Compare commits
1 Commits
heimdal-op
...
mediawiki-
| Author | SHA1 | Date | |
|---|---|---|---|
| 7d7fb21004 |
41
flake.lock
generated
41
flake.lock
generated
@@ -7,11 +7,11 @@
|
|||||||
]
|
]
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1709632354,
|
"lastModified": 1700927249,
|
||||||
"narHash": "sha256-jxRHwqrtNze51WKFKvxlQ8Inf62UNRl5cFqEQ2V96vE=",
|
"narHash": "sha256-iqmIWiEng890/ru7ZBf4nUezFPyRm2fjRTvuwwxqk2o=",
|
||||||
"owner": "nix-community",
|
"owner": "nix-community",
|
||||||
"repo": "disko",
|
"repo": "disko",
|
||||||
"rev": "0d11aa8d6431326e10b8656420f91085c3bd0b12",
|
"rev": "3cb78c93e6a02f494aaf6aeb37481c27a2e2ee22",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
@@ -65,31 +65,32 @@
|
|||||||
"nixpkgs-lib": "nixpkgs-lib"
|
"nixpkgs-lib": "nixpkgs-lib"
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1701507532,
|
"lastModified": 1697936579,
|
||||||
"narHash": "sha256-Zzv8OFB7iilzDGe6z2t/j8qRtR23TN3N8LssGsvRWEA=",
|
"narHash": "sha256-nMyepKnwoHMzu2OpXvG2ZhU081TV9ENmWCo0vWxs6AI=",
|
||||||
"owner": "dali99",
|
"owner": "dali99",
|
||||||
"repo": "nixos-matrix-modules",
|
"repo": "nixos-matrix-modules",
|
||||||
"rev": "046194cdadc50d81255a9c57789381ed1153e2b1",
|
"rev": "e09814657187c8ed1a5fe1646df6d8da1eb2dee9",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
"owner": "dali99",
|
"owner": "dali99",
|
||||||
"repo": "nixos-matrix-modules",
|
"repo": "nixos-matrix-modules",
|
||||||
|
"rev": "e09814657187c8ed1a5fe1646df6d8da1eb2dee9",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"nixpkgs": {
|
"nixpkgs": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1709565521,
|
"lastModified": 1701362232,
|
||||||
"narHash": "sha256-YP3H7Lm3IhOKHIcn+qMCLRINJG313Io5CjvNTJyrnhY=",
|
"narHash": "sha256-GVdzxL0lhEadqs3hfRLuj+L1OJFGiL/L7gCcelgBlsw=",
|
||||||
"owner": "NixOS",
|
"owner": "NixOS",
|
||||||
"repo": "nixpkgs",
|
"repo": "nixpkgs",
|
||||||
"rev": "9a5f1a573376eeb8c525f936eed32fabfb6e81be",
|
"rev": "d2332963662edffacfddfad59ff4f709dde80ffe",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
"id": "nixpkgs",
|
"id": "nixpkgs",
|
||||||
"ref": "nixos-23.11-small",
|
"ref": "nixos-23.05-small",
|
||||||
"type": "indirect"
|
"type": "indirect"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
@@ -110,27 +111,27 @@
|
|||||||
},
|
},
|
||||||
"nixpkgs-stable": {
|
"nixpkgs-stable": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1709428628,
|
"lastModified": 1700905716,
|
||||||
"narHash": "sha256-//ZCCnpVai/ShtO2vPjh3AWgo8riXCaret6V9s7Hew4=",
|
"narHash": "sha256-w1vHn2MbGfdC+CrP3xLZ3scsI06N0iQLU7eTHIVEFGw=",
|
||||||
"owner": "NixOS",
|
"owner": "NixOS",
|
||||||
"repo": "nixpkgs",
|
"repo": "nixpkgs",
|
||||||
"rev": "66d65cb00b82ffa04ee03347595aa20e41fe3555",
|
"rev": "dfb95385d21475da10b63da74ae96d89ab352431",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
"owner": "NixOS",
|
"owner": "NixOS",
|
||||||
"ref": "release-23.11",
|
"ref": "release-23.05",
|
||||||
"repo": "nixpkgs",
|
"repo": "nixpkgs",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"nixpkgs-unstable": {
|
"nixpkgs-unstable": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1712963716,
|
"lastModified": 1701368325,
|
||||||
"narHash": "sha256-WKm9CvgCldeIVvRz87iOMi8CFVB1apJlkUT4GGvA0iM=",
|
"narHash": "sha256-3OqZyi2EdopJxpxwrySPyCTuCvfBY4oXTLVgQ4B6qDg=",
|
||||||
"owner": "NixOS",
|
"owner": "NixOS",
|
||||||
"repo": "nixpkgs",
|
"repo": "nixpkgs",
|
||||||
"rev": "cfd6b5fc90b15709b780a5a1619695a88505a176",
|
"rev": "3934dbde4f4a0e266825348bc4ad1bdd00a8d6a3",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
@@ -179,11 +180,11 @@
|
|||||||
"nixpkgs-stable": "nixpkgs-stable"
|
"nixpkgs-stable": "nixpkgs-stable"
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1709591996,
|
"lastModified": 1701127353,
|
||||||
"narHash": "sha256-0sQcalXSgqlO6mnxBTXkSQChBHy2GQsokB1XY8r+LpQ=",
|
"narHash": "sha256-qVNX0wOl0b7+I35aRu78xUphOyELh+mtUp1KBx89K1Q=",
|
||||||
"owner": "Mic92",
|
"owner": "Mic92",
|
||||||
"repo": "sops-nix",
|
"repo": "sops-nix",
|
||||||
"rev": "291aad29b59ceda517a06e59809f35cb0bb17c6b",
|
"rev": "b1edbf5c0464b4cced90a3ba6f999e671f0af631",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
|||||||
18
flake.nix
18
flake.nix
@@ -2,7 +2,7 @@
|
|||||||
description = "PVV System flake";
|
description = "PVV System flake";
|
||||||
|
|
||||||
inputs = {
|
inputs = {
|
||||||
nixpkgs.url = "nixpkgs/nixos-23.11-small";
|
nixpkgs.url = "nixpkgs/nixos-23.05-small";
|
||||||
nixpkgs-unstable.url = "nixpkgs/nixos-unstable-small";
|
nixpkgs-unstable.url = "nixpkgs/nixos-unstable-small";
|
||||||
|
|
||||||
sops-nix.url = "github:Mic92/sops-nix";
|
sops-nix.url = "github:Mic92/sops-nix";
|
||||||
@@ -14,7 +14,8 @@
|
|||||||
pvv-calendar-bot.url = "git+https://git.pvv.ntnu.no/Projects/calendar-bot.git";
|
pvv-calendar-bot.url = "git+https://git.pvv.ntnu.no/Projects/calendar-bot.git";
|
||||||
pvv-calendar-bot.inputs.nixpkgs.follows = "nixpkgs";
|
pvv-calendar-bot.inputs.nixpkgs.follows = "nixpkgs";
|
||||||
|
|
||||||
matrix-next.url = "github:dali99/nixos-matrix-modules";
|
# Last release compatible with 23.05
|
||||||
|
matrix-next.url = "github:dali99/nixos-matrix-modules/e09814657187c8ed1a5fe1646df6d8da1eb2dee9";
|
||||||
|
|
||||||
grzegorz.url = "github:Programvareverkstedet/grzegorz";
|
grzegorz.url = "github:Programvareverkstedet/grzegorz";
|
||||||
grzegorz.inputs.nixpkgs.follows = "nixpkgs-unstable";
|
grzegorz.inputs.nixpkgs.follows = "nixpkgs-unstable";
|
||||||
@@ -57,6 +58,9 @@
|
|||||||
pkgs = import nixpkgs {
|
pkgs = import nixpkgs {
|
||||||
inherit system;
|
inherit system;
|
||||||
overlays = [
|
overlays = [
|
||||||
|
(final: prev: {
|
||||||
|
mx-puppet-discord = prev.mx-puppet-discord.override { nodejs_14 = final.nodejs_18; };
|
||||||
|
})
|
||||||
inputs.pvv-calendar-bot.overlays.${system}.default
|
inputs.pvv-calendar-bot.overlays.${system}.default
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
@@ -123,22 +127,12 @@
|
|||||||
packages = {
|
packages = {
|
||||||
"x86_64-linux" = let
|
"x86_64-linux" = let
|
||||||
pkgs = nixpkgs.legacyPackages."x86_64-linux";
|
pkgs = nixpkgs.legacyPackages."x86_64-linux";
|
||||||
pkgs-unstable = nixpkgs-unstable.legacyPackages."x86_64-linux";
|
|
||||||
in rec {
|
in rec {
|
||||||
default = important-machines;
|
default = important-machines;
|
||||||
important-machines = pkgs.linkFarm "important-machines"
|
important-machines = pkgs.linkFarm "important-machines"
|
||||||
(nixlib.getAttrs importantMachines self.packages.x86_64-linux);
|
(nixlib.getAttrs importantMachines self.packages.x86_64-linux);
|
||||||
all-machines = pkgs.linkFarm "all-machines"
|
all-machines = pkgs.linkFarm "all-machines"
|
||||||
(nixlib.getAttrs allMachines self.packages.x86_64-linux);
|
(nixlib.getAttrs allMachines self.packages.x86_64-linux);
|
||||||
heimdal = pkgs.callPackage hosts/buskerud/containers/salsa/services/heimdal/package.nix {
|
|
||||||
inherit (pkgs.apple_sdk.frameworks)
|
|
||||||
CoreFoundation Security SystemConfiguration;
|
|
||||||
};
|
|
||||||
heimdal-unstable = pkgs-unstable.callPackage hosts/buskerud/containers/salsa/services/heimdal/package.nix {
|
|
||||||
inherit (pkgs.apple_sdk.frameworks)
|
|
||||||
CoreFoundation Security SystemConfiguration;
|
|
||||||
};
|
|
||||||
inherit pkgs pkgs-unstable;
|
|
||||||
} // nixlib.genAttrs allMachines
|
} // nixlib.genAttrs allMachines
|
||||||
(machine: self.nixosConfigurations.${machine}.config.system.build.toplevel);
|
(machine: self.nixosConfigurations.${machine}.config.system.build.toplevel);
|
||||||
};
|
};
|
||||||
|
|||||||
@@ -10,10 +10,10 @@
|
|||||||
|
|
||||||
# TODO: set up authentication for the following:
|
# TODO: set up authentication for the following:
|
||||||
# ./services/website.nix
|
# ./services/website.nix
|
||||||
./services/nginx
|
./services/nginx.nix
|
||||||
./services/gitea/default.nix
|
./services/gitea/default.nix
|
||||||
./services/webmail
|
./services/webmail
|
||||||
# ./services/mediawiki.nix
|
./services/mediawiki.nix
|
||||||
];
|
];
|
||||||
|
|
||||||
sops.defaultSopsFile = ../../secrets/bekkalokk/bekkalokk.yaml;
