kanidm client working

This commit is contained in:
Daniel Flanagan 2024-08-06 15:55:07 -05:00
parent 078f29bcbe
commit 2a14742b5a
2 changed files with 37 additions and 0 deletions

View file

@ -103,6 +103,7 @@
packages = with pkgs; [
# tools I use when editing nix code
kanidm
nil
alejandra
gnupg

View file

@ -927,6 +927,42 @@
root
];
services.kanidm = {
enableClient = true;
enablePam = true;
package = pkgs.kanidm;
clientSettings.uri = "https://idm.h.lyte.dev";
unixSettings = {
# hsm_pin_path = "/somewhere/else";
pam_allowed_login_groups = [];
};
};
systemd.tmpfiles.rules = [
"d /etc/kanidm 1755 nobody users -"
];
# module has the incorrect file permissions out of the box
environment.etc = {
# "kanidm" = {
# enable = true;
# user = "nobody";
# group = "users";
# mode = "0755";
# };
"kanidm/unixd" = {
user = "kanidm-unixd";
group = "kanidm-unixd";
mode = "0700";
};
"kanidm/config" = {
user = "nobody";
group = "users";
mode = "0755";
};
};
programs.gnupg.agent = {
enable = true;
pinentryPackage = lib.mkDefault pkgs.pinentry-tty;