gwg313/nixos-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

lots of stuff

Browse source 
Signed-off-by: gwg313 <gwg313@pm.me>
This commit is contained in:
gwg313 2025-06-30 18:13:14 -04:00
parent cf1df09a9e
commit 58f06d6729
Signed by: gwg313
GPG key ID: 60FF63B4826B7400
55 changed files with 2154 additions and 584 deletions
Download patch file Download diff file Expand all files Collapse all files

69
hosts/kerby/kerberos.nix Normal file
View file

@ -0,0 +1,69 @@
{
config,
lib,
pkgs,
...
}:
{
services.krb5kdc = {
enable = true;
realms = {
"EXAMPLE.LOCAL" = {
aclFile = "/etc/krb5kdc/kadm5.acl";
dictFile = "/etc/krb5kdc/kadm5.dict";
databaseName = "/var/lib/krb5kdc/principal";
adminServer = "kerberos.example.local";
supportedEnctypes = [ "aes256-cts-hmac-sha1-96" ];
};
};
};
services.kadmind.enable = true;
services.krb5 = {
enable = true;
libdefaults = {
default_realm = "EXAMPLE.LOCAL";
};
realms = {
"EXAMPLE.LOCAL" = {
kdc = [ "kerberos.example.local" ];
admin_server = "kerberos.example.local";
};
};
};
environment.etc."krb5kdc/kadm5.acl".text = "*/admin@EXAMPLE.LOCAL *";
sops.secrets."kdc/master_password" = { };
sops.secrets."kdc/admin_password" = { };
systemd.services.krb5-bootstrap = {
description = "Bootstrap KDC DB + principals";
wantedBy = [ "multi-user.target" ];
before = [ "krb5kdc.service" ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
};
script = ''
set -e
DB="/var/lib/krb5kdc/principal"
if [ ! -f "$DB" ]; then
MASTER_PW=$(<${config.sops.secrets."kdc/master_password".path})
ADMIN_PW=$(<${config.sops.secrets."kdc/admin_password".path})
echo "Creating KDC database..."
echo "$MASTER_PW" | kdb5_util create -s -P "$MASTER_PW"
echo "$ADMIN_PW
$ADMIN_PW" | kadmin.local -q "addprinc root/admin"
kadmin.local -q "addprinc -randkey nfs/truenas.example.local"
kadmin.local -q "ktadd -k /etc/krb5kdc/nfs.keytab nfs/truenas.example.local"
fi
'';
};
environment.etc."krb5kdc/nfs.keytab".source = "/etc/krb5kdc/nfs.keytab";
}