|
sops.defaultSopsFile = ../../secrets/bekkalokk/bekkalokk.yaml;
|
||||||
|
|||||||
@@ -1,4 +1,4 @@
|
|||||||
{ pkgs, lib, config, values, ... }: let
|
{ pkgs, lib, config, values, pkgs-unstable, ... }: let
|
||||||
cfg = config.services.mediawiki;
|
cfg = config.services.mediawiki;
|
||||||
|
|
||||||
# "mediawiki"
|
# "mediawiki"
|
||||||
@@ -13,7 +13,7 @@ in {
|
|||||||
owner = user;
|
owner = user;
|
||||||
group = group;
|
group = group;
|
||||||
};
|
};
|
||||||
"keys/postgres/mediawiki" = {
|
"mediawiki/database" = {
|
||||||
restartUnits = [ "mediawiki-init.service" "phpfpm-mediawiki.service" ];
|
restartUnits = [ "mediawiki-init.service" "phpfpm-mediawiki.service" ];
|
||||||
owner = user;
|
owner = user;
|
||||||
group = group;
|
group = group;
|
||||||
@@ -30,7 +30,7 @@ in {
|
|||||||
type = "postgres";
|
type = "postgres";
|
||||||
host = "postgres.pvv.ntnu.no";
|
host = "postgres.pvv.ntnu.no";
|
||||||
port = config.services.postgresql.port;
|
port = config.services.postgresql.port;
|
||||||
passwordFile = config.sops.secrets."keys/postgres/mediawiki".path;
|
passwordFile = config.sops.secrets."mediawiki/database".path;
|
||||||
createLocally = false;
|
createLocally = false;
|
||||||
# TODO: create a normal database and copy over old data when the service is production ready
|
# TODO: create a normal database and copy over old data when the service is production ready
|
||||||
name = "mediawiki_test";
|
name = "mediawiki_test";
|
||||||
@@ -61,35 +61,45 @@ in {
|
|||||||
|
|
||||||
extensions = {
|
extensions = {
|
||||||
DeleteBatch = pkgs.fetchzip {
|
DeleteBatch = pkgs.fetchzip {
|
||||||
url = "https://extdist.wmflabs.org/dist/extensions/DeleteBatch-REL1_39-995ea6f.tar.gz";
|
name = "mediawiki-delete-batch-source";
|
||||||
sha256 = "sha256-0F4GLCy2f5WcWIY2YgF1tVxgYbglR0VOsj/pMrW93b8=";
|
url = "https://extdist.wmflabs.org/dist/extensions/DeleteBatch-REL1_40-4fe36dc.tar.gz";
|
||||||
|
hash = "sha256-jmRkjHFQR9cjPr1eBHVDLHm0xO4OPn9HYiYwrkBT/aA=";
|
||||||
};
|
};
|
||||||
UserMerge = pkgs.fetchzip {
|
UserMerge = pkgs.fetchzip {
|
||||||
url = "https://extdist.wmflabs.org/dist/extensions/UserMerge-REL1_39-b10d50e.tar.gz";
|
name = "mediawiki-user-merge-source";
|
||||||
sha256 = "sha256-bXhj1+OlOUJDbvEuc8iwqb1LLEu6cN6+C/7cAvnWPOQ=";
|
url = "https://extdist.wmflabs.org/dist/extensions/UserMerge-REL1_40-7407806.tar.gz";
|
||||||
|
hash = "sha256-NHAw79pDxjia46J5DIGV9AoF9UazSahT8DZgUUn/pQE=";
|
||||||
};
|
};
|
||||||
PluggableAuth = pkgs.fetchzip {
|
PluggableAuth = pkgs.fetchzip {
|
||||||
url = "https://extdist.wmflabs.org/dist/extensions/PluggableAuth-REL1_39-1210fc3.tar.gz";
|
name = "mediawiki-pluggable-auth-source";
|
||||||
sha256 = "sha256-F6bTMCzkK3kZwZGIsNE87WlZWqXXmTMhEjApO99YKR0=";
|
url = "https://extdist.wmflabs.org/dist/extensions/PluggableAuth-REL1_40-eb10a76.tar.gz";
|
||||||
|
hash = "sha256-GFmtQc0SeBpvI+7iHOVw77JR2h+hwPxo8+wZ9RED8a8=";
|
||||||
};
|
};
|
||||||
SimpleSAMLphp = pkgs.fetchzip {
|
SimpleSAMLphp = pkgs.fetchzip {
|
||||||
url = "https://extdist.wmflabs.org/dist/extensions/SimpleSAMLphp-REL1_39-dcf0acb.tar.gz";
|
name = "mediawiki-simple-saml-php-source";
|
||||||
sha256 = "sha256-tCvFmb2+q2rxms+lRo5pgoI3h6GjCwXAR8XisPg03TQ=";
|
url = "https://extdist.wmflabs.org/dist/extensions/SimpleSAMLphp-REL1_40-8043943.tar.gz";
|
||||||
|
hash = "sha256-HJHcrv/FNqPJegrHo4VPVjw0alkyHwetFZiLwjHsf6Y=";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
extraConfig = let
|
extraConfig = let
|
||||||
|
SimpleSAMLphpRepo = pkgs-unstable.php.buildComposerProject rec {
|
||||||
SimpleSAMLphpRepo = pkgs.stdenvNoCC.mkDerivation rec {
|
|
||||||
pname = "configuredSimpleSAML";
|
pname = "configuredSimpleSAML";
|
||||||
version = "2.0.4";
|
version = "2.1.0-rc1";
|
||||||
src = pkgs.fetchzip {
|
src = pkgs.fetchFromGitHub {
|
||||||
url = "https://github.com/simplesamlphp/simplesamlphp/releases/download/v${version}/simplesamlphp-${version}.tar.gz";
|
owner = "simplesamlphp";
|
||||||
sha256 = "sha256-pfMV/VmqqxgtG7Nx4s8MW4tWSaxOkVPtCRJwxV6RDSE=";
|
repo = "simplesamlphp";
|
||||||
|
# name = "simple-saml-php-source";
|
||||||
|
# url = "https://github.com/simplesamlphp/simplesamlphp/releases/download/v${version}/simplesamlphp-${version}.tar.gz";
|
||||||
|
rev = "v${version}";
|
||||||
|
hash = "sha256-E7S6T/EfuhNbe697OiklZ77wMRkOb/ABJXoL5MphMCY=";
|
||||||
};
|
};
|
||||||
|
|
||||||
buildPhase = ''
|
composerStrictValidation = false;
|
||||||
cat > config/authsources.php << EOF
|
|
||||||
|
vendorHash = "sha256-vr9mWXN9v6tGNvPtxQ+pgf7OYj8dedzWfxt6Xw1nCm0=";
|
||||||
|
|
||||||
|
configAuthsourcesPhp = ''
|
||||||
<?php
|
<?php
|
||||||
$config = array(
|
$config = array(
|
||||||
'default-sp' => array(
|
'default-sp' => array(
|
||||||
@@ -97,11 +107,51 @@ in {
|
|||||||
'idp' => 'https://idp.pvv.ntnu.no/',
|
'idp' => 'https://idp.pvv.ntnu.no/',
|
||||||
),
|
),
|
||||||
);
|
);
|
||||||
EOF
|
'';
|
||||||
'';
|
|
||||||
|
|
||||||
installPhase = ''
|
# TODO: this could be fetched automagically with these:
|
||||||
cp -r . $out
|
# - https://simplesamlphp.org/docs/contrib_modules/metarefresh/simplesamlphp-automated_metadata.html
|
||||||
|
# - https://idp.pvv.ntnu.no/simplesaml/saml2/idp/metadata.php
|
||||||
|
metadataSaml20IdpRemotePhp = ''
|
||||||
|
<?php
|
||||||
|
$metadata['https://idp.pvv.ntnu.no/'] = array (
|
||||||
|
'metadata-set' => 'saml20-idp-remote',
|
||||||
|
'entityid' => 'https://idp.pvv.ntnu.no/',
|
||||||
|
'SingleSignOnService' =>
|
||||||
|
array (
|
||||||
|
0 =>
|
||||||
|
array (
|
||||||
|
'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
|
||||||
|
'Location' => 'https://idp.pvv.ntnu.no/simplesaml/saml2/idp/SSOService.php',
|
||||||
|
),
|
||||||
|
),
|
||||||
|
'SingleLogoutService' =>
|
||||||
|
array (
|
||||||
|
0 =>
|
||||||
|
array (
|
||||||
|
'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
|
||||||
|
'Location' => 'https://idp.pvv.ntnu.no/simplesaml/saml2/idp/SingleLogoutService.php',
|
||||||
|
),
|
||||||
|
),
|
||||||
|
'certData' => 'pvvcert.pem',
|
||||||
|
'NameIDFormat' => 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient',
|
||||||
|
);
|
||||||
|
'';
|
||||||
|
|
||||||
|
pvvcert = ''
|
||||||
|
MIIDpTCCAo2gAwIBAgIJAJIgibrB7NvsMA0GCSqGSIb3DQEBCwUAMGkxCzAJBgNVBAYTAk5PMR4wHAYDVQQKDBVQcm9ncmFtdmFyZXZlcmtzdGVkZXQxGDAWBgNVBAMMD2lkcC5wdnYubnRudS5ubzEgMB4GCSqGSIb3DQEJARYRZHJpZnRAcHZ2Lm50bnUubm8wHhcNMTcxMTEzMjI0NTQyWhcNMjcxMTEzMjI0NTQyWjBpMQswCQYDVQQGEwJOTzEeMBwGA1UECgwVUHJvZ3JhbXZhcmV2ZXJrc3RlZGV0MRgwFgYDVQQDDA9pZHAucHZ2Lm50bnUubm8xIDAeBgkqhkiG9w0BCQEWEWRyaWZ0QHB2di5udG51Lm5vMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAveLujCsgVCRA360y5yezy8FcSPhaqodggDqY12UTkYOMQLBFaph6uUL4oCUlXZqxScrAYVRt9yw+7BYpcm0p51VZzVCsfMxRVkn+O1eUvsaXq3f13f87QHKYP2f0uqkGf5PvnKIdSaI/ix8WJhD8XT+h0OkHEcaBvUtSG7zbEhvG21WPHwgw2rvZSneArQ8tOitZC0u8VXSfdhtf6ynRseo0xC95634UwQAZivhQ2v4A6Tp57QG5DCXIJ9/z3PkINx3KB/hOeh0EP6Dpbp+7V0/t9778E3whpm4llrH144kzROhA7EgUgkZOjAVjxGCYlcj3xQPnnItihVOZ5B5qLwIDAQABo1AwTjAdBgNVHQ4EFgQUPLhrB+Qb/Kzz7Car9GJkKmEkz6swHwYDVR0jBBgwFoAUPLhrB+Qb/Kzz7Car9GJkKmEkz6swDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAd+4E6t0j8/p8rbZE8y/gZ9GsiRhxkR4l6JbMRUfEpqHKi415qstChRcP2Lo3Yd5qdmj9tLDWoPsqet1QgyTTmQTgUmPhhMOQDqSh90LuqEJseKWafXGS/SfWLH6MWVmzDV5YofJEw2ThPiU58GiS06OLS2poq1eAesa2LQ22J8yYisXM4sxImIFte+LYQ1+1evfBWcvU1vrGsQ0VLJHdef9WoXp1swUFhq4Zk0c7gjHiB1CFVlExAAlk9L6W3CVXmKIYlf4eUnEBGkC061Ir42+uhAMWO9Y/L1NEuboTyd2KAI/6JdKdzpmfk7zPVxWlNxNCZ7OPNuvOKp6VlpB2EA==
|
||||||
|
'';
|
||||||
|
|
||||||
|
passAsFile = [
|
||||||
|
"configAuthsourcesPhp"
|
||||||
|
"metadataSaml20IdpRemotePhp"
|
||||||
|
"pvvcert"
|
||||||
|
];
|
||||||
|
|
||||||
|
postPatch = ''
|
||||||
|
install -Dm444 "$configAuthsourcesPhpPath" "config/authsources.php"
|
||||||
|
install -Dm444 "$metadataSaml20IdpRemotePhpPath" "metadata/saml20-idp-remote.php"
|
||||||
|
install -Dm444 "$pvvcertPath" "cert/pvvcert.pem"
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
|
|
||||||
@@ -172,4 +222,23 @@ in {
|
|||||||
|
|
||||||
${pkgs.php}/bin/php ${pkg}/share/mediawiki/maintenance/update.php --conf ${mediawikiConfig} --quick
