Jan/nixos-config
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Move request-key configuration

Browse Source
This commit is contained in:
Jan-Bulthuis 2025-06-09 15:00:44 +02:00
parent 2fec5ead38
commit 537e30a347
1 changed files with 16 additions and 30 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

46
hosts/vm-oddjob/configuration.nix
View File

@ -19,39 +19,25 @@
};
# Setup NAS backups
environment.etc."request-key.conf".text =
let
upcall = "${pkgs.cifs-utils}/bin/cifs.upcall";
keyctl = "${pkgs.keyutils}/bin/keyctl";
in
''
#OP TYPE DESCRIPTION CALLOUT_INFO PROGRAM
# -t is required for DFS share servers...
create cifs.spnego * * ${upcall} -t %k
create dns_resolver * * ${upcall} %k
# Everything below this is essentially the
# defualt configuration
create user debug:* negate ${keyctl} negate %k 30 %S
create user debug:* rejected ${keyctl} reject %k 30 %c %S
create user debug:* expired ${keyctl} reject %k 30 %c %S
create user debug:* revoked ${keyctl} reject %k 30 %c %S
create user debug:loop:* * |${pkgs.coreutils}/bin/cat
create user debug:* * ${pkgs.keyutils}/share/keyutils/request-key-debug.sh %k %d %c %S
negate * * * ${keyctl} negate %k 30 %S
'';
environment.etc."request-key.d/cifs.spnego.conf".text = ''
create cifs.spnego * * ${pkgs.cifs-utils}/bin/cifs.upcall -t %k
'';
environment.etc."request-key.d/cifs.idmap.conf".text = ''
create cifs.idmap * * ${pkgs.cifs-utils}/bin/cifs.idmap %k
'';
sops.secrets."smb-credentials" = {
sopsFile = "${inputs.secrets}/secrets/vm-oddjob.enc.yaml";
};
systemd.services.mnt-nas-krb5 = {
description = "Set up Kerberos credentials for mnt-nas";
before = [ "mnt-nas.mount" ];
requiredBy = [ "mnt-nas.mount" ];
serviceConfig.type = "oneshot";
script = ''
. ${config.sops.secrets."smb-credentials".path}
echo $password | ${pkgs.krb5}/bin/kinit $username
'';
};
# systemd.services.mnt-nas-krb5 = {
# description = "Set up Kerberos credentials for mnt-nas";
# before = [ "mnt-nas.mount" ];
# requiredBy = [ "mnt-nas.mount" ];
# serviceConfig.type = "oneshot";
# script = ''
# . ${config.sops.secrets."smb-credentials".path}
# echo $password | ${pkgs.krb5}/bin/kinit $username
# '';
# };
fileSystems."/mnt/nas" = {
device = "//${inputs.secrets.lab.nas.host}/Backup";
fsType = "cifs";