commit 943334bf1141915a30fe490d3a780636de0f3325 · pyrox.dev/nixpkgs

+2 -12

nixos/tests/all-tests.nix

···

       772
       772
        
         k3s = handleTest ./k3s { };

     

       773
       773
        
         kafka = handleTest ./kafka { };

     

       774
       774
        
         kanboard = runTest ./web-apps/kanboard.nix;

     

       775
       775
       -
         kanidm =

     

       776
       776
       -
           kanidmVersion:

     

       777
       777
       -
           runTest {

     

       778
       778
       -
             imports = [ ./kanidm.nix ];

     

       779
       779
       -
             _module.args = { inherit kanidmVersion; };

     

       780
       780
       -
           };

     

       781
       781
       -
         kanidm-provisioning =

     

       782
       782
       -
           kanidmVersion:

     

       783
       783
       -
           runTest {

     

       784
       784
       -
             imports = [ ./kanidm-provisioning.nix ];

     

       785
       785
       -
             _module.args = { inherit kanidmVersion; };

     

       786
       786
       -
           };

     

       775
       775
       +
         kanidm = runTest ./kanidm.nix;

     

       776
       776
       +
         kanidm-provisioning = runTest ./kanidm-provisioning.nix;

     

       787
       777
        
         karma = runTest ./karma.nix;

     

       788
       778
        
         kavita = runTest ./kavita.nix;

     

       789
       779
        
         kbd-setfont-decompress = runTest ./kbd-setfont-decompress.nix;

+4 -4

nixos/tests/kanidm-provisioning.nix

···

       1
       1
       -
       { kanidmVersion, pkgs, ... }:

     

       1
       1
       +
       { kanidmPackage, pkgs, ... }:

     

       2
       2
        
       let

     

       3
       3
        
         certs = import ./common/acme/server/snakeoil-certs.nix;

     

       4
       4
        
         serverDomain = certs.domain;

     
···

       13
       13
        
         provisionAdminPassword = "very-strong-password-for-admin";

     

       14
       14
        
         provisionIdmAdminPassword = "very-strong-password-for-idm-admin";

     

       15
       15
        
         provisionIdmAdminPassword2 = "very-strong-alternative-password-for-idm-admin";

     

       16
       16
       -
       

     

       17
       17
       -
         kanidmPackage = pkgs."kanidmWithSecretProvisioning_${kanidmVersion}";

     

       18
       16
        
       in

     

       19
       17
        
       {

     

       20
       20
       -
         name = "kanidm-provisioning";

     

       18
       18
       +
         name = "kanidm-provisioning-${kanidmPackage.version}";

     

       21
       19
        
         meta.maintainers = with pkgs.lib.maintainers; [ oddlama ];

     

       20
       20
       +
       

     

       21
       21
       +
         _module.args.kanidmPackage = pkgs.lib.mkDefault pkgs.kanidmWithSecretProvisioning;

     

       22
       22
        
       

     

       23
       23
        
         nodes.provision =

     

       24
       24
        
           { pkgs, lib, ... }:

+4 -4

nixos/tests/kanidm.nix

···

       1
       1
       -
       { kanidmVersion, pkgs, ... }:

     

       1
       1
       +
       { kanidmPackage, pkgs, ... }:

     

       2
       2
        
       let

     

       3
       3
        
         certs = import ./common/acme/server/snakeoil-certs.nix;

     

       4
       4
        
         serverDomain = certs.domain;

     
···

       13
       13
        
           cp ${certs."${serverDomain}".cert} $out/snakeoil.crt

     

       14
       14
        
           cp ${certs."${serverDomain}".key} $out/snakeoil.key

     

       15
       15
        
         '';

     

       16
       16
       -
       

     

       17
       17
       -
         kanidmPackage = pkgs."kanidm_${kanidmVersion}";

     

       18
       16
        
       in

     

       19
       17
        
       {

     

       20
       20
       -
         name = "kanidm";

     

       18
       18
       +
         name = "kanidm-${kanidmPackage.version}";

     

       21
       19
        
         meta.maintainers = with pkgs.lib.maintainers; [

     

       22
       20
        
           Flakebi

     

       23
       21
        
           oddlama

     

       24
       22
        
         ];

     

       23
       23
       +
       

     

       24
       24
       +
         _module.args.kanidmPackage = pkgs.lib.mkDefault pkgs.kanidm;

     

       25
       25
        
       

     

       26
       26
        
         nodes.server =

     

       27
       27
        
           { pkgs, ... }:

+23 -20

pkgs/by-name/ka/kanidm/generic.nix

···

       22
       22
        
         pam,

     

       23
       23
        
         bashInteractive,

     

       24
       24
        
         rust-jemalloc-sys,

     

       25
       25
       -
         kanidm,

     

       25
       25
       +
         kanidmWithSecretProvisioning,

     

       26
       26
        
         # If this is enabled, kanidm will be built with two patches allowing both

     

       27
       27
        
         # oauth2 basic secrets and admin credentials to be provisioned.

     

       28
       28
        
         # This is NOT officially supported (and will likely never be),

     
···

       35
       35
        
       let

     