|
${pkgs.php}/bin/php ${pkg}/share/mediawiki/maintenance/update.php --conf ${mediawikiConfig} --quick
|
||||||
'';
|
'';
|
||||||
|
|
||||||
|
services.nginx.virtualHosts."bekkalokk.pvv.ntnu.no" = {
|
||||||
|
forceSSL = true;
|
||||||
|
enableACME = true;
|
||||||
|
root = "${config.services.mediawiki.finalPackage}/share/mediawiki";
|
||||||
|
locations = {
|
||||||
|
"/" = {
|
||||||
|
extraConfig = ''
|
||||||
|
fastcgi_split_path_info ^(.+\.php)(/.+)$;
|
||||||
|
fastcgi_index index.php;
|
||||||
|
fastcgi_pass unix:${config.services.phpfpm.pools.mediawiki.socket};
|
||||||
|
include ${pkgs.nginx}/conf/fastcgi_params;
|
||||||
|
include ${pkgs.nginx}/conf/fastcgi.conf;
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
"/images".root = config.services.mediawiki.uploadsDir;
|
||||||
|
};
|
||||||
|
};
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -1,9 +1,5 @@
|
|||||||
{ pkgs, config, ... }:
|
{ pkgs, config, ... }:
|
||||||
{
|
{
|
||||||
imports = [
|
|
||||||
./ingress.nix
|
|
||||||
];
|
|
||||||
|
|
||||||
security.acme = {
|
security.acme = {
|
||||||
acceptTerms = true;
|
acceptTerms = true;
|
||||||
defaults.email = "drift@pvv.ntnu.no";
|
defaults.email = "drift@pvv.ntnu.no";
|
||||||
@@ -1,55 +0,0 @@
|
|||||||
{ config, lib, ... }:
|
|
||||||
{
|
|
||||||
services.nginx.virtualHosts = {
|
|
||||||
"www2.pvv.ntnu.no" = {
|
|
||||||
serverAliases = [ "www2.pvv.org" "pvv.ntnu.no" "pvv.org" ];
|
|
||||||
addSSL = true;
|
|
||||||
enableACME = true;
|
|
||||||
|
|
||||||
locations = {
|
|
||||||
# Proxy home directories
|
|
||||||
"/~" = {
|
|
||||||
extraConfig = ''
|
|
||||||
proxy_redirect off;
|
|
||||||
proxy_pass https://tom.pvv.ntnu.no;
|
|
||||||
proxy_set_header Host $host;
|
|
||||||
proxy_set_header X-Real-IP $remote_addr;
|
|
||||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
||||||
proxy_set_header X-Forwarded-Proto $scheme;
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
# Redirect old wiki entries
|
|
||||||
"/disk".return = "301 https://www.pvv.ntnu.no/pvv/Diskkjøp";
|
|
||||||
"/dok/boker.php".return = "301 https://www.pvv.ntnu.no/pvv/Bokhyllen";
|
|
||||||
"/styret/lover/".return = "301 https://www.pvv.ntnu.no/pvv/Lover";
|
|
||||||
"/styret/".return = "301 https://www.pvv.ntnu.no/pvv/Styret";
|
|
||||||
"/info/".return = "301 https://www.pvv.ntnu.no/pvv/";
|
|
||||||
"/info/maskinpark/".return = "301 https://www.pvv.ntnu.no/pvv/Maskiner";
|
|
||||||
"/medlemssider/meldinn.php".return = "301 https://www.pvv.ntnu.no/pvv/Medlemskontingent";
|
|
||||||
"/diverse/medlems-sider.php".return = "301 https://www.pvv.ntnu.no/pvv/Medlemssider";
|
|
||||||
"/cert/".return = "301 https://www.pvv.ntnu.no/pvv/CERT";
|
|
||||||
"/drift".return = "301 https://www.pvv.ntnu.no/pvv/Drift";
|
|
||||||
"/diverse/abuse.php".return = "301 https://www.pvv.ntnu.no/pvv/CERT/Abuse";
|
|
||||||
"/nerds/".return = "301 https://www.pvv.ntnu.no/pvv/Nerdepizza";
|
|
||||||
|
|
||||||
# TODO: Redirect webmail
|
|
||||||
"/webmail".return = "301 https://webmail.pvv.ntnu.no/squirrelmail";
|
|
||||||
|
|
||||||
# Redirect everything else to the main website
|
|
||||||
"/".return = "301 https://www.pvv.ntnu.no$request_uri";
|
|
||||||
|
|
||||||
# Proxy the matrix well-known files
|
|
||||||
# Host has be set before proxy_pass
|
|
||||||
# The header must be set so nginx on the other side routes it to the right place
|
|
||||||
"/.well-known/matrix/" = {
|
|
||||||
extraConfig = ''
|
|
||||||
proxy_set_header Host matrix.pvv.ntnu.no;
|
|
||||||
proxy_pass https://matrix.pvv.ntnu.no/.well-known/matrix/;
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
||||||
@@ -12,8 +12,7 @@
|
|||||||
./services/mysql.nix
|
./services/mysql.nix
|
||||||
./services/postgres.nix
|
./services/postgres.nix
|
||||||
./services/mysql.nix
|
./services/mysql.nix
|
||||||
# TODO: fix the calendar bot
|
./services/calendar-bot.nix
|
||||||
# ./services/calendar-bot.nix
|
|
||||||
|
|
||||||
./services/matrix
|
./services/matrix
|
||||||
];
|
];
|
||||||
|
|||||||
@@ -1,44 +0,0 @@
|
|||||||
{ config, pkgs, values, ... }:
|
|
||||||
{
|
|
||||||
networking.nat = {
|
|
||||||
enable = true;
|
|
||||||
internalInterfaces = ["ve-+"];
|
|
||||||
externalInterface = "ens3";
|
|
||||||
# Lazy IPv6 connectivity for the container
|
|
||||||
enableIPv6 = true;
|
|
||||||
};
|
|
||||||
|
|
||||||
containers.bikkje = {
|
|
||||||
autoStart = true;
|
|
||||||
config = { config, pkgs, ... }: {
|
|
||||||
#import packages
|
|
||||||
packages = with pkgs; [
|
|
||||||
alpine
|
|
||||||
mutt
|
|
||||||
mutt-ics
|
|
||||||
mutt-wizard
|
|
||||||
weechat
|
|
||||||
weechatScripts.edit
|
|
||||||
hexchat
|
|
||||||
irssi
|
|
||||||
pidgin
|
|
||||||
];
|
|
||||||
|
|
||||||
networking = {
|
|
||||||
firewall = {
|
|
||||||
enable = true;
|
|
||||||
# Allow SSH and HTTP and ports for email and irc
|
|
||||||
allowedTCPPorts = [ 80 22 194 994 6665 6666 6667 6668 6669 6697 995 993 25 465 587 110 143 993 995 ];
|
|
||||||
allowedUDPPorts = [ 80 22 194 994 6665 6666 6667 6668 6669 6697 995 993 25 465 587 110 143 993 995 ];
|
|
||||||
};
|
|
||||||
# Use systemd-resolved inside the container
|
|
||||||
# Workaround for bug https://github.com/NixOS/nixpkgs/issues/162686
|
|
||||||
useHostResolvConf = mkForce false;
|
|
||||||
};
|
|
||||||
|
|
||||||
system.stateVersion = "23.11";
|
|
||||||
services.resolved.enable = true;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
};
|
|
||||||
@@ -1,18 +1,19 @@
|
|||||||
{ config, pkgs, values, ... }:
|
{ config, pkgs, values, ... }:
|
||||||
{
|
{
|
||||||
imports = [
|
imports = [
|
||||||
./hardware-configuration.nix
|
# Include the results of the hardware scan.
|
||||||
../../base.nix
|
./hardware-configuration.nix
|
||||||
../../misc/metrics-exporters.nix
|
../../base.nix
|
||||||
|
../../misc/metrics-exporters.nix
|
||||||
|
|
||||||
./containers/salsa/configuration.nix
|
./services/openvpn-client.nix
|
||||||
];
|
];
|
||||||
|
|
||||||
# buskerud does not support efi?
|
# buskerud does not support efi?
|
||||||
# boot.loader.systemd-boot.enable = true;
|
# boot.loader.systemd-boot.enable = true;
|
||||||
# boot.loader.efi.canTouchEfiVariables = true;
|
# boot.loader.efi.canTouchEfiVariables = true;
|
||||||
boot.loader.grub.enable = true;
|
boot.loader.grub.enable = true;
|
||||||
boot.loader.grub.device = "/dev/sdb";
|
boot.loader.grub.device = "/dev/sda";
|
||||||
|
|
||||||
networking.hostName = "buskerud";
|
networking.hostName = "buskerud";
|
||||||
networking.search = [ "pvv.ntnu.no" "pvv.org" ];
|
networking.search = [ "pvv.ntnu.no" "pvv.org" ];
|
||||||
@@ -24,10 +25,20 @@
|
|||||||
address = with values.hosts.buskerud; [ (ipv4 + "/25") (ipv6 + "/64") ];
|
address = with values.hosts.buskerud; [ (ipv4 + "/25") (ipv6 + "/64") ];
|
||||||
};
|
};
|
||||||
|
|
||||||
|
# Buskerud should use the default gateway received from DHCP
|
||||||
|
networking.interfaces.enp14s0f1.useDHCP = true;
|
||||||
|
|
||||||
|
# networking.interfaces.tun = {
|
||||||
|
# virtual = true;
|
||||||
|
# ipv4.adresses = [ {address="129.241.210.252"; prefixLength=25; } ];
|
||||||
|
# };
|
||||||
|
|
||||||
# List packages installed in system profile
|
# List packages installed in system profile
|
||||||
environment.systemPackages = with pkgs; [
|
environment.systemPackages = with pkgs; [
|
||||||
];
|
];
|
||||||
|
|
||||||
|
# List services that you want to enable:
|
||||||
|
|
||||||
# This value determines the NixOS release from which the default
|
# This value determines the NixOS release from which the default
|
||||||
# settings for stateful data, like file locations and database versions
|
# settings for stateful data, like file locations and database versions
|
||||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||||
@@ -35,4 +46,5 @@
|
|||||||
# Before changing this value read the documentation for this option
|
# Before changing this value read the documentation for this option
|
||||||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||||
system.stateVersion = "23.05"; # Did you read the comment?
|
system.stateVersion = "23.05"; # Did you read the comment?
