nixos/nsswitch: Make databases more configurable #85998
Conversation
dasJ
force-pushed
the
make-nsswitch-more-flexible
branch
from
5b162a3
to
c0bffb2
Compare
| @@ -10,35 +10,44 @@ let | |||
| canLoadExternalModules = config.services.nscd.enable; | |||
| myhostname = canLoadExternalModules; | |||
| mymachines = canLoadExternalModules; | |||
| # XXX Move these to their respective modules | |||
There was a problem hiding this comment.
Could these also be moved into the individual modules?
We have a similar mess inside the pam module, and it'd be nice to clean all this up.
There was a problem hiding this comment.
Yeah, that's what I wanted to say
There was a problem hiding this comment.
Can you add a commit on top that does this, for some of the NSS modules?
I'd assume the systemd and oslogin nss modules should be a somewhat trivial example, and then we could create a follow-up ticket tracking the migration of the others.
There was a problem hiding this comment.
Just added the commit. I used sss instead, because it allows me to drop the servicesArray ;)
|
Ah example from my Samba DC config: {
system.nssDatabases = rec {
passwd = [ "winbind" ];
group = passwd;
};
}Results in |
nixos/modules/config/nsswitch.nix
Outdated
| ++ optional sssd "sss"; | ||
| hostArray = mkMerge [ | ||
| (mkBefore [ "files" ]) | ||
| (optional mymachines "mymachines") |
There was a problem hiding this comment.
Prefer mkIf over optional in NixOS modules
Instead of hardcoding all nss modules that are added into nsswitch, there are now options exposed. This allows users to add own nss modules (I had this issue with winbindd, for example). Also, nss modules could be moved to their NixOS modules which would make the nsswitch module slimmer. As the lists are now handled by the modules system, we can use mkOrder to ensure a proper order as well as mkForce to override one specific database type instead of the entire file.
dasJ
force-pushed
the
make-nsswitch-more-flexible
branch
from
c0bffb2
to
bc2a4b3
Compare
|
Thanks! |
Motivation for this change
Instead of hardcoding all nss modules that are added into nsswitch,
there are now options exposed.
This allows users to add own nss modules (I had this issue with
winbindd, for example).
Also, nss modules could be moved to their NixOS modules which would
make the nsswitch module slimmer.
As the lists are now handled by the modules system, we can use mkOrder
to ensure a proper order as well as mkForce to override one specific
database type instead of the entire file.
cc @infinisil to make sure I use
mk*correctlycc @LnL7 because you were the last to touch the file and I drop your option
Things done
sandboxinnix.confon non-NixOS linux)nix-shell -p nixpkgs-review --run "nixpkgs-review wip"./result/bin/)nix path-info -Sbefore and after)