       36
       36
        
         arch = if stdenv.hostPlatform.isx86_64 then "x86_64" else "generic";

     

       37
       37
        
       

     

       38
       38
       -
         versionUnderscored = builtins.replaceStrings [ "." ] [ "_" ] (

     

       39
       39
       -
           lib.versions.majorMinor kanidm.version

     

       40
       40
       -
         );

     

       41
       41
       -
       

     

       42
       42
       -
         provisionPatches = [

     

       43
       43
       -
           (./. + "/provision-patches/${versionUnderscored}/oauth2-basic-secret-modify.patch")

     

       44
       44
       -
           (./. + "/provision-patches/${versionUnderscored}/recover-account.patch")

     

       45
       45
       -
         ];

     

       38
       38
       +
         versionUnderscored =

     

       39
       39
       +
           finalAttrs: lib.replaceStrings [ "." ] [ "_" ] (lib.versions.majorMinor finalAttrs.version);

     

       46
       40
        
       

     

       47
       41
        
         upgradeNote = ''

     

       48
       42
        
           Please upgrade by verifying `kanidmd domain upgrade-check` and choosing the

     
···

       60
       54
        
         src = fetchFromGitHub {

     

       61
       55
        
           owner = "kanidm";

     

       62
       56
        
           repo = "kanidm";

     

       63
       63
       -
           rev = "refs/tags/v${version}";

     

       57
       57
       +
           tag = "v${finalAttrs.version}";

     

       64
       58
        
           inherit hash;

     

       65
       59
        
         };

     

       66
       60
        
       

     

       67
       61
        
         env.KANIDM_BUILD_PROFILE = "release_nixpkgs_${arch}";

     

       68
       62
        
       

     

       69
       69
       -
         patches = lib.optionals enableSecretProvisioning provisionPatches;

     

       63
       63
       +
         patches = lib.optionals enableSecretProvisioning [

     

       64
       64
       +
           (./. + "/provision-patches/${versionUnderscored finalAttrs}/oauth2-basic-secret-modify.patch")

     

       65
       65
       +
           (./. + "/provision-patches/${versionUnderscored finalAttrs}/recover-account.patch")

     

       66
       66
       +
         ];

     

       70
       67
        
       

     

       71
       68
        
         postPatch =

     

       72
       69
        
           let

     
···

       75
       72
        
             profile = {

     

       76
       73
        
               cpu_flags = if stdenv.hostPlatform.isx86_64 then "x86_64_legacy" else "none";

     

       77
       74
        
             }

     

       78
       78
       -
             // lib.optionalAttrs (lib.versionAtLeast version "1.5") {

     

       75
       75
       +
             // lib.optionalAttrs (lib.versionAtLeast finalAttrs.version "1.5") {

     

       79
       76
        
               client_config_path = "/etc/kanidm/config";

     

       80
       77
        
               resolver_config_path = "/etc/kanidm/unixd";

     

       81
       78
        
               resolver_unix_shell_path = "${lib.getBin bashInteractive}/bin/bash";

     
···

       136
       133
        
       

     

       137
       134
        
         passthru = {

     

       138
       135
        
           tests = {

     

       139
       139
       -
             kanidm = nixosTests.kanidm versionUnderscored;

     

       140
       140
       -
             kanidm-provisioning = nixosTests.kanidm-provisioning versionUnderscored;

     

       136
       136
       +
             kanidm = nixosTests.kanidm.extend {

     

       137
       137
       +
               modules = [ { _module.args.kanidmPackage = finalAttrs.finalPackage; } ];

     

       138
       138
       +
             };

     

       139
       139
       +
             kanidm-provisioning = nixosTests.kanidm-provisioning.extend {

     

       140
       140
       +
               modules = [ { _module.args.kanidmPackage = finalAttrs.finalPackage.withSecretProvisioning; } ];

     

       141
       141
       +
             };

     

       141
       142
        
           };

     

       142
       143
        
       

     

       143
       144
        
           updateScript = lib.optionals (!enableSecretProvisioning) (nix-update-script {

     

       144
       145
        
             extraArgs = [

     

       145
       146
        
               "-vr"

     

       146
       146
       -
               "v(${lib.versions.major kanidm.version}\\.${lib.versions.minor kanidm.version}\\.[0-9]*)"

     

       147
       147
       +
               "v(${lib.versions.major finalAttrs.version}\\.${lib.versions.minor finalAttrs.version}\\.[0-9]*)"

     

       147
       148
        
               "--override-filename"

     

       148
       148
       -
               "pkgs/by-name/ka/kanidm/${versionUnderscored}.nix"

     

       149
       149
       +
               "pkgs/by-name/ka/kanidm/${versionUnderscored finalAttrs}.nix"

     

       149
       150
        
             ];

     

       150
       151
        
           });

     

       151
       152
        
       

     

       152
       153
        
           inherit enableSecretProvisioning;

     

       153
       153
       -
           withSecretProvisioning = kanidm.override { enableSecretProvisioning = true; };

     

       154
       154
       +
           # Unfortunately there is no such thing as finalAttrs.finalPackage.override,

     

       155
       155
       +
           # so we have to resort to this.