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -1,27 +0,0 @@
|
|||||||
# Misc docs
|
|
||||||
|
|
||||||
### Old stuff about storing kerberos state inside LDAP - might not be relevant
|
|
||||||
|
|
||||||
- https://wiki.debian.org/LDAP/OpenLDAPSetup#OpenLDAP_as_a_Backend
|
|
||||||
- https://ubuntu.com/server/docs/service-kerberos-with-openldap-backend
|
|
||||||
- https://forums.freebsd.org/threads/heimdal-and-openldap-integration-some-questions.58422/
|
|
||||||
- http://osr507doc.sco.com/cgi-bin/info2html?(heimdal.info.gz)Using%2520LDAP%2520to%2520store%2520the%2520database&lang=en
|
|
||||||
- https://bbs.archlinux.org/viewtopic.php?id=54236
|
|
||||||
- https://openldap-software.0penldap.narkive.com/Ml6seAGL/ldap-backend-for-heimdal-kerberos
|
|
||||||
|
|
||||||
### Heimdal setup
|
|
||||||
|
|
||||||
- http://chschneider.eu/linux/server/heimdal.shtml
|
|
||||||
- https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/kerberos/heimdal.nix
|
|
||||||
- https://itk.samfundet.no/dok/Kerberos (possibly a bit dated)
|
|
||||||
|
|
||||||
### OpenLDAP setup with new olc stuff
|
|
||||||
|
|
||||||
- https://www.openldap.org/doc/admin26/
|
|
||||||
- https://www.openldap.org/doc/admin26/sasl.html#GSSAPI
|
|
||||||
- https://www.zytrax.com/books/ldap/
|
|
||||||
|
|
||||||
### SASLAUTHD
|
|
||||||
|
|
||||||
- https://linux.die.net/man/8/saslauthd
|
|
||||||
- https://www.cyrusimap.org/sasl/index.html
|
|
||||||
@@ -1,51 +0,0 @@
|
|||||||
{ config, pkgs, lib, inputs, values, ... }:
|
|
||||||
{
|
|
||||||
containers.salsa = {
|
|
||||||
autoStart = true;
|
|
||||||
interfaces = [ "enp6s0f1" ];
|
|
||||||
bindMounts = {
|
|
||||||
"/data" = { hostPath = "/data/salsa"; isReadOnly = false; };
|
|
||||||
};
|
|
||||||
nixpkgs = inputs.nixpkgs-unstable;
|
|
||||||
|
|
||||||
config = { config, pkgs, ... }: let
|
|
||||||
inherit values inputs;
|
|
||||||
in {
|
|
||||||
imports = [
|
|
||||||
inputs.sops-nix.nixosModules.sops
|
|
||||||
../../../../base.nix
|
|
||||||
|
|
||||||
./services/heimdal
|
|
||||||
./services/openldap.nix
|
|
||||||
./services/saslauthd.nix
|
|
||||||
|
|
||||||
# https://github.com/NixOS/nixpkgs/pull/287611
|
|
||||||
./modules/krb5
|
|
||||||
./modules/kerberos
|
|
||||||
];
|
|
||||||
|
|
||||||
disabledModules = [
|
|
||||||
"security/krb5"
|
|
||||||
"services/system/kerberos/default.nix"
|
|
||||||
];
|
|
||||||
|
|
||||||
_module.args = {
|
|
||||||
inherit values inputs;
|
|
||||||
};
|
|
||||||
|
|
||||||
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
|
||||||
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
|
||||||
sops.age.generateKey = true;
|
|
||||||
|
|
||||||
# systemd.network.networks."30-enp6s0f1" = values.defaultNetworkConfig // {
|
|
||||||
# matchConfig.Name = "enp6s0f1";
|
|
||||||
# address = with values.hosts.jokum; [ (ipv4 + "/25") (ipv6 + "/64") ]
|
|
||||||
# ++ (with values.services.turn; [ (ipv4 + "/25") (ipv6 + "/64") ]);
|
|
||||||
# };
|
|
||||||
|
|
||||||
networking.useHostResolvConf = lib.mkForce false;
|
|
||||||
|
|
||||||
system.stateVersion = "23.11";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
@@ -1,101 +0,0 @@
|
|||||||
{ config, pkgs, lib, ... }:
|
|
||||||
|
|
||||||
let
|
|
||||||
inherit (lib) mkOption types;
|
|
||||||
cfg = config.services.kerberos_server;
|
|
||||||
inherit (config.security.krb5) package;
|
|
||||||
|
|
||||||
format = import ../krb5/krb5-conf-format.nix { inherit pkgs lib; } { };
|
|
||||||
in
|
|
||||||
|
|
||||||
{
|
|
||||||
imports = [
|
|
||||||
(lib.mkRenamedOptionModule [ "services" "kerberos_server" "realms" ] [ "services" "kerberos_server" "settings" "realms" ])
|
|
||||||
|
|
||||||
./mit.nix
|
|
||||||
./heimdal.nix
|
|
||||||
];
|
|
||||||
|
|
||||||
options = {
|
|
||||||
services.kerberos_server = {
|
|
||||||
enable = lib.mkEnableOption (lib.mdDoc "the kerberos authentication server");
|
|
||||||
|
|
||||||
settings = let
|
|
||||||
aclEntry = types.submodule {
|
|
||||||
options = {
|
|
||||||
principal = mkOption {
|
|
||||||
type = types.str;
|
|
||||||
description = lib.mdDoc "Which principal the rule applies to";
|
|
||||||
};
|
|
||||||
access = mkOption {
|
|
||||||
type = types.either
|
|
||||||
(types.listOf (types.enum ["add" "cpw" "delete" "get" "list" "modify"]))
|
|
||||||
(types.enum ["all"]);
|
|
||||||
default = "all";
|
|
||||||
description = lib.mdDoc "The changes the principal is allowed to make.";
|
|
||||||
};
|
|
||||||
target = mkOption {
|
|
||||||
type = types.str;
|
|
||||||
default = "*";
|
|
||||||
description = lib.mdDoc "The principals that 'access' applies to.";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
realm = types.submodule ({ name, ... }: {
|
|
||||||
freeformType = format.sectionType;
|
|
||||||
options = {
|
|
||||||
acl = mkOption {
|
|
||||||
type = types.listOf aclEntry;
|
|
||||||
default = [
|
|
||||||
{ principal = "*/admin"; access = "all"; }
|
|
||||||
{ principal = "admin"; access = "all"; }
|
|
||||||
];
|
|
||||||
description = lib.mdDoc ''
|
|
||||||
The privileges granted to a user.
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
};
|
|
||||||
});
|
|
||||||
in mkOption {
|
|
||||||
type = types.submodule (format.type.getSubModules ++ [{
|
|
||||||
options = {
|
|
||||||
realms = mkOption {
|
|
||||||
type = types.attrsOf realm;
|
|
||||||
description = lib.mdDoc ''
|
|
||||||
The realm(s) to serve keys for.
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}]);
|
|
||||||
description = ''
|
|
||||||
Settings for the kerberos server of choice.
|
|
||||||
|
|
||||||
See the following documentation:
|
|
||||||
- Heimdal: {manpage}`kdc.conf(5)`
|
|
||||||
- MIT Kerberos: <https://web.mit.edu/kerberos/krb5-1.21/doc/admin/conf_files/kdc_conf.html>
|
|
||||||
'';
|
|
||||||
default = { };
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
config = lib.mkIf cfg.enable {
|
|
||||||
environment.systemPackages = [ package ];
|
|
||||||
assertions = [
|
|
||||||
{
|
|
||||||
assertion = cfg.settings.realms != { };
|
|
||||||
message = "The server needs at least one realm";
|
|
||||||
}
|
|
||||||
{
|
|
||||||
assertion = lib.length (lib.attrNames cfg.settings.realms) <= 1;
|
|
||||||
message = "Only one realm per server is currently supported.";
|
|
||||||
}
|
|
||||||
];
|
|
||||||
|
|
||||||
systemd.slices.system-kerberos-server = { };
|
|
||||||
systemd.targets.kerberos-server = {
|
|
||||||
wantedBy = [ "multi-user.target" ];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
@@ -1,87 +0,0 @@
|
|||||||
{ pkgs, config, lib, ... } :
|
|
||||||
|
|
||||||
let
|
|
||||||
inherit (lib) mapAttrs;
|
|
||||||
cfg = config.services.kerberos_server;
|
|
||||||
package = config.security.krb5.package;
|
|
||||||
|
|
||||||
aclConfigs = lib.pipe cfg.settings.realms [
|
|
||||||
(mapAttrs (name: { acl, ... }: lib.concatMapStringsSep "\n" (
|
|
||||||
{ principal, access, target, ... }:
|
|
||||||
"${principal}\t${lib.concatStringsSep "," (lib.toList access)}\t${target}"
|
|
||||||
) acl))
|
|
||||||
(lib.mapAttrsToList (name: text:
|
|
||||||
{
|
|
||||||
dbname = "/var/lib/heimdal/heimdal";
|
|
||||||
acl_file = pkgs.writeText "${name}.acl" text;
|
|
||||||
}
|
|
||||||
))
|
|
||||||
];
|
|
||||||
|
|
||||||
finalConfig = cfg.settings // {
|
|
||||||
realms = mapAttrs (_: v: removeAttrs v [ "acl" ]) (cfg.settings.realms or { });
|
|
||||||
kdc = (cfg.settings.kdc or { }) // {
|
|
||||||
database = aclConfigs;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
format = import ../krb5/krb5-conf-format.nix { inherit pkgs lib; } { };
|
|
||||||
|
|
||||||
kdcConfFile = format.generate "kdc.conf" finalConfig;
|
|
||||||
in
|
|
||||||
|
|
||||||
{
|
|
||||||
config = lib.mkIf (cfg.enable && package.passthru.implementation == "heimdal") {
|
|
||||||
environment.etc."heimdal-kdc/kdc.conf".source = kdcConfFile;
|
|
||||||
|
|
||||||
systemd.tmpfiles.settings."10-heimdal" = let
|
|
||||||
databases = lib.pipe finalConfig.kdc.database [
|
|
||||||
(map (dbAttrs: dbAttrs.dbname or null))
|
|
||||||
(lib.filter (x: x != null))
|
|
||||||
lib.unique
|
|
||||||
];
|
|
||||||
in lib.genAttrs databases (_: {
|
|
||||||
d = {
|
|
||||||
user = "root";
|
|
||||||
group = "root";
|
|
||||||
mode = "0700";
|
|
||||||
};
|
|
||||||
});
|
|
||||||
|
|
||||||
systemd.services.kadmind = {
|
|
||||||
description = "Kerberos Administration Daemon";
|
|
||||||
partOf = [ "kerberos-server.target" ];
|
|
||||||
wantedBy = [ "kerberos-server.target" ];
|
|
||||||
serviceConfig = {
|
|
||||||
ExecStart = "${package}/libexec/kadmind --config-file=/etc/heimdal-kdc/kdc.conf";
|
|
||||||
Slice = "system-kerberos-server.slice";
|
|
||||||
StateDirectory = "heimdal";
|
|
||||||
};
|
|
||||||
restartTriggers = [ kdcConfFile ];
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.services.kdc = {
|
|
||||||
description = "Key Distribution Center daemon";
|
|
||||||
partOf = [ "kerberos-server.target" ];
|
|
||||||
wantedBy = [ "kerberos-server.target" ];
|
|
||||||
serviceConfig = {
|
|
||||||
ExecStart = "${package}/libexec/kdc --config-file=/etc/heimdal-kdc/kdc.conf";
|
|
||||||
Slice = "system-kerberos-server.slice";
|
|
||||||
StateDirectory = "heimdal";
|
|
||||||
};
|
|
||||||
restartTriggers = [ kdcConfFile ];
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.services.kpasswdd = {
|
|
||||||
description = "Kerberos Password Changing daemon";
|
|
||||||
partOf = [ "kerberos-server.target" ];
|
|
||||||
wantedBy = [ "kerberos-server.target" ];
|
|
||||||
serviceConfig = {
|
|
||||||
ExecStart = "${package}/libexec/kpasswdd";
|
|
||||||
Slice = "system-kerberos-server.slice";
|
|
||||||
StateDirectory = "heimdal";
|
|
||||||
};
|
|
||||||
restartTriggers = [ kdcConfFile ];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
@@ -1,77 +0,0 @@
|
|||||||
{ pkgs, config, lib, ... } :
|
|
||||||
|
|
||||||
let
|
|
||||||
inherit (lib) mapAttrs;
|
|
||||||
cfg = config.services.kerberos_server;
|
|
||||||
package = config.security.krb5.package;
|
|
||||||
PIDFile = "/run/kdc.pid";
|
|
||||||
|
|
||||||
format = import ../krb5/krb5-conf-format.nix { inherit pkgs lib; } { };
|
|
||||||
|
|
||||||
aclMap = {
|
|
||||||
add = "a"; cpw = "c"; delete = "d"; get = "i"; list = "l"; modify = "m";
|
|
||||||
all = "*";
|
|
||||||
};
|
|
||||||
|
|
||||||
aclConfigs = lib.pipe cfg.settings.realms [
|
|
||||||
(mapAttrs (name: { acl, ... }: lib.concatMapStringsSep "\n" (
|
|
||||||
{ principal, access, target, ... }: let
|
|
||||||
access_code = map (a: aclMap.${a}) (lib.toList access);
|
|
||||||
in "${principal} ${lib.concatStrings access_code} ${target}"
|
|
||||||
) acl))
|
|
||||||
|
|
||||||
(lib.concatMapAttrs (name: text: {
|
|
||||||
${name} = {
|
|
||||||
acl_file = pkgs.writeText "${name}.acl" text;
|
|
||||||
};
|
|
||||||
}))
|
|
||||||
];
|
|
||||||
|
|
||||||
finalConfig = cfg.settings // {
|
|
||||||
realms = mapAttrs (n: v: (removeAttrs v [ "acl" ]) // aclConfigs.${n}) (cfg.settings.realms or { });
|
|
||||||
};
|
|
||||||
|
|
||||||
kdcConfFile = format.generate "kdc.conf" finalConfig;
