From e356a7ccbae3698d8aa320f0b118a0b472ee20bc Mon Sep 17 00:00:00 2001
From: Daniel Flanagan <daniel@lyte.dev>
Date: Tue, 6 Aug 2024 10:33:09 -0500
Subject: [PATCH] WIP kanidm

---
 modules/nixos/kanidm/client.toml |   2 --
 modules/nixos/kanidm/kanidm.db   | Bin 73728 -> 0 bytes
 modules/nixos/kanidm/server.toml |  10 ----------
 nixos/beefcake.nix               |  16 ++++++++++++----
 safe-remote-upgrade.bash         |   4 ++--
 5 files changed, 14 insertions(+), 18 deletions(-)
 delete mode 100644 modules/nixos/kanidm/client.toml
 delete mode 100644 modules/nixos/kanidm/kanidm.db
 delete mode 100644 modules/nixos/kanidm/server.toml

diff --git a/modules/nixos/kanidm/client.toml b/modules/nixos/kanidm/client.toml
deleted file mode 100644
index 1ea48a5..0000000
--- a/modules/nixos/kanidm/client.toml
+++ /dev/null
@@ -1,2 +0,0 @@
-uri = "https://idm.foxtrot.hare-cod.ts.net:8443"
-ca_path = "/tmp/cert.pem"
diff --git a/modules/nixos/kanidm/kanidm.db b/modules/nixos/kanidm/kanidm.db
deleted file mode 100644
index 2a0e7c7d26881f9589f10fbc95b0837e8dff78ce..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 73728
zcmeI)%}yIv7zW@OFt#CpLn>scQN#o(YKVqv&Uj{QXVW@lf~>fv7}7SXBG<tVvA{OP
zcA6;4B9tt80o}G2kwv@f9dyyFsJhE4Rabq#u`#A#LZzxz+}FZke$LN#o^y;CzN4(I
z=BllV@u0C=E47S-c3#tU?L))RG%bwx1-uVlavnN3!FRpyc+g>3d%yVZRP1+cCh}5?
zU5foQ`SbK|(?3k_Pp?k=IQjkL&SYlt!uW3V+wl(~FQZ=!YKGS-KmiI+fCB$}f#=uG
zN8*<+>w9yp(*5nq!)C2mF11R<*5T32Qo+xx`^I|aM$R`5uNzk<i~+B$$`fPV|7_j(
zxRCuQQ@Cr~_V1blOFt@Yw=2et+{z6jzp`%R@8ohPmR(59gyYMXb*)-2R~|RN+{P~(
z#ZtS~2+oU#krmb9@rCE_O-JH$bNb$;-UzGpR%d|0LG0N0g3JH@@Kh`u_vcO<UJzJk
zbiv{Iy``yO`u10Y!PP3Y`<30sgJSFOX!^+T4zCXw-)6Dhu9kz@J9)-RZz^zWrQm0m
z^D^gGJFP7k1^<>`@bgRlnz6atXzvtTSEZW;<EGpw1S>0>&#q@Px!m3EMgQi>0ra=u
z3Fb)qrHze7TPC>M!%80Q<$NsQrOet==B9saZ7uA58jZv+UesTV1&ZAWyWhr-_;oK1
z!0XYydEwVfwMyqRa<Jx&JNfMD9slG(H+SlPqx5FATyM)#FtYh|f7vheK3J!A(rRo~
z>PJ6_Cr49xyi?tMf=}v4ej&TmYy7zE;$%3Uxj1M^cQK1j_h4%A+*yhzy2U3KC(csb
z?iN3{IDVGms#|>GYi%_6!SP}xSQWi>)jJ3sSsA^{!?`wgO3mh1joosvJWgH}|NQb%
zk<)%6_QZ=$?=Y&uXRDIvRf(vvvsJNsRl+KCwkoPuW$gK!9*JMMqVMU!aw^|1KC0|C
ztBrcG)qgy4WKs3s8L+OpKdj&U6Q|qV!H<OFAJ*hZIDY%epbu+*C`HwOHj3Y(qVk*6
z6yAF5wT3UgC_n)UP=Epypa2CZKmiI+fC3a4E`dmBbauQ}s@5kkE<XPc*W_|E6rcbF
zC_n)UP=Epypa2CZK!L76baYmi$N!Mz|FP+xFA7kA0u-PC1t>rP3Q&Lo6rcbFhFC!I
z|9t)*;tA%^C_n)UP=Epypa2CZKmiI+fC3QU^FNmX1t>rP3Q&Lo6rcbFC_n)UP+<54
z`20WobIcJ^fC3bt00k&O0SZun0u-PC1^E2WH9!FhP=Epypa2CZKmiI+fC3a4egXdf
zf5Sh=93cfLKmiI+fC3bt00k&O0SZun`G2kf3Q&Lo6rcbFC_n)UP=Epypuq48@cDoE
z=a?g;00k&O0SZun0u-PC1t>rP3h?=#Yk&e2pa2CZKmiI+fC3bt00k&8`~rObAO1P!
z2q{1T3Q&Lo6rcbFC_n)UP=Esb|NpoKC_n)UP=Epypa2CZKmiI+fC9rWAkY6JQ@?1_
zzv3UhC_n)UP=Epypa2CZKmiI+;4Ko^duJpxyFdT1R@!(vzt(urT6<WsUGEb$fBotF
zR^`e3_0Mfvnd!8dNSW!BX(yDa9M8m&<(RmdG?kUWJ833tQ`xxg;xvI0wuy?KYo<^!
zZQ3?&r}4Hd6ZMlQ=-{elo30n!L>c#<Io~R6N}mZQxTjKP3b)Z>(m}tt=%h>!eac%x
zk-oj4IfdTrgoP%mkI;fjqU9u7_Ry^*bvz4AN|^-SZl}6J2@JtjR?vg(BEWmkp6$)*
zp_%<_wXKdxrqYDT@<y$nMWJ^L6Y-#V<(aMoh~{04uVW-b#rPFERvt7Q7afV0B_=pi
zX%tK&Ky;6uQ#f<sqHssfh0H-+v}n6d&qg^2*h-_Fpmhf!L%>#DBp0m+1#Tle+m&uG
zIJDu2Z-67!gK0uED2Wz?%EDYB7|S!$u8Dwg%}ZmBJCk9-MfU%X#9nE!SFu0dqD9V7
zDL?@VP=Epypa2CZKmiI+fC3aaO&~fttIOYpM#e^G#%o)W|JSF!)9}R?1t>rP3Q&Lo
z6rcbFC_n)U{AU9DMLiV%CRHsXZ{JB=`y1uvU(@;BB)%<~WgIJ{cx~kNl_c4bFjlr}
zO0GSLys?}jWsj`7nGW*j3h8VQ`DLVt74qGZpq2!C3RUsVmdr6S%E(tEA08y6Q)mTg
zWL!xg<BSs|zLENO(Whjkk>!`>kocBe14zUt<)Y;0ksnW*NR6Wk_7r$1hda`mjo1*P
zoJ!=9MaL!q#3fae*a?6{wu81L8!nL|g`PH%A4d`%=Rw|FlK&W%Y#+cT0hK~CHfkZf
zpgG)>D9{gb;Ml65kQWbbNR}NV_7I<7Nk&}`F=9l44F<040g!DG5+oAt3MqMXg0Ud2
z9_%uZN*KQ6{eztVaF87c7>~dRS`Zt65SJWUeQAFr<rTEB2?7V`6%D1(sbgY#6oxJC
zlKht$!%RqEo;t|*%hm}LOCdN+JRmU`h0^%4E$lgfH%iF3(X*(?rT{O2>W^J3J%7F4
t-rnxy|Ml2w4PSgwfC3bt00k&O0SZun0u-PC1t>6F0@2a<c<@)HKLKtsRdxUX

