Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

net-nds/kanidm: new package, add 1.2.0 #177

Draft
wants to merge 3 commits into
base: dev
Choose a base branch
from
Draft
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions acct-group/kanidm/kanidm-0.ebuild
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
# Copyright 2024 Gentoo Authors
# Distributed under the terms of the GNU General Public License v2

EAPI=8

inherit acct-group

ACCT_GROUP_ID=-1
8 changes: 8 additions & 0 deletions acct-group/kanidm/metadata.xml
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
<pkgmetadata>
<maintainer type="person">
<email>[email protected]</email>
<name>Anna</name>
</maintainer>
</pkgmetadata>
11 changes: 11 additions & 0 deletions acct-user/kanidm/kanidm-0.ebuild
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
# Copyright 2024 Gentoo Authors
# Distributed under the terms of the GNU General Public License v2

EAPI=8

inherit acct-user

ACCT_USER_ID=-1
ACCT_USER_GROUPS=( kanidm ldap tss )

acct-user_add_deps
8 changes: 8 additions & 0 deletions acct-user/kanidm/metadata.xml
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
<pkgmetadata>
<maintainer type="person">
<email>[email protected]</email>
<name>Anna</name>
</maintainer>
</pkgmetadata>
606 changes: 606 additions & 0 deletions net-nds/kanidm/Manifest

Large diffs are not rendered by default.

28 changes: 28 additions & 0 deletions net-nds/kanidm/files/kanidm-ipa-sync.service
Original file line number Diff line number Diff line change
@@ -0,0 +1,28 @@
[Unit]
Description=Kanidm IPA Sync Service
After=time-sync.target network-online.target
Wants=time-sync.target network-online.target

[Service]
Type=exec
LoadCredential=config:/etc/kanidm/kanidm-ipa-sync
Environment=KANIDM_IPA_SYNC_CONFIG=%d/config
ExecStart=/usr/sbin/kanidm-ipa-sync --schedule
User=kanidm

AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE

NoNewPrivileges=true
PrivateTmp=true
PrivateDevices=true
ProtectHostname=true
ProtectClock=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectControlGroups=true
MemoryDenyWriteExecute=true

[Install]
WantedBy=multi-user.target
14 changes: 14 additions & 0 deletions net-nds/kanidm/files/kanidm-unixd-tasks.initd
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
#!/sbin/openrc-run
# Copyright 2024 Gentoo Authors
# Distributed under the terms of the GNU General Public License v2

# shellcheck shell=sh

command="/usr/sbin/kanidm_unixd_tasks"
command_background=1
pidfile="/var/run/kanidm/${RC_SVCNAME}.pid"

depend() {
need kanidm-unixd net
use ntp-client ntpd
}
27 changes: 27 additions & 0 deletions net-nds/kanidm/files/kanidm-unixd-tasks.service
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
[Unit]
Description=Kanidm Local Tasks
After=chronyd.service ntpd.service network-online.target kanidm-unixd.service
Requires=kanidm-unixd.service

[Service]
Type=notify
ExecStart=/usr/sbin/kanidm_unixd_tasks
User=root

CapabilityBoundingSet=CAP_CHOWN CAP_FOWNER CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH
# SystemCallFilter=@aio @basic-io @chown @file-system @io-event @network-io @sync
RestrictAddressFamilies=AF_UNIX
NoNewPrivileges=true
PrivateTmp=true
PrivateDevices=true
PrivateNetwork=true
ProtectHostname=true
ProtectClock=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectControlGroups=true
MemoryDenyWriteExecute=true

[Install]
WantedBy=multi-user.target
20 changes: 20 additions & 0 deletions net-nds/kanidm/files/kanidm-unixd.initd
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
#!/sbin/openrc-run
# Copyright 2024 Gentoo Authors
# Distributed under the terms of the GNU General Public License v2

