colin/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos/kanidm: declare online_backup options

Browse Source
This commit is contained in:
h7x4 2024-01-08 18:07:42 +01:00
parent 521b5b3e67
commit d167743c72
No known key found for this signature in database
GPG Key ID: 9F2F7D8250F35146
1 changed files with 32 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
nixos/modules/services/security/kanidm.nix
View File

@ -132,6 +132,28 @@ in
default = "WriteReplica";
type = lib.types.enum [ "WriteReplica" "WriteReplicaNoUI" "ReadOnlyReplica" ];
};
online_backup = {
path = lib.mkOption {
description = lib.mdDoc "Path to the output directory for backups.";
type = lib.types.path;
default = "/var/lib/kanidm/backups";
};
schedule = lib.mkOption {
description = lib.mdDoc "The schedule for backups in cron format.";
type = lib.types.str;
default = "00 22 * * *";
};
versions = lib.mkOption {
description = lib.mdDoc ''
Number of backups to keep.
The default is set to `0`, in order to disable backups by default.
'';
type = lib.types.ints.unsigned;
default = 0;
example = 7;
};
};
};
};
default = { };
@ -226,6 +248,14 @@ in
environment.systemPackages = lib.mkIf cfg.enableClient [ cfg.package ];
systemd.tmpfiles.settings."10-kanidm" = {
${cfg.serverSettings.online_backup.path}.d = {
mode = "0700";
user = "kanidm";
group = "kanidm";
};
};
systemd.services.kanidm = lib.mkIf cfg.enableServer {
description = "kanidm identity management daemon";
wantedBy = [ "multi-user.target" ];
@ -246,6 +276,8 @@ in
BindPaths = [
# To create the socket
"/run/kanidmd:/run/kanidmd"
# To store backups
cfg.serverSettings.online_backup.path
];
AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];