|
|
||||||
env = {
|
|
||||||
# What Debian uses, could possibly link directly to Nix store?
|
|
||||||
KRB5_KDC_PROFILE = "/etc/krb5kdc/kdc.conf";
|
|
||||||
};
|
|
||||||
in
|
|
||||||
|
|
||||||
{
|
|
||||||
config = lib.mkIf (cfg.enable && package.passthru.implementation == "krb5") {
|
|
||||||
environment = {
|
|
||||||
etc."krb5kdc/kdc.conf".source = kdcConfFile;
|
|
||||||
variables = env;
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.services.kadmind = {
|
|
||||||
description = "Kerberos Administration Daemon";
|
|
||||||
partOf = [ "kerberos-server.target" ];
|
|
||||||
wantedBy = [ "kerberos-server.target" ];
|
|
||||||
serviceConfig = {
|
|
||||||
ExecStart = "${package}/bin/kadmind -nofork";
|
|
||||||
Slice = "system-kerberos-server.slice";
|
|
||||||
StateDirectory = "krb5kdc";
|
|
||||||
};
|
|
||||||
restartTriggers = [ kdcConfFile ];
|
|
||||||
environment = env;
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.services.kdc = {
|
|
||||||
description = "Key Distribution Center daemon";
|
|
||||||
partOf = [ "kerberos-server.target" ];
|
|
||||||
wantedBy = [ "kerberos-server.target" ];
|
|
||||||
serviceConfig = {
|
|
||||||
Type = "forking";
|
|
||||||
PIDFile = PIDFile;
|
|
||||||
ExecStart = "${package}/bin/krb5kdc -P ${PIDFile}";
|
|
||||||
Slice = "system-kerberos-server.slice";
|
|
||||||
StateDirectory = "krb5kdc";
|
|
||||||
};
|
|
||||||
restartTriggers = [ kdcConfFile ];
|
|
||||||
environment = env;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
||||||
@@ -1,104 +0,0 @@
|
|||||||
{ config, lib, pkgs, ... }:
|
|
||||||
let
|
|
||||||
inherit (lib) mdDoc mkIf mkOption mkPackageOption mkRemovedOptionModule;
|
|
||||||
inherit (lib.types) bool;
|
|
||||||
|
|
||||||
mkRemovedOptionModule' = name: reason: mkRemovedOptionModule ["krb5" name] reason;
|
|
||||||
mkRemovedOptionModuleCfg = name: mkRemovedOptionModule' name ''
|
|
||||||
The option `krb5.${name}' has been removed. Use
|
|
||||||
`security.krb5.settings.${name}' for structured configuration.
|
|
||||||
'';
|
|
||||||
|
|
||||||
cfg = config.security.krb5;
|
|
||||||
format = import ./krb5-conf-format.nix { inherit pkgs lib; } { };
|
|
||||||
in {
|
|
||||||
imports = [
|
|
||||||
(mkRemovedOptionModuleCfg "libdefaults")
|
|
||||||
(mkRemovedOptionModuleCfg "realms")
|
|
||||||
(mkRemovedOptionModuleCfg "domain_realm")
|
|
||||||
(mkRemovedOptionModuleCfg "capaths")
|
|
||||||
(mkRemovedOptionModuleCfg "appdefaults")
|
|
||||||
(mkRemovedOptionModuleCfg "plugins")
|
|
||||||
(mkRemovedOptionModuleCfg "config")
|
|
||||||
(mkRemovedOptionModuleCfg "extraConfig")
|
|
||||||
(mkRemovedOptionModule' "kerberos" ''
|
|
||||||
The option `krb5.kerberos' has been moved to `security.krb5.package'.
|
|
||||||
'')
|
|
||||||
];
|
|
||||||
|
|
||||||
options = {
|
|
||||||
security.krb5 = {
|
|
||||||
enable = mkOption {
|
|
||||||
default = false;
|
|
||||||
description = mdDoc "Enable and configure Kerberos utilities";
|
|
||||||
type = bool;
|
|
||||||
};
|
|
||||||
|
|
||||||
package = mkPackageOption pkgs "krb5" {
|
|
||||||
example = "heimdal";
|
|
||||||
};
|
|
||||||
|
|
||||||
settings = mkOption {
|
|
||||||
default = { };
|
|
||||||
type = format.type;
|
|
||||||
description = mdDoc ''
|
|
||||||
Structured contents of the {file}`krb5.conf` file. See
|
|
||||||
{manpage}`krb5.conf(5)` for details about configuration.
|
|
||||||
'';
|
|
||||||
example = {
|
|
||||||
include = [ "/run/secrets/secret-krb5.conf" ];
|
|
||||||
includedir = [ "/run/secrets/secret-krb5.conf.d" ];
|
|
||||||
|
|
||||||
libdefaults = {
|
|
||||||
default_realm = "ATHENA.MIT.EDU";
|
|
||||||
};
|
|
||||||
|
|
||||||
realms = {
|
|
||||||
"ATHENA.MIT.EDU" = {
|
|
||||||
admin_server = "athena.mit.edu";
|
|
||||||
kdc = [
|
|
||||||
"athena01.mit.edu"
|
|
||||||
"athena02.mit.edu"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
domain_realm = {
|
|
||||||
"mit.edu" = "ATHENA.MIT.EDU";
|
|
||||||
};
|
|
||||||
|
|
||||||
logging = {
|
|
||||||
kdc = "SYSLOG:NOTICE";
|
|
||||||
admin_server = "SYSLOG:NOTICE";
|
|
||||||
default = "SYSLOG:NOTICE";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
config = {
|
|
||||||
assertions = mkIf (cfg.enable || config.services.kerberos_server.enable) [(let
|
|
||||||
implementation = cfg.package.passthru.implementation or "<NOT SET>";
|
|
||||||
in {
|
|
||||||
assertion = lib.elem implementation [ "krb5" "heimdal" ];
|
|
||||||
message = ''
|
|
||||||
`security.krb5.package` must be one of:
|
|
||||||
|
|
||||||
- krb5
|
|
||||||
- heimdal
|
|
||||||
|
|
||||||
Currently chosen implementation: ${implementation}
|
|
||||||
'';
|
|
||||||
})];
|
|
||||||
|
|
||||||
environment = mkIf cfg.enable {
|
|
||||||
systemPackages = [ cfg.package ];
|
|
||||||
etc."krb5.conf".source = format.generate "krb5.conf" cfg.settings;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
meta.maintainers = builtins.attrValues {
|
|
||||||
inherit (lib.maintainers) dblsaiko h7x4;
|
|
||||||
};
|
|
||||||
}
|
|
||||||
@@ -1,96 +0,0 @@
|
|||||||
{ pkgs, lib, ... }:
|
|
||||||
|
|
||||||
# Based on
|
|
||||||
# - https://web.mit.edu/kerberos/krb5-1.12/doc/admin/conf_files/krb5_conf.html
|
|
||||||
# - https://manpages.debian.org/unstable/heimdal-docs/krb5.conf.5heimdal.en.html
|
|
||||||
|
|
||||||
let
|
|
||||||
inherit (lib) boolToString concatMapStringsSep concatStringsSep filter
|
|
||||||
isAttrs isBool isList mapAttrsToList mdDoc mkOption singleton splitString;
|
|
||||||
inherit (lib.types) attrsOf bool coercedTo either int listOf oneOf path
|
|
||||||
str submodule;
|
|
||||||
in
|
|
||||||
{ }: rec {
|
|
||||||
sectionType = let
|
|
||||||
relation = oneOf [
|
|
||||||
(listOf (attrsOf value))
|
|
||||||
(attrsOf value)
|
|
||||||
value
|
|
||||||
];
|
|
||||||
value = either (listOf atom) atom;
|
|
||||||
atom = oneOf [int str bool];
|
|
||||||
in attrsOf relation;
|
|
||||||
|
|
||||||
type = submodule {
|
|
||||||
freeformType = attrsOf sectionType;
|
|
||||||
options = {
|
|
||||||
include = mkOption {
|
|
||||||
default = [ ];
|
|
||||||
description = mdDoc ''
|
|
||||||
Files to include in the Kerberos configuration.
|
|
||||||
'';
|
|
||||||
type = coercedTo path singleton (listOf path);
|
|
||||||
};
|
|
||||||
includedir = mkOption {
|
|
||||||
default = [ ];
|
|
||||||
description = mdDoc ''
|
|
||||||
Directories containing files to include in the Kerberos configuration.
|
|
||||||
'';
|
|
||||||
type = coercedTo path singleton (listOf path);
|
|
||||||
};
|
|
||||||
module = mkOption {
|
|
||||||
default = [ ];
|
|
||||||
description = mdDoc ''
|
|
||||||
Modules to obtain Kerberos configuration from.
|
|
||||||
'';
|
|
||||||
type = coercedTo path singleton (listOf path);
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
generate = let
|
|
||||||
indent = str: concatMapStringsSep "\n" (line: " " + line) (splitString "\n" str);
|
|
||||||
|
|
||||||
formatToplevel = args @ {
|
|
||||||
include ? [ ],
|
|
||||||
includedir ? [ ],
|
|
||||||
module ? [ ],
|
|
||||||
...
|
|
||||||
}: let
|
|
||||||
sections = removeAttrs args [ "include" "includedir" "module" ];
|
|
||||||
in concatStringsSep "\n" (filter (x: x != "") [
|
|
||||||
(concatStringsSep "\n" (mapAttrsToList formatSection sections))
|
|
||||||
(concatMapStringsSep "\n" (m: "module ${m}") module)
|
|
||||||
(concatMapStringsSep "\n" (i: "include ${i}") include)
|
|
||||||
(concatMapStringsSep "\n" (i: "includedir ${i}") includedir)
|
|
||||||
]);
|
|
||||||
|
|
||||||
formatSection = name: section: ''
|
|
||||||
[${name}]
|
|
||||||
${indent (concatStringsSep "\n" (mapAttrsToList formatRelation section))}
|
|
||||||
'';
|
|
||||||
|
|
||||||
formatRelation = name: relation:
|
|
||||||
if isAttrs relation
|
|
||||||
then ''
|
|
||||||
${name} = {
|
|
||||||
${indent (concatStringsSep "\n" (mapAttrsToList formatValue relation))}
|
|
||||||
}''
|
|
||||||
else if isList relation
|
|
||||||
then
|
|
||||||
concatMapStringsSep "\n" (formatRelation name) relation
|
|
||||||
else formatValue name relation;
|
|
||||||
|
|
||||||
formatValue = name: value:
|
|
||||||
if isList value
|
|
||||||
then concatMapStringsSep "\n" (formatAtom name) value
|
|
||||||
else formatAtom name value;
|
|
||||||
|
|
||||||
formatAtom = name: atom: let
|
|
||||||
v = if isBool atom then boolToString atom else toString atom;
|
|
||||||
in "${name} = ${v}";
|
|
||||||
in
|
|
||||||
name: value: pkgs.writeText name ''
|
|
||||||
${formatToplevel value}
|
|
||||||
'';
|
|
||||||
}
|
|
||||||
@@ -1,78 +0,0 @@
|
|||||||
{ config, pkgs, lib, ... }:
|
|
||||||
let
|
|
||||||
|
|
||||||
realm = "PVV.NTNU.NO";
|
|
||||||
|
|
||||||
cfg = config.security.krb5;
|
|
||||||
in
|
|
||||||
{
|
|
||||||
security.krb5 = {
|
|
||||||
enable = true;
