chore(secrets): placeholder for the LDAP bind secret

README.md

@@ -52,6 +52,33 @@ The home config is also exposed for use beyond these hosts:
   (`inputs.<this>.homeModules.default`). Consumers must supply the module args
   these expect: `inputs` always, `identity` for git/desktop, `portable` for sway.
 
+## Directory authentication (SSSD → Authentik LDAP)
+
+Every NixOS host authenticates users against the Authentik LDAP outpost via
+SSSD, implemented in [`modules/sssd.nix`](./modules/sssd.nix) and enabled by
+default through the `services.authentikLdap.enable` option (added to
+`baseModules`). The **EDaaS** WSL box opts out
+(`services.authentikLdap.enable = false`) as a work-managed environment; the
+macOS host is unaffected (SSSD is Linux-only).
+
+- Connects over LDAPS to `ldap.lyrapup.pet:636`, search base
+  `dc=ldap,dc=goauthentik,dc=io`, binding as
+  `cn=sssd-bind,ou=users,dc=ldap,dc=goauthentik,dc=io`.
+- The schema mappings match Authentik's non-standard object classes
+  (`goauthentik.io/ldap/user`, `goauthentik.io/ldap/group`) over the POSIX
+  attributes (`uid`, `uidNumber`, `gidNumber`, `homeDirectory`).
+- Home directories are created on first login (`pam_mkhomedir`).
+
+### Secrets (agenix)
+
+The LDAP bind credential is an [agenix](https://github.com/ryantm/agenix)
+secret, decrypted at activation with each host's SSH host key. The decrypted
+plaintext is a full `sssd.conf` drop-in delivered to
+`/etc/sssd/conf.d/01-ldap-authtok.conf`, so the password never enters the Nix
+store. Owner setup (host recipient keys, encrypting the bind password, DNS for
+`ldap.lyrapup.pet`, rebuild) is documented in
+[`secrets/README.md`](./secrets/README.md).
+
 ## Applying
 
 ```sh

flake.lock

@@ -25,11 +25,11 @@
       },
       "locked": {
         "dir": "pkgs/firefox-addons",
-        "lastModified": 1782619356,
-        "narHash": "sha256-sde3f0uM5mEUwl6Bxom69P+9KOdpJ9YnSj0umSB2qdQ=",
+        "lastModified": 1782014564,
+        "narHash": "sha256-F/royQHyJAyKWKrV8AaG4Yf1yjzxa+PFk5xvTdvBrzk=",
         "owner": "rycee",
         "repo": "nur-expressions",
-        "rev": "9ad2019bb522c7eeecd9e3e2d18dd681f697f4d0",
+        "rev": "d6668e34bbce788459883a1097bf0ee170f49c61",
         "type": "gitlab"
       },
       "original": {
@@ -177,11 +177,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1782704057,
-        "narHash": "sha256-G1I1gd32F7mp9LAe1DaZ4ZL7NX5gyiKwdCMwro1Vrck=",
+        "lastModified": 1781981105,
+        "narHash": "sha256-/1nNBbA7PrSQpTc9Qazkhl4kIPg+TNl0CjxS3UQJKlw=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "868d0a692de703c2de98fab61968e4e310b7c28e",
+        "rev": "7bfff44b465909f69a442701293bc0badcf476dc",
         "type": "github"
       },
       "original": {
@@ -253,11 +253,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1782636943,
-        "narHash": "sha256-ripjZa7BBLwL1uS5VJF3s/VpZpWt5ZIQEvkJ/FJNpQw=",
+        "lastModified": 1782030356,
+        "narHash": "sha256-h4WpMr455AfRub0FXBaon6Vcpe0waUyJ4GivIW6oyd4=",
         "owner": "nix-community",
         "repo": "nix-index-database",
-        "rev": "058b1f9381fa79fcda49982370a750ff92dbba43",
+        "rev": "3017088b49efd404f78e3b104f553b97e4af786b",
         "type": "github"
       },
       "original": {
@@ -274,11 +274,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1782734462,
-        "narHash": "sha256-0HguXu/4KDgCL1mehqwhQXD96hbR85HS+o0zh73E8AQ=",
+        "lastModified": 1781520503,
+        "narHash": "sha256-XuqQQG1qRyc3o8ld937sDLQNx+QrGV852KJ0dNglJDg=",
         "owner": "nix-community",
         "repo": "nixos-apple-silicon",
-        "rev": "12e3b92363d21fcc550b500370d73a0747484e43",
+        "rev": "43043ad207529650f9fa68e1705f7cf9c08bfdeb",
         "type": "github"
       },
       "original": {
@@ -294,11 +294,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1782562157,
-        "narHash": "sha256-a7+T6QSeowynwZ1ZJJbP8T8ntAytvrui8kFGJmIZt2c=",
+        "lastModified": 1781622756,