     

       156
       156
       +
           withSecretProvisioning = kanidmWithSecretProvisioning;

     

       154
       157
        
       

     

       155
       158
        
           eolMessage = lib.optionalString (eolDate != null) ''

     

       156
       156
       -
             kanidm ${lib.versions.majorMinor version} is deprecated and will reach end-of-life on ${eolDate}

     

       159
       159
       +
             kanidm ${lib.versions.majorMinor finalAttrs.version} is deprecated and will reach end-of-life on ${eolDate}

     

       157
       160
        
       

     

       158
       161
        
             ${upgradeNote}

     

       159
       162
        
           '';

     
···

       163
       166
        
         requiredSystemFeatures = [ "big-parallel" ];

     

       164
       167
        
       

     

       165
       168
        
         meta = {

     

       166
       166
       -
           changelog = "https://github.com/kanidm/kanidm/releases/tag/v${version}";

     

       169
       169
       +
           changelog = "https://github.com/kanidm/kanidm/releases/tag/v${finalAttrs.version}";

     

       167
       170
        
           description = "Simple, secure and fast identity management platform";

     

       168
       171
        
           homepage = "https://github.com/kanidm/kanidm";

     

       169
       172
        
           license = lib.licenses.mpl20;

     
···

       174
       177
        
           ];

     

       175
       178
        
           knownVulnerabilities = lib.optionals unsupported [

     

       176
       179
        
             ''

     

       177
       177
       -
               kanidm ${lib.versions.majorMinor version} has reached end-of-life.

     

       180
       180
       +
               kanidm ${lib.versions.majorMinor finalAttrs.version} has reached end-of-life.

     

       178
       181
        
       

     

       179
       182
        
               ${upgradeNote}

     

       180
       183
        
             ''

+11 -14

pkgs/top-level/all-packages.nix

···

       10124
       10124
        
       

     

       10125
       10125
        
         jetty = jetty_12;

     

       10126
       10126
        
       

     

       10127
       10127
       -
         kanidm_1_5 = callPackage ../by-name/ka/kanidm/1_5.nix { kanidm = kanidm_1_5; };

     

       10128
       10128
       -
         kanidm_1_6 = callPackage ../by-name/ka/kanidm/1_6.nix { kanidm = kanidm_1_6; };

     

       10129
       10129
       -
         kanidm_1_7 = callPackage ../by-name/ka/kanidm/1_7.nix { kanidm = kanidm_1_7; };

     

       10130
       10130
       -
       

     

       10131
       10131
       -
         kanidmWithSecretProvisioning = kanidmWithSecretProvisioning_1_6;

     

       10132
       10132
       -
       

     

       10133
       10133
       -
         kanidmWithSecretProvisioning_1_5 = callPackage ../by-name/ka/kanidm/1_5.nix {

     

       10134
       10134
       -
           enableSecretProvisioning = true;

     

       10127
       10127
       +
         kanidm_1_5 = callPackage ../by-name/ka/kanidm/1_5.nix {

     

       10128
       10128
       +
           kanidmWithSecretProvisioning = kanidmWithSecretProvisioning_1_5;

     

       10129
       10129
       +
         };

     

       10130
       10130
       +
         kanidm_1_6 = callPackage ../by-name/ka/kanidm/1_6.nix {

     

       10131
       10131
       +
           kanidmWithSecretProvisioning = kanidmWithSecretProvisioning_1_6;

     

       10135
       10132
        
         };

     

       10136
       10136
       -
       

     

       10137
       10137
       -
         kanidmWithSecretProvisioning_1_6 = callPackage ../by-name/ka/kanidm/1_6.nix {

     

       10138
       10138
       -
           enableSecretProvisioning = true;

     

       10133
       10133
       +
         kanidm_1_7 = callPackage ../by-name/ka/kanidm/1_7.nix {

     

       10134
       10134
       +
           kanidmWithSecretProvisioning = kanidmWithSecretProvisioning_1_7;

     

       10139
       10135
        
         };

     

       10140
       10136
        
       

     

       10141
       10141
       -
         kanidmWithSecretProvisioning_1_7 = callPackage ../by-name/ka/kanidm/1_7.nix {

     

       10142
       10142
       -
           enableSecretProvisioning = true;

     

       10143
       10143
       -
         };

     

       10137
       10137
       +
         kanidmWithSecretProvisioning = kanidm.override { enableSecretProvisioning = true; };

     

       10138
       10138
       +
         kanidmWithSecretProvisioning_1_5 = kanidm_1_5.override { enableSecretProvisioning = true; };

     

       10139
       10139
       +
         kanidmWithSecretProvisioning_1_6 = kanidm_1_6.override { enableSecretProvisioning = true; };

     

       10140
       10140
       +
         kanidmWithSecretProvisioning_1_7 = kanidm_1_7.override { enableSecretProvisioning = true; };

     

       10144
       10141
        
       

     

       10145
       10142
        
         knot-resolver = callPackage ../servers/dns/knot-resolver {

     

       10146
       10143
        
           systemd = systemdMinimal; # in closure already anyway