b12f/nixpkgs
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

Merge pull request #182456 from mayflower/crowd-secrets

Browse source 
nixos/crowd: store openid password securely
This commit is contained in:
Maximilian Bosch 2022-07-25 12:02:57 +02:00 committed by GitHub
parent 785b28bee3 ee2413c326
commit f923f5b9aa
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 40 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

31
nixos/modules/services/web-apps/atlassian/crowd.nix
View file

@ -14,6 +14,21 @@ let
proxyUrl = "${cfg.proxy.scheme}://${cfg.proxy.name}:${toString cfg.proxy.port}";
});
crowdPropertiesFile = pkgs.writeText "crowd.properties" ''
application.name crowd-openid-server
application.password @NIXOS_CROWD_OPENID_PW@
application.base.url http://localhost:${toString cfg.listenPort}/openidserver
application.login.url http://localhost:${toString cfg.listenPort}/openidserver
application.login.url.template http://localhost:${toString cfg.listenPort}/openidserver?returnToUrl=''${RETURN_TO_URL}
crowd.server.url http://localhost:${toString cfg.listenPort}/crowd/services/
session.isauthenticated session.isauthenticated
session.tokenkey session.tokenkey
session.validationinterval 0
session.lastvalidation session.lastvalidation
'';
in
{
@ -53,9 +68,16 @@ in
openidPassword = mkOption {
type = types.str;
default = "WILL_NEVER_BE_SET";
description = "Application password for OpenID server.";
};
openidPasswordFile = mkOption {
type = types.nullOr types.str;
default = null;
description = "Path to the file containing the application password for OpenID server.";
};
catalinaOptions = mkOption {
type = types.listOf types.str;
default = [];
@ -140,6 +162,7 @@ in
JAVA_HOME = "${cfg.jrePackage}";
CATALINA_OPTS = concatStringsSep " " cfg.catalinaOptions;
CATALINA_TMPDIR = "/tmp";
JAVA_OPTS = mkIf (cfg.openidPasswordFile != null) "-Dcrowd.properties=${cfg.home}/crowd.properties";
};
preStart = ''
@ -151,6 +174,14 @@ in
-e 's,compression="on",compression="off" protocol="HTTP/1.1" proxyName="${cfg.proxy.name}" proxyPort="${toString cfg.proxy.port}" scheme="${cfg.proxy.scheme}" secure="${boolToString cfg.proxy.secure}",' \
'') + ''
${pkg}/apache-tomcat/conf/server.xml.dist > ${cfg.home}/server.xml
${optionalString (cfg.openidPasswordFile != null) ''
install -m660 ${crowdPropertiesFile} ${cfg.home}/crowd.properties
${pkgs.replace-secret}/bin/replace-secret \
'@NIXOS_CROWD_OPENID_PW@' \
${cfg.openidPasswordFile} \
${cfg.home}/crowd.properties
''}
'';
serviceConfig = {

11
pkgs/servers/atlassian/crowd.nix
View file

@ -1,7 +1,14 @@
{ lib, stdenv, fetchurl, home ? "/var/lib/crowd"
, port ? 8092, proxyUrl ? null, openidPassword ? "WILL_NEVER_BE_SET" }:
stdenv.mkDerivation rec {
let
optionalWarning = cond: msg:
if cond then lib.warn msg
else lib.id;
in
optionalWarning (openidPassword != "WILL_NEVER_BE_SET") "Using `crowdProperties` is deprecated!"
(stdenv.mkDerivation rec {
pname = "atlassian-crowd";
version = "5.0.1";
@ -46,4 +53,4 @@ stdenv.mkDerivation rec {
license = licenses.unfree;
maintainers = with maintainers; [ fpletz globin ];
};
}
})