+        "narHash": "sha256-JrPh4M6S7aPsEE9tOENuZrxC6o2szSLlK+t4+nLke9s=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "a9cf7546a938c737b079e738de73934a13de9784",
+        "rev": "08018c72174a4df5657f8d94178ac69fb9c243e5",
         "type": "github"
       },
       "original": {
@@ -330,11 +330,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1782535326,
-        "narHash": "sha256-ZeRxu4yn6shd3SNF5ZUQb4r7BaVo1zBKMjRhfoNSBmw=",
+        "lastModified": 1781216227,
+        "narHash": "sha256-9mUW6gNwoN2SWc/l0fW4svPNOulXLl8ijqKyeSOGgJE=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "714a5f8c4ead6b31148d829288440ed033ccc041",
+        "rev": "a0374025a863d007d98e3297f6aa46cc3141c2f0",
         "type": "github"
       },
       "original": {
@@ -346,11 +346,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1782467914,
-        "narHash": "sha256-pGvFkM8N0xEkIIXDe5YYfbEAvHrk4IxBrjB/x8OomhE=",
+        "lastModified": 1781577229,
+        "narHash": "sha256-lrp67w8AulE9Ks53n27I45ADSzbOCn4H+CNW1Ck8B+8=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "e73de5be04e0eff4190a1432b946d469c794e7b4",
+        "rev": "567a49d1913ce81ac6e9582e3553dd90a955875f",
         "type": "github"
       },
       "original": {

flake.nix

@@ -46,6 +46,15 @@
       url = "github:cachix/git-hooks.nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    # agenix: age-encrypted secrets, decrypted at activation with each host's
+    # SSH host key. Provides the SSSD LDAP bind credential (secrets/, see
+    # modules/sssd.nix). The darwin module is intentionally unused (SSSD is
+    # Linux-only).
+    agenix = {
+      url = "github:ryantm/agenix";
+      inputs.nixpkgs.follows = "nixpkgs";
+      inputs.home-manager.follows = "home-manager";
+    };
     # Declarative Neovim (the editor; see home/editor.nix). Release
     # branch matched to the pinned nixpkgs (26.05); follows our nixpkgs to keep a
     # single nixpkgs in the closure. editor.nix sets programs.nixvim.nixpkgs.source
@@ -123,7 +132,9 @@
           ./modules/users.nix
           ./modules/common-nixos.nix
           ./modules/features.nix
+          ./modules/sssd.nix
           commonModule
+          inputs.agenix.nixosModules.default
           home-manager.nixosModules.home-manager
           {
             home-manager.useGlobalPkgs = true;

hosts/EDaaS/configuration.nix

@@ -62,6 +62,11 @@
 
   features.swayDesktop.enable = false;
 
+  # Opt out of fleet-wide SSSD/Authentik LDAP auth: this is a work-managed WSL
+  # box, not part of the personal directory. Every other NixOS host inherits the
+  # default-true from modules/sssd.nix.
+  services.authentikLdap.enable = false;
+
   # NOTE: this user's systemd --user lingering -- so the home-manager renovate
   # timer fires without an open login session -- is enabled from the host table
   # in flake.nix (users.emmathorpe.linger = true) and applied by

modules/sssd.nix

@@ -0,0 +1,130 @@
+# Authentik LDAP authentication for NixOS hosts.
+#
+# Wires SSSD (System Security Services Daemon) to the Authentik LDAP outpost so
+# every Linux host authenticates users against the same directory that backs the
+# SSO stack. Enabled by default on every NixOS host via baseModules; the EDaaS
+# WSL box opts out (services.authentikLdap.enable = false) because it is a
+# work-managed Windows-hosted environment.
+#
+# The Authentik LDAP provider exposes NON-standard object classes/attributes
+# (goauthentik.io/ldap/user, goauthentik.io/ldap/group) alongside the POSIX
+# attributes (uid, uidNumber, gidNumber, homeDirectory), so the schema mappings
+# below are explicit rather than relying on an RFC2307 default.
+#
+# The bind password is NOT inlined: services.sssd.config renders to the world-
+# readable Nix store, so the credential is delivered out-of-band by agenix as an
+# sssd.conf drop-in under /etc/sssd/conf.d/ (SSSD merges conf.d/*.conf after the
+# main file). See secrets/README.md.
+{
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.services.authentikLdap;
+
+  # Directory coordinates for the Authentik LDAP provider.
