feat(sssd): authenticate NixOS hosts against Authentik LDAP via agenix #55

2026-07-06T13:57:31+01:00

lyrathorpe commented

2026-07-06 13:57:31 +01:00

Add fleet-wide SSSD authentication against the Authentik LDAP outpost.

New modules/sssd.nix wires services.sssd to ldaps://ldap.lyrapup.pet:636 with the Authentik schema mappings (goauthentik.io/ldap/user|group over POSIX uid/uidNumber/gidNumber/homeDirectory). Exposed as services.authentikLdap.enable, default true, added to baseModules.
emmathorpe-edaas (WSL) opts out; the macOS host is untouched (SSSD is Linux-only). So it lands on lyrathorpe-mbp/-t400/-macpro31/-rpi5.
The LDAP bind credential is managed with agenix and delivered as an sssd.conf drop-in under /etc/sssd/conf.d/, keeping the password out of the Nix store. secrets/secrets.nix ships with PLACEHOLDER host recipients; secrets/README.md documents the owner workflow. The real secrets/ldap-bind.age is not committed (placeholder only).
README documents the setup.

Pairs with the Terraform LDAP-outpost PR (#178), which provisions the outpost and the sssd-bind service account.

⚠️ Owner steps before this deploys / evals cleanly:

nix flake lock --update-input agenix (adds agenix to flake.lock — this PR edits flake.nix only).
Put each SSSD host's /etc/ssh/ssh_host_ed25519_key.pub into secrets/secrets.nix recipients.
cd secrets && agenix -e ldap-bind.age with the sssd-bind password (= TF_VAR_authentik_sssd_bind_password); remove the .PLACEHOLDER.
DNS ldap.lyrapup.pet → docker host; then nixos-rebuild switch per host; verify getent passwd <user> / id <user>.

Note: commit authored via the API (unsigned) because nixfiles is read-only to the tooling here; re-sign on merge if desired. nix flake check will fail until steps 1–3 are done (missing agenix lock + the referenced .age).

Add fleet-wide SSSD authentication against the Authentik LDAP outpost. - New `modules/sssd.nix` wires `services.sssd` to `ldaps://ldap.lyrapup.pet:636` with the Authentik schema mappings (`goauthentik.io/ldap/user|group` over POSIX `uid`/`uidNumber`/`gidNumber`/`homeDirectory`). Exposed as `services.authentikLdap.enable`, default true, added to `baseModules`. - `emmathorpe-edaas` (WSL) opts out; the macOS host is untouched (SSSD is Linux-only). So it lands on `lyrathorpe-mbp/-t400/-macpro31/-rpi5`. - The LDAP bind credential is managed with **agenix** and delivered as an sssd.conf drop-in under `/etc/sssd/conf.d/`, keeping the password out of the Nix store. `secrets/secrets.nix` ships with PLACEHOLDER host recipients; `secrets/README.md` documents the owner workflow. The real `secrets/ldap-bind.age` is **not** committed (placeholder only). - README documents the setup. Pairs with the Terraform LDAP-outpost PR (#178), which provisions the outpost and the `sssd-bind` service account. ⚠️ **Owner steps before this deploys / evals cleanly:** 1. `nix flake lock --update-input agenix` (adds agenix to flake.lock — this PR edits flake.nix only). 2. Put each SSSD host's `/etc/ssh/ssh_host_ed25519_key.pub` into `secrets/secrets.nix` recipients. 3. `cd secrets && agenix -e ldap-bind.age` with the `sssd-bind` password (= `TF_VAR_authentik_sssd_bind_password`); remove the `.PLACEHOLDER`. 4. DNS `ldap.lyrapup.pet` → docker host; then `nixos-rebuild switch` per host; verify `getent passwd <user>` / `id <user>`. Note: commit authored via the API (unsigned) because nixfiles is read-only to the tooling here; re-sign on merge if desired. `nix flake check` will fail until steps 1–3 are done (missing agenix lock + the referenced `.age`).

lyrathorpe added 7 commits 2026-07-06 13:57:31 +01:00

feat(sssd): add agenix input and sssd module to baseModules 01bda7fe58

docs: document SSSD/Authentik directory auth and secrets b1447e6e30

feat(sssd): opt EDaaS out of SSSD 8f240c27ba

feat(sssd): SSSD LDAP auth against Authentik outpost bac9951995

feat(sssd): agenix recipients scaffold 2864ef0553

docs(secrets): agenix owner workflow 5fd42fbdcd

chore(secrets): placeholder for the LDAP bind secret

CI / flake (pull_request) Failing after 1m20s

Details

e5d6b5bc8d

lyrathorpe added 1 commit 2026-07-06 13:57:31 +01:00