|
|
||||||
|
|
||||||
# NOTE: This has a small edit that moves an include header to $dev/include.
|
|
||||||
# It is required in order to build smbk5pwd, because of some nested includes.
|
|
||||||
# We should open an issue upstream (heimdal, not nixpkgs), but this patch
|
|
||||||
# will do for now.
|
|
||||||
# package = pkgs.heimdal;
|
|
||||||
package = pkgs.callPackage ./package.nix {
|
|
||||||
inherit (pkgs.apple_sdk.frameworks)
|
|
||||||
CoreFoundation Security SystemConfiguration;
|
|
||||||
};
|
|
||||||
|
|
||||||
settings = {
|
|
||||||
logging.kdc = "CONSOLE";
|
|
||||||
realms.${realm} = {
|
|
||||||
admin_server = "localhost";
|
|
||||||
kdc = [ "localhost" ];
|
|
||||||
};
|
|
||||||
|
|
||||||
kadmin.default_keys = lib.concatStringsSep " " [
|
|
||||||
"aes256-cts-hmac-sha1-96:pw-salt"
|
|
||||||
"aes128-cts-hmac-sha1-96:pw-salt"
|
|
||||||
];
|
|
||||||
|
|
||||||
libdefaults.default_etypes = lib.concatStringsSep " " [
|
|
||||||
"aes256-cts-hmac-sha1-96"
|
|
||||||
"aes128-cts-hmac-sha1-96"
|
|
||||||
];
|
|
||||||
|
|
||||||
libdefaults = {
|
|
||||||
default_realm = realm;
|
|
||||||
};
|
|
||||||
|
|
||||||
domain_realm = {
|
|
||||||
"pvv.ntnu.no" = realm;
|
|
||||||
".pvv.ntnu.no" = realm;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
services.kerberos_server = {
|
|
||||||
enable = true;
|
|
||||||
settings = {
|
|
||||||
realms.${realm} = {
|
|
||||||
dbname = "/var/heimdal/heimdal";
|
|
||||||
mkey = "/var/heimdal/mkey";
|
|
||||||
};
|
|
||||||
# kadmin.default_keys = lib.concatStringsSep " " [
|
|
||||||
# "aes256-cts-hmac-sha1-96:pw-salt"
|
|
||||||
# "aes128-cts-hmac-sha1-96:pw-salt"
|
|
||||||
# ];
|
|
||||||
|
|
||||||
# libdefaults.default_etypes = lib.concatStringsSep " " [
|
|
||||||
# "aes256-cts-hmac-sha1-96"
|
|
||||||
# "aes128-cts-hmac-sha1-96"
|
|
||||||
# ];
|
|
||||||
|
|
||||||
# password_quality.min_length = 8;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
# NOTE: These changes are part of nixpkgs-unstable, but not 23.11.
|
|
||||||
# The package override needs these changes.
|
|
||||||
# systemd.services = {
|
|
||||||
# kdc.serviceConfig.ExecStart = lib.mkForce "${cfg.package}/libexec/kadmind --config-file=/etc/heimdal-kdc/kdc.conf";
|
|
||||||
# kpasswdd.serviceConfig.ExecStart = lib.mkForce "${cfg.package}/libexec/kpasswdd";
|
|
||||||
# kadmind.serviceConfig.ExecStart = lib.mkForce "${cfg.package}/libexec/kdc --config-file=/etc/heimdal-kdc/kdc.conf";
|
|
||||||
# };
|
|
||||||
}
|
|
||||||
@@ -1,180 +0,0 @@
|
|||||||
{ lib
|
|
||||||
, stdenv
|
|
||||||
, fetchFromGitHub
|
|
||||||
, autoreconfHook
|
|
||||||
, pkg-config
|
|
||||||
, python3
|
|
||||||
, perl
|
|
||||||
, bison
|
|
||||||
, flex
|
|
||||||
, texinfo
|
|
||||||
, perlPackages
|
|
||||||
|
|
||||||
, openldap
|
|
||||||
, libcap_ng
|
|
||||||
, sqlite
|
|
||||||
, openssl
|
|
||||||
, db
|
|
||||||
, libedit
|
|
||||||
, pam
|
|
||||||
, krb5
|
|
||||||
, libmicrohttpd
|
|
||||||
, cjson
|
|
||||||
|
|
||||||
, CoreFoundation
|
|
||||||
, Security
|
|
||||||
, SystemConfiguration
|
|
||||||
|
|
||||||
, curl
|
|
||||||
, jdk
|
|
||||||
, unzip
|
|
||||||
, which
|
|
||||||
|
|
||||||
, nixosTests
|
|
||||||
|
|
||||||
, withCJSON ? true
|
|
||||||
, withCapNG ? stdenv.isLinux
|
|
||||||
# libmicrohttpd should theoretically work for darwin as well, but something is broken.
|
|
||||||
# It affects tests check-bx509d and check-httpkadmind.
|
|
||||||
, withMicroHTTPD ? stdenv.isLinux
|
|
||||||
, withOpenLDAP ? true
|
|
||||||
, withOpenLDAPAsHDBModule ? false
|
|
||||||
, withOpenSSL ? true
|
|
||||||
, withSQLite3 ? true
|
|
||||||
}:
|
|
||||||
|
|
||||||
assert lib.assertMsg (withOpenLDAPAsHDBModule -> withOpenLDAP) ''
|
|
||||||
OpenLDAP needs to be enabled in order to build the OpenLDAP HDB Module.
|
|
||||||
'';
|
|
||||||
|
|
||||||
stdenv.mkDerivation {
|
|
||||||
pname = "heimdal";
|
|
||||||
version = "7.8.0-unstable-2023-11-29";
|
|
||||||
|
|
||||||
src = fetchFromGitHub {
|
|
||||||
owner = "heimdal";
|
|
||||||
repo = "heimdal";
|
|
||||||
rev = "3253c49544eacb33d5ad2f6f919b0696e5aab794";
|
|
||||||
hash = "sha256-uljzQBzXrZCZjcIWfioqHN8YsbUUNy14Vo+A3vZIXzM=";
|
|
||||||
};
|
|
||||||
|
|
||||||
outputs = [ "out" "dev" "man" "info" ];
|
|
||||||
|
|
||||||
nativeBuildInputs = [
|
|
||||||
autoreconfHook
|
|
||||||
pkg-config
|
|
||||||
python3
|
|
||||||
perl
|
|
||||||
bison
|
|
||||||
flex
|
|
||||||
texinfo
|
|
||||||
]
|
|
||||||
++ (with perlPackages; [ JSON ]);
|
|
||||||
|
|
||||||
buildInputs = [ db libedit pam ]
|
|
||||||
++ lib.optionals (stdenv.isDarwin) [ CoreFoundation Security SystemConfiguration ]
|
|
||||||
++ lib.optionals (withCJSON) [ cjson ]
|
|
||||||
++ lib.optionals (withCapNG) [ libcap_ng ]
|
|
||||||
++ lib.optionals (withMicroHTTPD) [ libmicrohttpd ]
|
|
||||||
++ lib.optionals (withOpenLDAP) [ openldap ]
|
|
||||||
++ lib.optionals (withOpenSSL) [ openssl ]
|
|
||||||
++ lib.optionals (withSQLite3) [ sqlite ];
|
|
||||||
|
|
||||||
doCheck = true;
|
|
||||||
nativeCheckInputs = [
|
|
||||||
curl
|
|
||||||
jdk
|
|
||||||
unzip
|
|
||||||
which
|
|
||||||
];
|
|
||||||
|
|
||||||
configureFlags = [
|
|
||||||
"--with-libedit-include=${libedit.dev}/include"
|
|
||||||
"--with-libedit-lib=${libedit}/lib"
|
|
||||||
# "--with-berkeley-db-include=${db.dev}/include"
|
|
||||||
"--with-berkeley-db=${db}/lib"
|
|
||||||
|
|
||||||
"--without-x"
|
|
||||||
"--disable-afs-string-to-key"
|
|
||||||
] ++ lib.optionals (withCapNG) [
|
|
||||||
"--with-capng"
|
|
||||||
] ++ lib.optionals (withCJSON) [
|
|
||||||
"--with-cjson=${cjson}"
|
|
||||||
] ++ lib.optionals (withOpenLDAP) [
|
|
||||||
"--with-openldap=${openldap.dev}"
|
|
||||||
] ++ lib.optionals (withOpenLDAPAsHDBModule) [
|
|
||||||
"--enable-hdb-openldap-module"
|
|
||||||
] ++ lib.optionals (withSQLite3) [
|
|
||||||
"--with-sqlite3=${sqlite.dev}"
|
|
||||||
];
|
|
||||||
|
|
||||||
# (check-ldap) slapd resides within ${openldap}/libexec,
|
|
||||||
# which is not part of $PATH by default.
|
|
||||||
# (check-ldap) prepending ${openldap}/bin to the path to avoid
|
|
||||||
# using the default installation of openldap on unsandboxed darwin systems,
|
|
||||||
# which does not support the new mdb backend at the moment (2024-01-13).
|
|
||||||
# (check-ldap) the bdb backend got deprecated in favour of mdb in openldap 2.5.0,
|
|
||||||
# but the heimdal tests still seem to expect bdb as the openldap backend.
|
|
||||||
# This might be fixed upstream in a future update.
|
|
||||||
patchPhase = ''
|
|
||||||
runHook prePatch
|
|
||||||
|
|
||||||
substituteInPlace tests/ldap/slapd-init.in \
|
|
||||||
--replace 'SCHEMA_PATHS="' 'SCHEMA_PATHS="${openldap}/etc/schema '
|
|
||||||
substituteInPlace tests/ldap/check-ldap.in \
|
|
||||||
--replace 'PATH=' 'PATH=${openldap}/libexec:${openldap}/bin:'
|
|
||||||
substituteInPlace tests/ldap/slapd.conf \
|
|
||||||
--replace 'database bdb' 'database mdb'
|
|
||||||
|
|
||||||
runHook postPatch
|
|
||||||
'';