+  ldapUri = "ldaps://ldap.lyrapup.pet:636";
+  searchBase = "dc=ldap,dc=goauthentik,dc=io";
+  bindDn = "cn=sssd-bind,ou=users,dc=ldap,dc=goauthentik,dc=io";
+in
+{
+  options.services.authentikLdap.enable =
+    lib.mkEnableOption "SSSD authentication against the Authentik LDAP outpost"
+    // {
+      default = true;
+    };
+
+  config = lib.mkIf cfg.enable {
+    services.sssd = {
+      enable = true;
+
+      # Non-secret sssd.conf. The bind password is injected separately via the
+      # agenix conf.d drop-in (ldap_default_authtok lives there, not here) to
+      # keep it out of the Nix store.
+      config = ''
+        [sssd]
+        config_file_version = 2
+        services = nss, pam
+        domains = default
+
+        [nss]
+        # Do not walk the whole directory for `getent passwd` etc.
+        filter_users = root
+        filter_groups = root
+
+        [pam]
+
+        [domain/default]
+        # --- Providers --------------------------------------------------------
+        id_provider = ldap
+        auth_provider = ldap
+        chpass_provider = none
+        access_provider = permit
+
+        # --- Connection -------------------------------------------------------
+        ldap_uri = ${ldapUri}
+        ldap_search_base = ${searchBase}
+        ldap_default_bind_dn = ${bindDn}
+        ldap_default_authtok_type = password
+        # ldap_default_authtok is supplied by the agenix drop-in in conf.d.
+
+        # --- TLS (LDAPS on 636; no StartTLS) ---------------------------------
+        ldap_id_use_start_tls = false
+        ldap_tls_reqcert = demand
+
+        # --- Schema: Authentik LDAP provider ---------------------------------
+        # Authentik returns DN-valued group membership (member/memberOf), so
+        # rfc2307bis (not rfc2307) is the correct base schema.
+        ldap_schema = rfc2307bis
+
+        # Users: goauthentik.io/ldap/user, keyed by uid; POSIX attrs are
+        # standard names (uidNumber/gidNumber/homeDirectory).
+        ldap_user_object_class = goauthentik.io/ldap/user
+        ldap_user_name = uid
+        ldap_user_uid_number = uidNumber
+        ldap_user_gid_number = gidNumber
+        ldap_user_home_directory = homeDirectory
+        ldap_user_gecos = displayName
+        ldap_user_shell = loginShell
+
+        # Groups: goauthentik.io/ldap/group, keyed by cn.
+        ldap_group_object_class = goauthentik.io/ldap/group
+        ldap_group_name = cn
+        ldap_group_gid_number = gidNumber
+        ldap_group_member = member
+
+        # --- Behaviour --------------------------------------------------------
+        cache_credentials = true
+        enumerate = false
+      '';
+    };
+
+    # agenix delivers the bind password as an sssd.conf drop-in. The decrypted
+    # plaintext IS a valid conf.d snippet:
+    #
+    #   [domain/default]
+    #   ldap_default_authtok = <the bind password>
+    #
+    # SSSD requires conf.d files to be root-owned and 0600 or it ignores them.
+    age.secrets.ldap-bind = {
+      file = ../secrets/ldap-bind.age;
+      path = "/etc/sssd/conf.d/01-ldap-authtok.conf";
+      owner = "root";
+      group = "root";
+      mode = "0600";
+    };
+
+    # Restart SSSD when the credential drop-in changes. agenix writes secrets in
+    # a system activation script that runs before systemd (re)starts services on
+    # a `switch`, so the file is present by the time sssd starts; the trigger
+    # picks up rotations of the bind password.
+    systemd.services.sssd.restartTriggers = [ config.age.secrets.ldap-bind.path ];
+
+    # Create home directories on first login for LDAP users (they have no
+    # locally-provisioned home). NixOS wires nss + the SSSD PAM stack when
+    # services.sssd.enable is true; mkHomeDir adds pam_mkhomedir to it.
+    security.pam.services.login.makeHomeDir = true;
+    security.pam.services.sshd.makeHomeDir = true;
+  };
+}

secrets/README.md

@@ -0,0 +1,92 @@
+# Secrets (agenix)
+
+Encrypted secrets for the fleet, managed with [agenix](https://github.com/ryantm/agenix).
+
+Each secret is an age-encrypted file (`*.age`) encrypted to a set of recipient
+public keys declared in [`secrets.nix`](./secrets.nix). A host decrypts its
+secrets at activation using its SSH **host** key
+(`/etc/ssh/ssh_host_ed25519_key`), so every host that must read a secret has to
+be listed as a recipient for it.
+
+`secrets.nix` is read only by the `agenix` CLI. It is never imported into the
+NixOS evaluation.
+
+## Secrets in this repo
+
+| File            | Purpose                                                                 | Recipients                          |
+| --------------- | ----------------------------------------------------------------------- | ----------------------------------- |
+| `ldap-bind.age` | SSSD → Authentik LDAP bind credential, as an `sssd.conf` drop-in snippet | all SSSD-enabled hosts (not EDaaS)  |
+
+Consumed by [`modules/sssd.nix`](../modules/sssd.nix) via
+`age.secrets.ldap-bind.path`, which places the decrypted snippet at
+`/etc/sssd/conf.d/01-ldap-authtok.conf`.
