movefasta/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-06-12 04:35:41 +03:00
Code Issues Projects Releases Packages Wiki Activity

nixos/mongodb: replace option initialRootPassword with initialRootPasswordFile

Browse source
This commit is contained in:
Niklas Korz 2025-01-21 14:47:51 +01:00
parent 3f8a2242b2
commit 2f8af3ea93
2 changed files with 18 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

23
nixos/modules/services/databases/mongodb.nix
View file

@ -27,6 +27,13 @@ let
in
{
imports = [
(lib.mkRemovedOptionModule [
"services"
"mongodb"
"initialRootPassword"
] "Use services.mongodb.initialRootPasswordFile to securely provide the initial root password.")
];
###### interface
@ -64,10 +71,10 @@ in
description = "Enable client authentication. Creates a default superuser with username root!";
};
initialRootPassword = lib.mkOption {
type = lib.types.nullOr lib.types.str;
initialRootPasswordFile = lib.mkOption {
type = lib.types.nullOr lib.types.path;
default = null;
description = "Password for the root user if auth is enabled.";
description = "Path to the file containing the password for the root user if auth is enabled.";
};
dbpath = lib.mkOption {
@ -116,8 +123,8 @@ in
config = lib.mkIf config.services.mongodb.enable {
assertions = [
{
assertion = !cfg.enableAuth || cfg.initialRootPassword != null;
message = "`enableAuth` requires `initialRootPassword` to be set.";
assertion = !cfg.enableAuth || cfg.initialRootPasswordFile != null;
message = "`enableAuth` requires `initialRootPasswordFile` to be set.";
}
];
@ -168,12 +175,13 @@ in
# wait for mongodb
while ! ${mongoshExe} --eval "db.version()" > /dev/null 2>&1; do sleep 0.1; done
initialRootPassword=$(<${cfg.initialRootPasswordFile})
${mongoshExe} <<EOF
use admin;
db.createUser(
{
user: "root",
pwd: "${cfg.initialRootPassword}",
pwd: "$initialRootPassword",
roles: [
{ role: "userAdminAnyDatabase", db: "admin" },
{ role: "dbAdminAnyDatabase", db: "admin" },
@ -189,7 +197,8 @@ in
postStart = ''
if test -e "${cfg.dbpath}/.first_startup"; then
${lib.optionalString (cfg.initialScript != null) ''
${mongoshExe} ${lib.optionalString (cfg.enableAuth) "-u root -p ${cfg.initialRootPassword}"} admin "${cfg.initialScript}"
initialRootPassword=$(<${cfg.initialRootPasswordFile})
${mongoshExe} ${lib.optionalString (cfg.enableAuth) "-u root -p $initialRootPassword"} admin "${cfg.initialScript}"
''}
rm -f "${cfg.dbpath}/.first_startup"
fi