diff --git a/modules/nixos/kanidm/server.toml b/modules/nixos/kanidm/server.toml
deleted file mode 100644
index 3e35d9e..0000000
--- a/modules/nixos/kanidm/server.toml
+++ /dev/null
@@ -1,10 +0,0 @@
-bindaddress = "[::]:8443"
-db_path = "/home/daniel/code/nix/modules/nixos/kanidm/kanidm.db"
-tls_chain = "/tmp/cert.pem"
-tls_key = "/tmp/key.pem"
-domain = "idm.foxtrot.hare-cod.ts.net"
-origin = "https://idm.foxtrot.hare-cod.ts.net:8443"
-
-[online_backup]
-path = "/tmp/kanidm/backups/"
-schedule = "00 22 * * *"
diff --git a/nixos/beefcake.nix b/nixos/beefcake.nix
index 0f520ed..9c8b3cd 100644
--- a/nixos/beefcake.nix
+++ b/nixos/beefcake.nix
@@ -447,7 +447,6 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
       users.groups.daniel.members = ["daniel"];
       users.groups.nixadmin.members = ["daniel"];
       users.users.daniel = {
-        packages = [pkgs.weechat];
         extraGroups = [
           "nixadmin" # write access to /etc/nixos/ files
           "wheel" # sudo access
@@ -778,6 +777,7 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
             gitMinimal
             gnused
             nodejs
+            gnutar # needed for cache action
             wget
           ];
         };
@@ -1008,19 +1008,27 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
 
         serverSettings = {
           bindaddress = "[::]:8443";
-          db_path = "/storage/kanidm/data/kanidm.db";
+          # ldapbindaddress
           # TODO: these will need permissions?
           tls_chain = "/var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/idm.h.lyte.dev.crt";
           tls_key = "/var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/idm.h.lyte.dev.key";
-          domain = "idm.foxtrot.hare-cod.ts.net";
-          origin = "https://idm.h.lyte.dev:8443";
+          domain = "idm.h.lyte.dev";
+          origin = "https://idm.h.lyte.dev";
+          # log_level
 
           online_backup = {
             path = "/storage/kanidm/backups/";
             schedule = "00 22 * * *";
+            # versions = 7;
           };
         };
 
+        unixSettings = {
+          uri = "https://idm.h.lyte.dev";
+          pam_allowed_login_groups = [];
+          # ca_path = "/path/to/ca.pem";
+        };
+
         clientSettings = {
           uri = "https://idm.h.lyte.dev";
           # ca_path = "/tmp/cert.pem";
diff --git a/safe-remote-upgrade.bash b/safe-remote-upgrade.bash
index d620fe6..530ca3d 100755
--- a/safe-remote-upgrade.bash
+++ b/safe-remote-upgrade.bash
@@ -30,9 +30,9 @@ git add -A
 
 ssh "root@$target_host" "bash -c '
   set -m
-  # sleep 5 mins
+  # sleep 15 mins
   echo \"Starting background reboot job...\"
-  (sleep 300; reboot;) &
+  (sleep 900; reboot;) &
   jobs -p
   disown
 '" &