+
+> **`ldap-bind.age` is not committed yet.** Only `ldap-bind.age.PLACEHOLDER`
+> ships in this change (real host recipient keys and the real password were not
+> available when it was written). Follow the steps below to create the real
+> secret, then delete the `.PLACEHOLDER`.
+
+## Owner setup checklist
+
+Run these once (per new host or when the bind password rotates):
+
+### 1. Collect host recipient keys
+
+On each SSSD-enabled host (all Linux hosts **except** EDaaS):
+
+```sh
+cat /etc/ssh/ssh_host_ed25519_key.pub
+```
+
+Paste each value into the matching placeholder in `secrets.nix`, replacing the
+`AAAA_PLACEHOLDER_REPLACE_ME_*` strings. (Optionally uncomment and set `admin`
+to an operator user key so the secret can be edited off-host.)
+
+### 2. Encrypt the bind password
+
+The plaintext must be a **full sssd.conf drop-in snippet**, because SSSD cannot
+read `ldap_default_authtok` from a separate file — it only merges `conf.d/*.conf`.
+The content is exactly:
+
+```ini
+[domain/default]
+ldap_default_authtok = <the sssd-bind service-account password>
+```
+
+Use the password of the `sssd-bind` (Terraform: `sssd-bind`) Authentik LDAP
+service account. Then, from the repo root:
+
+```sh
+# Requires the agenix CLI: `nix run github:ryantm/agenix -- -e secrets/ldap-bind.age`
+cd secrets
+agenix -e ldap-bind.age
+```
+
+An `$EDITOR` opens; paste the two-line snippet above, save, quit. agenix writes
+the encrypted `ldap-bind.age`. Commit it and delete `ldap-bind.age.PLACEHOLDER`.
+
+### 3. Rekey after changing recipients
+
+If you add/remove hosts in `secrets.nix`, re-encrypt every secret to the new
+recipient set:
+
+```sh
+cd secrets
+agenix -r
+```
+
+### 4. DNS
+
+`ldap.lyrapup.pet` must resolve to the Authentik LDAP outpost and serve LDAPS on
+port 636 with a certificate the hosts trust (`ldap_tls_reqcert = demand`). If the
+cert is not from a system-trusted CA, add it to the hosts' trust store
+(`security.pki.certificateFiles`) or relax `ldap_tls_reqcert` in
+`modules/sssd.nix`.
+
+### 5. Rebuild
+
+```sh
+sudo nixos-rebuild switch --flake .#<host>
+```
+
+Verify with `getent passwd <ldap-user>` and `id <ldap-user>`.

secrets/ldap-bind.age.PLACEHOLDER

@@ -0,0 +1,21 @@
+THIS IS A PLACEHOLDER, NOT A REAL AGE SECRET.
+
+The real secrets/ldap-bind.age is produced by the repo owner with `agenix -e`
+(see secrets/README.md) and is a binary age-encrypted blob. It is intentionally
+NOT committed here because:
+  * the real host age recipients are not available to the author of this change
+    (they are each host's /etc/ssh/ssh_host_ed25519_key.pub), and
+  * fabricating an encrypted blob or fake host keys would be misleading.
+
+Committing this file as `ldap-bind.age` would let modules/sssd.nix reference
+`../secrets/ldap-bind.age` and evaluate, but SSSD would fail to decrypt it at
+runtime. Do ONE of the following before deploying:
+
+  1. Preferred: generate the real secret (secrets/README.md), commit it as
+     secrets/ldap-bind.age, and delete this .PLACEHOLDER file.
+
+The decrypted plaintext must be a valid sssd.conf drop-in (NOT the bare
+password):
+
+    [domain/default]
+    ldap_default_authtok = <the sssd-bind service-account password>

secrets/secrets.nix

@@ -0,0 +1,15 @@
+let
+  lyrathorpe-mbp = "ssh-ed25519 AAAA_PLACEHOLDER_REPLACE_ME_mbp";
+  lyrathorpe-t400 = "ssh-ed25519 AAAA_PLACEHOLDER_REPLACE_ME_t400";
+  lyrathorpe-macpro31 = "ssh-ed25519 AAAA_PLACEHOLDER_REPLACE_ME_macpro31";
+  lyrathorpe-rpi5 = "ssh-ed25519 AAAA_PLACEHOLDER_REPLACE_ME_rpi5";
+  sssdHosts = [
+    lyrathorpe-mbp
+    lyrathorpe-t400
+    lyrathorpe-macpro31
+    lyrathorpe-rpi5
+  ];
+in
+{
+  "ldap-bind.age".publicKeys = sssdHosts;
+}