filter = "(|(memberOf=cn=skynet-committee,ou=groups,dc=skynet,dc=ie)(memberOf=cn=skynet-admins,ou=groups,dc=skynet,dc=ie))";
|
||||
};
|
||||
groups = {
|
||||
enable = true;
|
||||
path = "ou=groups";
|
||||
objectClass = "groupOfNames";
|
||||
nameAttribute = "cn";
|
||||
filter = "";
|
||||
};
|
||||
|
||||
users = true;
|
||||
userPath = "ou=users";
|
||||
userObjectClass = "inetOrgPerson";
|
||||
userEmailAttribute = "skMail";
|
||||
userFilter = "(|(memberOf=cn=skynet-committee,ou=groups,dc=skynet,dc=ie)(memberOf=cn=skynet-admins,ou=groups,dc=skynet,dc=ie))";
|
||||
|
||||
groups = true;
|
||||
groupPath = "ou=groups";
|
||||
groupObjectClass = "groupOfNames";
|
||||
groupNameAttribute = "cn";
|
||||
};
|
||||
|
||||
env = {
|
||||
|
|
|
|||
Loading…
Reference in a new issue