cafkafk/nixpkgs
cafkafk/nixpkgs
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

Merge pull request #280628 from h7x4/nixos-module-update-kanidm-add-backup-dir-to-bindpaths

Browse source 
nixos/kanidm: declare `online_backup` options
This commit is contained in:
Kerstin 2024-02-29 15:19:34 +01:00 committed by GitHub
commit 51363e5c0d
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 32 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

32
nixos/modules/services/security/kanidm.nix
View file

@ -132,6 +132,28 @@ in
default = "WriteReplica";
type = lib.types.enum [ "WriteReplica" "WriteReplicaNoUI" "ReadOnlyReplica" ];
};
online_backup = {
path = lib.mkOption {
description = lib.mdDoc "Path to the output directory for backups.";
type = lib.types.path;
default = "/var/lib/kanidm/backups";
};
schedule = lib.mkOption {
description = lib.mdDoc "The schedule for backups in cron format.";
type = lib.types.str;
default = "00 22 * * *";
};
versions = lib.mkOption {
description = lib.mdDoc ''
Number of backups to keep.
The default is set to `0`, in order to disable backups by default.
'';
type = lib.types.ints.unsigned;
default = 0;
example = 7;
};
};
};
};
default = { };
@ -233,6 +255,14 @@ in
environment.systemPackages = lib.mkIf cfg.enableClient [ cfg.package ];
systemd.tmpfiles.settings."10-kanidm" = {
${cfg.serverSettings.online_backup.path}.d = {
mode = "0700";
user = "kanidm";
group = "kanidm";
};
};
systemd.services.kanidm = lib.mkIf cfg.enableServer {
description = "kanidm identity management daemon";
wantedBy = [ "multi-user.target" ];
@ -253,6 +283,8 @@ in
BindPaths = [
# To create the socket
"/run/kanidmd:/run/kanidmd"
# To store backups
cfg.serverSettings.online_backup.path
];
AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];