# shellcheck shell=sh

command="/usr/sbin/kanidm_unixd"
command_user="kanidm:kanidm"
command_background=1
pidfile="/var/run/kanidm/${RC_SVCNAME}.pid"

depend() {
need net nscd
use ntp-client ntpd
before sshd
}

start_pre() {
checkpath -do kanidm:kanidm /var/run/kanidm
}
40 changes: 40 additions & 0 deletions net-nds/kanidm/files/kanidm-unixd.service
Original file line number Diff line number Diff line change
@@ -0,0 +1,40 @@
[Unit]
Description=Kanidm Local Client Resolver
After=chronyd.service nscd.service ntpd.service network-online.target
Before=systemd-user-sessions.service sshd.service nss-user-lookup.target
Wants=nss-user-lookup.target
# While it seems confusing, we need to be after nscd.service so that the
# Conflicts will triger and then automatically stop it.
Conflicts=nscd.service

[Service]
Type=notify
CacheDirectory=kanidm-unixd
RuntimeDirectory=kanidm-unixd
StateDirectory=kanidm-unixd
UMask=0027
ExecStart=/usr/sbin/kanidm_unixd
User=kanidm

## If you wish to setup an external HSM pin you should set:
# LoadCredential=hsmpin:/etc/kanidm/kanidm-unixd-hsm-pin
# Environment=KANIDM_HSM_PIN_PATH=%d/hsmpin

# SystemCallFilter=@aio @basic-io @chown @file-system @io-event @network-io @sync
NoNewPrivileges=true
PrivateTmp=true
# We have to disable this to allow tpmrm0 access for tpm binding.
PrivateDevices=false
# Older versions of systemd require this to be explicitly allowed.
DeviceAllow=/dev/tpmrm0 rw

ProtectHostname=true
ProtectClock=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectControlGroups=true
MemoryDenyWriteExecute=true

[Install]
WantedBy=multi-user.target
2 changes: 2 additions & 0 deletions net-nds/kanidm/files/kanidmd.confd
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
# Configuration file
#KANIDMD_CONFIGFILE="/etc/kanidm/server.toml"
42 changes: 42 additions & 0 deletions net-nds/kanidm/files/kanidmd.initd
Original file line number Diff line number Diff line change
@@ -0,0 +1,42 @@
#!/sbin/openrc-run
# Copyright 2024 Gentoo Authors
# Distributed under the terms of the GNU General Public License v2

# shellcheck shell=sh

extra_commands="configtest"
description_configtest="Run kanidm's internal config check."

: "${KANIDMD_CONFIGFILE:=/etc/kanidm/server.toml}"

command="/usr/sbin/kanidmd"
command_args="server -c \"${KANIDMD_CONFIGFILE}\""
command_user="kanidm:kanidm"
command_background=1
pidfile="/var/run/kanidm/${RC_SVCNAME}.pid"

depend() {
need net
use dns
}

start_pre() {
if [ "${RC_CMD}" != "restart" ]; then
configtest || return 1
fi

checkpath -do kanidm:kanidm /var/run/kanidm
}

stop_pre() {
if [ "${RC_CMD}" = "restart" ]; then
configtest || return 1
fi
}

configtest() {
ebegin "Checking kanidm's configuration"
${command} configtest -c "${KANIDMD_CONFIGFILE}"

eend $? "failed, please correct errors in the config file"
}
33 changes: 33 additions & 0 deletions net-nds/kanidm/files/kanidmd.service
Original file line number Diff line number Diff line change
@@ -0,0 +1,33 @@
[Unit]
Description=Kanidm Identity Server
After=time-sync.target network-online.target
Wants=time-sync.target network-online.target
Before=radiusd.service

[Service]
Type=notify
StateDirectory=kanidm
StateDirectoryMode=0750
CacheDirectory=kanidmd
CacheDirectoryMode=0750
RuntimeDirectory=kanidmd
RuntimeDirectoryMode=0755
ExecStart=/usr/sbin/kanidmd server -c /etc/kanidm/server.toml
User=kanidm

AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE

NoNewPrivileges=true
PrivateTmp=true
PrivateDevices=true
ProtectHostname=true
ProtectClock=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectControlGroups=true
MemoryDenyWriteExecute=true

[Install]
WantedBy=multi-user.target
Loading