rope/nixos
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

authelia: allow password reset writes

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
rope 2026-10-22 13:19:58 +01:00
parent c57ca59f25
commit 8fe9e98300
3 changed files with 46 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

19
services/authelia.nix
View file

@ -2,8 +2,9 @@
# Secrets live in /var/secrets/authelia (root:authelia-main, 640) — see readme.
#
# Users live in /var/lib/authelia-users so guildhall-join (services/
# guildhall-join.nix) can add invited players; Authelia only reads it and
# reloads on change. Groups decide reach: `household` gets the shared home
# guildhall-join.nix) can add invited players. Authelia reloads it on change
# and writes it back in place when someone resets their password, which only
# works for users with an `email` (the link lands in notification.txt). Groups decide reach: `household` gets the shared home
# sites, `guildhall` gets the game and nothing else.
{ config, lib, pkgs, ... }:
let
@ -13,7 +14,8 @@ let
usersFile = "${usersDir}/users_database.yml";
# One-time move out of Authelia's private state dir, then the same
# ownership on every start: guildhall-join writes, authelia-users reads.
# ownership on every start: guildhall-join appends, authelia-users reads and
# saves password resets.
prepareUsers = pkgs.writeShellScript "authelia-users-prepare" ''
set -eu
${pkgs.coreutils}/bin/install -d -m 0750 -o guildhall-join -g authelia-users ${usersDir}
@ -21,7 +23,7 @@ let
${pkgs.coreutils}/bin/cp /var/lib/authelia-main/users_database.yml ${usersFile}
fi
${pkgs.coreutils}/bin/chown guildhall-join:authelia-users ${usersFile}
${pkgs.coreutils}/bin/chmod 0640 ${usersFile}
${pkgs.coreutils}/bin/chmod 0660 ${usersFile}
'';
in
{
@ -94,7 +96,12 @@ in
};
};
# First, before the module's validate-config pre-start.
systemd.services.authelia-main.serviceConfig.ExecStartPre = lib.mkBefore [ "+${prepareUsers}" ];
systemd.services.authelia-main.serviceConfig = {
# First, before the module's validate-config pre-start.
ExecStartPre = lib.mkBefore [ "+${prepareUsers}" ];
# The directory, not the file: guildhall-join replaces the file, which
# would leave a file bind mount pointing at the old one.
ReadWritePaths = [ usersDir ];
};
};
}