|
|
||||||
|
|
||||||
# (test_cc) heimdal uses librokens implementation of `secure_getenv` on darwin,
|
|
||||||
# which expects either USER or LOGNAME to be set.
|
|
||||||
preCheck = lib.optionalString (stdenv.isDarwin) ''
|
|
||||||
export USER=nix-builder
|
|
||||||
'';
|
|
||||||
|
|
||||||
# We need to build hcrypt for applications like samba
|
|
||||||
postBuild = ''
|
|
||||||
(cd include/hcrypto; make -j $NIX_BUILD_CORES)
|
|
||||||
(cd lib/hcrypto; make -j $NIX_BUILD_CORES)
|
|
||||||
'';
|
|
||||||
|
|
||||||
postInstall = ''
|
|
||||||
# Install hcrypto
|
|
||||||
(cd include/hcrypto; make -j $NIX_BUILD_CORES install)
|
|
||||||
(cd lib/hcrypto; make -j $NIX_BUILD_CORES install)
|
|
||||||
|
|
||||||
mkdir -p $dev/bin
|
|
||||||
mv $out/bin/krb5-config $dev/bin/
|
|
||||||
|
|
||||||
# asn1 compilers, move them to $dev
|
|
||||||
mv $out/libexec/heimdal/* $dev/bin
|
|
||||||
rmdir $out/libexec/heimdal
|
|
||||||
|
|
||||||
cp include/heim_threads.h $dev/include
|
|
||||||
|
|
||||||
# compile_et is needed for cross-compiling this package and samba
|
|
||||||
mv lib/com_err/.libs/compile_et $dev/bin
|
|
||||||
'';
|
|
||||||
|
|
||||||
# Issues with hydra
|
|
||||||
# In file included from hxtool.c:34:0:
|
|
||||||
# hx_locl.h:67:25: fatal error: pkcs10_asn1.h: No such file or directory
|
|
||||||
#enableParallelBuilding = true;
|
|
||||||
|
|
||||||
passthru = {
|
|
||||||
implementation = "heimdal";
|
|
||||||
tests.nixos = nixosTests.kerberos.heimdal;
|
|
||||||
};
|
|
||||||
|
|
||||||
meta = with lib; {
|
|
||||||
homepage = "https://www.heimdal.software";
|
|
||||||
changelog = "https://github.com/heimdal/heimdal/releases";
|
|
||||||
description = "An implementation of Kerberos 5 (and some more stuff)";
|
|
||||||
license = licenses.bsd3;
|
|
||||||
platforms = platforms.unix;
|
|
||||||
maintainers = with maintainers; [ h7x4 ];
|
|
||||||
};
|
|
||||||
}
|
|
||||||
@@ -1,178 +0,0 @@
|
|||||||
{ lib
|
|
||||||
, stdenv
|
|
||||||
, fetchFromGitHub
|
|
||||||
, autoreconfHook
|
|
||||||
, pkg-config
|
|
||||||
, python3
|
|
||||||
, perl
|
|
||||||
, bison
|
|
||||||
, flex
|
|
||||||
, texinfo
|
|
||||||
, perlPackages
|
|
||||||
|
|
||||||
, openldap
|
|
||||||
, libcap_ng
|
|
||||||
, sqlite
|
|
||||||
, openssl
|
|
||||||
, db
|
|
||||||
, libedit
|
|
||||||
, pam
|
|
||||||
, krb5
|
|
||||||
, libmicrohttpd
|
|
||||||
, cjson
|
|
||||||
|
|
||||||
, CoreFoundation
|
|
||||||
, Security
|
|
||||||
, SystemConfiguration
|
|
||||||
|
|
||||||
, curl
|
|
||||||
, jdk
|
|
||||||
, unzip
|
|
||||||
, which
|
|
||||||
|
|
||||||
, nixosTests
|
|
||||||
|
|
||||||
, withCJSON ? true
|
|
||||||
, withCapNG ? stdenv.isLinux
|
|
||||||
# libmicrohttpd should theoretically work for darwin as well, but something is broken.
|
|
||||||
# It affects tests check-bx509d and check-httpkadmind.
|
|
||||||
, withMicroHTTPD ? stdenv.isLinux
|
|
||||||
, withOpenLDAP ? true
|
|
||||||
, withOpenLDAPAsHDBModule ? false
|
|
||||||
, withOpenSSL ? true
|
|
||||||
, withSQLite3 ? true
|
|
||||||
}:
|
|
||||||
|
|
||||||
assert lib.assertMsg (withOpenLDAPAsHDBModule -> withOpenLDAP) ''
|
|
||||||
OpenLDAP needs to be enabled in order to build the OpenLDAP HDB Module.
|
|
||||||
'';
|
|
||||||
|
|
||||||
stdenv.mkDerivation {
|
|
||||||
pname = "heimdal";
|
|
||||||
version = "7.8.0-unstable-2023-11-29";
|
|
||||||
|
|
||||||
src = fetchFromGitHub {
|
|
||||||
owner = "heimdal";
|
|
||||||
repo = "heimdal";
|
|
||||||
rev = "3253c49544eacb33d5ad2f6f919b0696e5aab794";
|
|
||||||
hash = "sha256-uljzQBzXrZCZjcIWfioqHN8YsbUUNy14Vo+A3vZIXzM=";
|
|
||||||
};
|
|
||||||
|
|
||||||
outputs = [ "out" "dev" "man" "info" ];
|
|
||||||
|
|
||||||
nativeBuildInputs = [
|
|
||||||
autoreconfHook
|
|
||||||
pkg-config
|
|
||||||
python3
|
|
||||||
perl
|
|
||||||
bison
|
|
||||||
flex
|
|
||||||
texinfo
|
|
||||||
]
|
|
||||||
++ (with perlPackages; [ JSON ]);
|
|
||||||
|
|
||||||
buildInputs = [ db libedit pam ]
|
|
||||||
++ lib.optionals (stdenv.isDarwin) [ CoreFoundation Security SystemConfiguration ]
|
|
||||||
++ lib.optionals (withCJSON) [ cjson ]
|
|
||||||
++ lib.optionals (withCapNG) [ libcap_ng ]
|
|
||||||
++ lib.optionals (withMicroHTTPD) [ libmicrohttpd ]
|
|
||||||
++ lib.optionals (withOpenLDAP) [ openldap ]
|
|
||||||
++ lib.optionals (withOpenSSL) [ openssl ]
|
|
||||||
++ lib.optionals (withSQLite3) [ sqlite ];
|
|
||||||
|
|
||||||
doCheck = true;
|
|
||||||
nativeCheckInputs = [
|
|
||||||
curl
|
|
||||||
jdk
|
|
||||||
unzip
|
|
||||||
which
|
|
||||||
];
|
|
||||||
|
|
||||||
configureFlags = [
|
|
||||||
"--with-libedit-include=${libedit.dev}/include"
|
|
||||||
"--with-libedit-lib=${libedit}/lib"
|
|
||||||
"--with-berkeley-db-include=${db.dev}/include"
|
|
||||||
"--with-berkeley-db"
|
|
||||||
|
|
||||||
"--without-x"
|
|
||||||
"--disable-afs-string-to-key"
|
|
||||||
] ++ lib.optionals (withCapNG) [
|
|
||||||
"--with-capng"
|
|
||||||
] ++ lib.optionals (withCJSON) [
|
|
||||||
"--with-cjson=${cjson}"
|
|
||||||
] ++ lib.optionals (withOpenLDAP) [
|
|
||||||
"--with-openldap=${openldap.dev}"
|
|
||||||
] ++ lib.optionals (withOpenLDAPAsHDBModule) [
|
|
||||||
"--enable-hdb-openldap-module"
|
|
||||||
] ++ lib.optionals (withSQLite3) [
|
|
||||||
"--with-sqlite3=${sqlite.dev}"
|
|
||||||
];
|
|
||||||
|
|
||||||
# (check-ldap) slapd resides within ${openldap}/libexec,
|
|
||||||
# which is not part of $PATH by default.
|
|
||||||
# (check-ldap) prepending ${openldap}/bin to the path to avoid
|
|
||||||
# using the default installation of openldap on unsandboxed darwin systems,
|
|
||||||
# which does not support the new mdb backend at the moment (2024-01-13).
|
|
||||||
# (check-ldap) the bdb backend got deprecated in favour of mdb in openldap 2.5.0,
|
|
||||||
# but the heimdal tests still seem to expect bdb as the openldap backend.
|
|
||||||
# This might be fixed upstream in a future update.
|
|
||||||
patchPhase = ''
|
|
||||||
runHook prePatch
|
|
||||||
|
|
||||||
substituteInPlace tests/ldap/slapd-init.in \
|
|
||||||
--replace 'SCHEMA_PATHS="' 'SCHEMA_PATHS="${openldap}/etc/schema '
|
|
||||||
substituteInPlace tests/ldap/check-ldap.in \
|
|
||||||
--replace 'PATH=' 'PATH=${openldap}/libexec:${openldap}/bin:'
|
|
||||||
substituteInPlace tests/ldap/slapd.conf \
|
|
||||||
--replace 'database bdb' 'database mdb'
|
|
||||||
|
|
||||||
runHook postPatch
|
|
||||||
'';
|
|
||||||
|
|
||||||
# (test_cc) heimdal uses librokens implementation of `secure_getenv` on darwin,
|
|
||||||
# which expects either USER or LOGNAME to be set.
|
|
||||||
preCheck = lib.optionalString (stdenv.isDarwin) ''
|
|
||||||
export USER=nix-builder
|
|
||||||
'';
|
|
||||||
|
|
||||||
# We need to build hcrypt for applications like samba
|
|
||||||
postBuild = ''
|
|
||||||
(cd include/hcrypto; make -j $NIX_BUILD_CORES)
|
|
||||||
(cd lib/hcrypto; make -j $NIX_BUILD_CORES)
|
|
||||||
'';
|
|
||||||
|
|
||||||
postInstall = ''
|
|
||||||
# Install hcrypto
|
|
||||||
(cd include/hcrypto; make -j $NIX_BUILD_CORES install)
|
|
||||||
(cd lib/hcrypto; make -j $NIX_BUILD_CORES install)
|
|
||||||
|
|
||||||
mkdir -p $dev/bin
|
|
||||||
mv $out/bin/krb5-config $dev/bin/
|
|
||||||
|
|
||||||
# asn1 compilers, move them to $dev
|
|
||||||
mv $out/libexec/heimdal/* $dev/bin
|
|
||||||
rmdir $out/libexec/heimdal
|
|
||||||
|
|
||||||
# compile_et is needed for cross-compiling this package and samba
|
|
||||||
mv lib/com_err/.libs/compile_et $dev/bin
|
|
||||||
'';
|
|
||||||
|
|
||||||
# Issues with hydra
|
|
||||||
# In file included from hxtool.c:34:0:
|
|
||||||
# hx_locl.h:67:25: fatal error: pkcs10_asn1.h: No such file or directory
|
|
||||||
#enableParallelBuilding = true;
|
|
||||||
|
|
||||||
passthru = {
|
|
||||||
implementation = "heimdal";
|
|
||||||
tests.nixos = nixosTests.kerberos.heimdal;
|
|
||||||
};
|
|
||||||
|
|
||||||
meta = with lib; {
|
|
||||||
homepage = "https://www.heimdal.software";
|
|
||||||
changelog = "https://github.com/heimdal/heimdal/releases";
|
|
||||||
description = "An implementation of Kerberos 5 (and some more stuff)";
|
|
||||||
license = licenses.bsd3;
|
|
||||||
platforms = platforms.unix;
|
|
||||||
maintainers = with maintainers; [ h7x4 ];
|
|
||||||
};
|
|
||||||
}
|
|
||||||
@@ -1,115 +0,0 @@
|
|||||||
{ config, pkgs, lib, ... }:
|
|
||||||
{
|
|
||||||
services.openldap = let
|
|
||||||
dn = "dc=kerberos,dc=pvv,dc=ntnu,dc=no";
|
|
||||||
cfg = config.services.openldap;
|
|
||||||
in {
|
|
||||||
enable = true;
