···

       
614
       
 
       


     

       
615
       
 
       
- `services.soft-serve` now restarts upon config change.

     

       
616
       
 
       


     

       
0
       
 
       

     

       
0
       
 
       

     

       
617
       
 
       
- `bind.cacheNetworks` now only controls access for recursive queries, where it previously controlled access for all queries.

     

       
618
       
 
       


     

       
619
       
 
       
- [`services.mongodb.enableAuth`](#opt-services.mongodb.enableAuth) now uses the newer [mongosh](https://github.com/mongodb-js/mongosh) shell instead of the legacy shell to configure the initial superuser. You can configure the mongosh package to use through the [`services.mongodb.mongoshPackage`](#opt-services.mongodb.mongoshPackage) option.

     

···

       
614
       
 
       


     

       
615
       
 
       
- `services.soft-serve` now restarts upon config change.

     

       
616
       
 
       


     

       
617
       
+
       
- `services.keycloak` now provides a `realmFiles` option that allows to import realms during startup. See https://www.keycloak.org/server/importExport

     

       
618
       
+
       


     

       
619
       
 
       
- `bind.cacheNetworks` now only controls access for recursive queries, where it previously controlled access for all queries.

     

       
620
       
 
       


     

       
621
       
 
       
- [`services.mongodb.enableAuth`](#opt-services.mongodb.enableAuth) now uses the newer [mongosh](https://github.com/mongodb-js/mongosh) shell instead of the legacy shell to configure the initial superuser. You can configure the mongosh package to use through the [`services.mongodb.mongoshPackage`](#opt-services.mongodb.mongoshPackage) option.

     

···

       
90
       
 
       
        enum

     

       
91
       
 
       
        package

     

       
92
       
 
       
        port

     

       
0
       
 
       

     

       
93
       
 
       
        ;

     

       
94
       
 
       


     

       
95
       
 
       
      assertStringPath =

     
···

       
285
       
 
       
          different theme types: for example, `account`,

     

       
286
       
 
       
          `login` etc. After adding a theme to this option you

     

       
287
       
 
       
          can select it by its name in Keycloak administration console.

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
288
       
 
       
        '';

     

       
289
       
 
       
      };

     

       
290
       
 
       


     
···

       
644
       
 
       
        '';

     

       
645
       
 
       
      };

     

       
646
       
 
       


     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
647
       
 
       
      systemd.services.keycloak =

     

       
648
       
 
       
        let

     

       
649
       
 
       
          databaseServices =

     
···

       
725
       
 
       
              cp $CREDENTIALS_DIRECTORY/ssl_{cert,key} /run/keycloak/ssl/

     

       
726
       
 
       
            ''

     

       
727
       
 
       
            + ''

     

       
728
       
-
       
              kc.sh --verbose start --optimized

     

       
729
       
 
       
            '';

     

       
730
       
 
       
        };

     

       
731
       
 
       


     

···

       
90
       
 
       
        enum

     

       
91
       
 
       
        package

     

       
92
       
 
       
        port

     

       
93
       
+
       
        listOf

     

       
94
       
 
       
        ;

     

       
95
       
 
       


     

       
96
       
 
       
      assertStringPath =

     
···

       
286
       
 
       
          different theme types: for example, `account`,

     

       
287
       
 
       
          `login` etc. After adding a theme to this option you

     

       
288
       
 
       
          can select it by its name in Keycloak administration console.

     

       
289
       
+
       
        '';

     

       
290
       
+
       
      };

     

       
291
       
+
       


     

       
292
       
+
       
      realmFiles = mkOption {

     

       
293
       
+
       
        type = listOf path;

     

       
294
       
+
       
        example = lib.literalExpression ''

     

       
295
       
+
       
          [

     

       
296
       
+
       
            ./some/realm.json

     

       
297
       
+
       
            ./another/realm.json

     

       
298
       
+
       
          ]

     

       
299
       
+
       
        '';

     

       
300
       
+
       
        default = [ ];

     

       
301
       
+
       
        description = ''

     

       
302
       
+
       
          Realm files that the server is going to import during startup.

     

       
303
       
+
       
          If a realm already exists in the server, the import operation is

     

       
304
       
+
       
          skipped. Importing the master realm is not supported. All files are

     

       
305
       
+
       
          expected to be in `json` format. See the

     

       
306
       
+
       
          [documentation](https://www.keycloak.org/server/importExport) for

     

       
307
       
+
       
          further information.

     

       
308
       
 
       
        '';

     

       
309
       
 
       
      };

     

       
310
       
 
       


     
···

       
664
       
 
       
        '';

     

       
665
       
 
       
      };

     

       
666
       
 
       


     

       
667
       
+
       
      systemd.tmpfiles.settings."10-keycloak" =

     

       
668
       
+
       
        let

     

       
669
       
+
       
          mkTarget =

     

       
670
       
+
       
            file:

     

       
671
       
+
       
            let

     

       
672
       
+
       
              baseName = builtins.baseNameOf file;

     

       
673
       
+
       
              name = if lib.hasSuffix ".json" baseName then baseName else "${baseName}.json";

     

       
674
       
+
       
            in

     

       
675
       
+
       
            "/run/keycloak/data/import/${name}";

     

       
676
       
+
       
          settingsList = map (f: {

     

       
677
       
+
       
            name = mkTarget f;

     

       
678
       
+
       
            value = {

     

       
679
       
+
       
              "L+".argument = "${f}";

     

       
680
       
+
       
            };

     

       
681
       
+
       
          }) cfg.realmFiles;

     

       
682
       
+
       
        in

     

       
683
       
+
       
        builtins.listToAttrs settingsList;

     

       
684
       
+
       


     

       
685
       
 
       
      systemd.services.keycloak =

     

       
686
       
 
       
        let

     

       
687
       
 
       
          databaseServices =

     
···

       
763
       
 
       
              cp $CREDENTIALS_DIRECTORY/ssl_{cert,key} /run/keycloak/ssl/

     

       
764
       
 
       
            ''

     

       
765
       
 
       
            + ''

     

       
766
       
+
       
              kc.sh --verbose start --optimized ${lib.optionalString (cfg.realmFiles != [ ]) "--import-realm"}

     

       
767
       
 
       
            '';

     

       
768
       
 
       
        };

     

       
769