movefasta/nixpkgs
0
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-07-14 06:00:33 +03:00
Code Activity

Merge pull request #182456 from mayflower/crowd-secrets

Browse source 
nixos/crowd: store openid password securely
This commit is contained in:
Maximilian Bosch 2022-07-25 12:02:57 +02:00 • committed by GitHub
commit f923f5b9aa
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 40 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

31
nixos/modules/services/web-apps/atlassian/crowd.nix
View file

@ -14,6 +14,21 @@ let
proxyUrl = "${cfg.proxy.scheme}://${cfg.proxy.name}:${toString cfg.proxy.port}";
});
crowdPropertiesFile = pkgs.writeText "crowd.properties" ''
application.name crowd-openid-server
application.password @NIXOS_CROWD_OPENID_PW@
application.base.url http://localhost:${toString cfg.listenPort}/openidserver
application.login.url http://localhost:${toString cfg.listenPort}/openidserver
application.login.url.template http://localhost:${toString cfg.listenPort}/openidserver?returnToUrl=''${RETURN_TO_URL}
crowd.server.url http://localhost:${toString cfg.listenPort}/crowd/services/
session.isauthenticated session.isauthenticated
session.tokenkey session.tokenkey
session.validationinterval 0
session.lastvalidation session.lastvalidation
'';
in
{
@ -53,9 +68,16 @@ in
openidPassword = mkOption {
type = types.str;
default = "WILL_NEVER_BE_SET";
description = "Application password for OpenID server.";
};
openidPasswordFile = mkOption {
type = types.nullOr types.str;
default = null;
description = "Path to the file containing the application password for OpenID server.";
};
catalinaOptions = mkOption {
type = types.listOf types.str;
default = [];
@ -140,6 +162,7 @@ in
JAVA_HOME = "${cfg.jrePackage}";
CATALINA_OPTS = concatStringsSep " " cfg.catalinaOptions;
CATALINA_TMPDIR = "/tmp";
JAVA_OPTS = mkIf (cfg.openidPasswordFile != null) "-Dcrowd.properties=${cfg.home}/crowd.properties";
};
preStart = ''
@ -151,6 +174,14 @@ in
-e 's,compression="on",compression="off" protocol="HTTP/1.1" proxyName="${cfg.proxy.name}" proxyPort="${toString cfg.proxy.port}" scheme="${cfg.proxy.scheme}" secure="${boolToString cfg.proxy.secure}",' \
'') + ''
${pkg}/apache-tomcat/conf/server.xml.dist > ${cfg.home}/server.xml
${optionalString (cfg.openidPasswordFile != null) ''
install -m660 ${crowdPropertiesFile} ${cfg.home}/crowd.properties
${pkgs.replace-secret}/bin/replace-secret \
'@NIXOS_CROWD_OPENID_PW@' \
${cfg.openidPasswordFile} \
${cfg.home}/crowd.properties
''}
'';
serviceConfig = {