|
|
||||||
|
|
||||||
# NOTE: this is a custom build of openldap with support for
|
|
||||||
# perl and kerberos.
|
|
||||||
package = pkgs.openldap.overrideAttrs (prev: {
|
|
||||||
# https://github.com/openldap/openldap/blob/master/configure
|
|
||||||
configureFlags = prev.configureFlags ++ [
|
|
||||||
# Connect to slapd via UNIX socket
|
|
||||||
"--enable-local"
|
|
||||||
# Cyrus SASL
|
|
||||||
"--enable-spasswd"
|
|
||||||
# Reverse hostname lookups
|
|
||||||
"--enable-rlookups"
|
|
||||||
# perl
|
|
||||||
"--enable-perl"
|
|
||||||
];
|
|
||||||
|
|
||||||
buildInputs = prev.buildInputs ++ (with pkgs; [
|
|
||||||
perl
|
|
||||||
config.security.krb5.package
|
|
||||||
]);
|
|
||||||
|
|
||||||
extraContribModules = prev.extraContribModules ++ [
|
|
||||||
# https://git.openldap.org/openldap/openldap/-/tree/master/contrib/slapd-modules
|
|
||||||
"smbk5pwd"
|
|
||||||
];
|
|
||||||
});
|
|
||||||
|
|
||||||
settings = {
|
|
||||||
attrs = {
|
|
||||||
olcLogLevel = [ "stats" "config" "args" ];
|
|
||||||
|
|
||||||
# olcAuthzRegexp = ''
|
|
||||||
# gidNumber=.*\\\+uidNumber=0,cn=peercred,cn=external,cn=auth
|
|
||||||
# "uid=heimdal,${dn2}"
|
|
||||||
# '';
|
|
||||||
|
|
||||||
# olcSaslSecProps = "minssf=0";
|
|
||||||
};
|
|
||||||
|
|
||||||
children = {
|
|
||||||
"cn=schema".includes = let
|
|
||||||
# NOTE: needed for smbk5pwd.so module
|
|
||||||
# schemaToLdif = name: path: pkgs.runCommandNoCC name {
|
|
||||||
# buildInputs = with pkgs; [ schema2ldif ];
|
|
||||||
# } ''
|
|
||||||
# schema2ldif "${path}" > $out
|
|
||||||
# '';
|
|
||||||
|
|
||||||
# hdb-ldif = schemaToLdif "hdb.ldif" "${pkgs.heimdal.src}/lib/hdb/hdb.schema";
|
|
||||||
# samba-ldif = schemaToLdif "samba.ldif" "${pkgs.heimdal.src}/tests/ldap/samba.schema";
|
|
||||||
in [
|
|
||||||
"${cfg.package}/etc/schema/core.ldif"
|
|
||||||
"${cfg.package}/etc/schema/cosine.ldif"
|
|
||||||
"${cfg.package}/etc/schema/nis.ldif"
|
|
||||||
"${cfg.package}/etc/schema/inetorgperson.ldif"
|
|
||||||
# "${hdb-ldif}"
|
|
||||||
# "${samba-ldif}"
|
|
||||||
];
|
|
||||||
|
|
||||||
# NOTE: installation of smbk5pwd.so module
|
|
||||||
# https://git.openldap.org/openldap/openldap/-/tree/master/contrib/slapd-modules/smbk5pwd
|
|
||||||
# "cn=module{0}".attrs = {
|
|
||||||
# objectClass = [ "olcModuleList" ];
|
|
||||||
# olcModuleLoad = [ "${cfg.package}/lib/modules/smbk5pwd.so" ];
|
|
||||||
# };
|
|
||||||
|
|
||||||
# NOTE: activation of smbk5pwd.so module for {1}mdb
|
|
||||||
# "olcOverlay={0}smbk5pwd,olcDatabase={1}mdb".attrs = {
|
|
||||||
# objectClass = [ "olcOverlayConfig" "olcSmbK5PwdConfig" ];
|
|
||||||
# olcOverlay = "{0}smbk5pwd";
|
|
||||||
# olcSmbK5PwdEnable = [ "krb5" "samba" ];
|
|
||||||
# olcSmbK5PwdMustChange = toString (60 * 60 * 24 * 30);
|
|
||||||
# };
|
|
||||||
|
|
||||||
"olcDatabase={1}mdb".attrs = {
|
|
||||||
objectClass = [ "olcDatabaseConfig" "olcMdbConfig" ];
|
|
||||||
|
|
||||||
olcDatabase = "{1}mdb";
|
|
||||||
|
|
||||||
olcSuffix = dn;
|
|
||||||
|
|
||||||
# TODO: PW is supposed to be a secret, but it's probably fine for testing
|
|
||||||
olcRootDN = "cn=admin,${dn}";
|
|
||||||
olcRootPW.path = pkgs.writeText "olcRootPW" "pass";
|
|
||||||
|
|
||||||
olcDbDirectory = "/var/lib/openldap/test-db";
|
|
||||||
olcDbIndex = "objectClass eq";
|
|
||||||
|
|
||||||
olcAccess = [
|
|
||||||
''{0}to attrs=userPassword,shadowLastChange
|
|
||||||
by dn.exact=cn=admin,${dn} write
|
|
||||||
by self write
|
|
||||||
by anonymous auth
|
|
||||||
by * none''
|
|
||||||
|
|
||||||
''{1}to dn.base=""
|
|
||||||
by * read''
|
|
||||||
|
|
||||||
/* allow read on anything else */
|
|
||||||
# ''{2}to *
|
|
||||||
# by cn=admin,${dn} write by dn.exact=gidNumber=0+uidNumber=0+cn=peercred,cn=external write
|
|
||||||
# by * read''
|
|
||||||
];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
@@ -1,14 +0,0 @@
|
|||||||
{ ... }:
|
|
||||||
{
|
|
||||||
# TODO: This is seemingly required for openldap to authenticate
|
|
||||||
# against kerberos, but I have no idea how to configure it as
|
|
||||||
# such. Does it need a keytab? There's a binary "testsaslauthd"
|
|
||||||
# that follows with `pkgs.cyrus_sasl` that might be useful.
|
|
||||||
services.saslauthd = {
|
|
||||||
enable = true;
|
|
||||||
mechanism = "kerberos5";
|
|
||||||
# config = ''
|
|
||||||
|
|
||||||
# '';
|
|
||||||
};
|
|
||||||
}
|
|
||||||
109
hosts/buskerud/services/openvpn-client.nix
Normal file
109
hosts/buskerud/services/openvpn-client.nix
Normal file
@@ -0,0 +1,109 @@
|
|||||||
|
{ lib, values, ... }:
|
||||||
|
{
|
||||||
|
services.openvpn.servers."ov-tunnel" = {
|
||||||
|
config = let
|
||||||
|
conf = {
|
||||||
|
# TODO: use aliases
|
||||||
|
client = true;
|
||||||
|
dev = "tap";
|
||||||
|
proto = "udp";
|
||||||
|
#remote = "129.241.210.253 1194";
|
||||||
|
remote = "129.241.210.191 1194";
|
||||||
|
|
||||||
|
resolv-retry = "infinite";
|
||||||
|
nobind = true;
|
||||||
|
|
||||||
|
ca = "/etc/openvpn/ca.pem";
|
||||||
|
cert = "/etc/openvpn/crt.pem";
|
||||||
|
key = "/etc/openvpn/key.pem";
|
||||||
|
remote-cert-tls = "server";
|
||||||
|
cipher = "none";
|
||||||
|
|
||||||
|
user = "nobody";
|
||||||
|
group = "nobody";
|
||||||
|
|
||||||
|
status = "/var/log/openvpn-status.log";
|
||||||
|
|
||||||
|
persist-key = true;
|
||||||
|
persist-tun = true;
|
||||||
|
|
||||||
|
verb = 5;
|
||||||
|
|
||||||
|
# script-security = 2;
|
||||||
|
# up = "systemctl restart rwhod";
|
||||||
|
};
|
||||||
|
in lib.pipe conf [
|
||||||
|
(lib.filterAttrs (_: value: !(builtins.isNull value || value == false)))
|
||||||
|
(builtins.mapAttrs (_: value:
|
||||||
|
if builtins.isList value then builtins.concatStringsSep " " (map toString value)
|
||||||
|
else if value == true then value
|
||||||
|
else if builtins.any (f: f value) [
|
||||||
|
builtins.isString
|
||||||
|
builtins.isInt
|
||||||
|
builtins.isFloat
|
||||||
|
lib.isPath
|
||||||
|
lib.isDerivation
|
||||||
|
] then toString value
|
||||||
|
else throw "Unknown value in buskerud openvpn config, deading now\n${value}"
|
||||||
|
))
|
||||||
|
(lib.mapAttrsToList (name: value: if value == true then name else "${name} ${value}"))
|
||||||
|
(builtins.concatStringsSep "\n")
|
||||||
|
(x: x + "\n\n")
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.network.networks."enp14s0f1" = {
|
||||||
|
matchConfig.Name = "enp14s0f1";
|
||||||
|
networkConfig = {
|
||||||
|
DefaultRouteOnDevice = true;
|
||||||
|
};
|
||||||
|
routes = [
|
||||||
|
{ routeConfig = {
|
||||||
|
Type = "unicast";
|
||||||
|
Destination = values.hosts.knutsen.ipv4 + "/32";
|
||||||
|
Metric = 50;
|
||||||
|
};
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.network.netdevs."br0" = {
|
||||||
|
netdevConfig = {
|
||||||
|
Kind = "bridge";
|
||||||
|
Name = "br0";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.network.networks."br0" = {
|
||||||
|
matchConfig.Name = "br0";
|
||||||
|
routes = [
|
||||||
|
{ routeConfig = {
|
||||||
|
Type = "unicast";
|
||||||
|
Destination = values.ipv4-space;
|
||||||
|
Metric = 100;
|
||||||
|
};
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.network.networks."enp3s0f0" = {
|
||||||
|
matchConfig.Name = "enp3s0f0";
|
||||||
|
networkConfig.DefaultRouteOnDevice = false;
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.network.networks."enp3s0f1" = {
|
||||||
|
matchConfig.Name = "enp3s0f1";
|
||||||
|
bridge = [ "br0" ];
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.network.networks."tap0" = {
|
||||||
|
matchConfig.Name = "tap0";
|
||||||
|
bridge = [ "br0" ];
|
||||||
|
};
|
||||||
|
|
||||||
|
#networking.nat = {
|
||||||
|
# enable = true;
|
||||||
|
# externalInterface = "enp14s0f1";
|
||||||
|
# internalInterfaces = [ "tun" ];
|
||||||
|
#};
|
||||||
|
}
|
||||||
@@ -9,7 +9,7 @@
|
|||||||
];
|
];
|
||||||
|
|
||||||
packages = with pkgs; [
|
packages = with pkgs; [
|
||||||
eza
|
exa
|
||||||
neovim
|
neovim
|
||||||
];
|
];
|
||||||
|
|
||||||
|
|||||||
@@ -1,18 +0,0 @@
|
|||||||
{ pkgs, ... }:
|
|
||||||
{
|
|
||||||
users.users.eirikwit = {
|
|
||||||
isNormalUser = true;
|
|
||||||
extraGroups = [
|
|
||||||
"wheel"
|
|
||||||
"drift"
|
|
||||||
];
|
|
||||||
|
|
||||||
packages = with pkgs; [
|
|
||||||
micro
|
|
||||||
];
|
|
||||||
|
|
||||||
openssh.authorizedKeys.keys = [
|
|
||||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGZusOSiUVSMjrvNdUq4R91Gafq4XVs9C77Zt+LMPhCU eirikw@live.no"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
}
|
|
||||||
@@ -3,7 +3,7 @@
|
|||||||
{
|
{
|
||||||
users.users.jonmro = {
|
users.users.jonmro = {
|
||||||
isNormalUser = true;
|
isNormalUser = true;
|
||||||
extraGroups = [ "wheel" "drift" "nix-builder-users" ];
|
extraGroups = [ "wheel" ];
|
||||||
shell = pkgs.zsh;
|
shell = pkgs.zsh;
|
||||||
openssh.authorizedKeys.keys = [
|
openssh.authorizedKeys.keys = [
|
||||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEm5PfYmfl/0fnAP/3coVlvTw3/TYNLT6r/NwJHZbLAK jonrodtang@gmail.com"
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEm5PfYmfl/0fnAP/3coVlvTw3/TYNLT6r/NwJHZbLAK jonrodtang@gmail.com"
|
||||||
|
|||||||
@@ -11,7 +11,7 @@
|
|||||||
|
|
||||||
packages = with pkgs; [
|
packages = with pkgs; [
|
||||||
bottom
|
bottom
|
||||||
eza
|
exa
|
||||||
neovim
|
neovim
|
||||||
diskonaut
|
diskonaut
|
||||||
ripgrep
|
ripgrep
|
||||||
|
|||||||
Reference in New Issue
Block a user