diff --git a/nixos/doc/manual/release-notes/rl-2405.section.md b/nixos/doc/manual/release-notes/rl-2405.section.md index 07cdf2096d3e..853fc805e828 100644 --- a/nixos/doc/manual/release-notes/rl-2405.section.md +++ b/nixos/doc/manual/release-notes/rl-2405.section.md @@ -94,7 +94,7 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m - `services.zfs.zed.enableMail` now uses the global `sendmail` wrapper defined by an email module (such as msmtp or Postfix). It no longer requires using a special ZFS build with email support. -- The `krb5` module has been rewritten, moving all options but `krb5.enable` and `krb5.package` into `krb5.settings`. +- The `krb5` module has been rewritten and moved to `security.krb5`, moving all options but `security.krb5.enable` and `security.krb5.package` into `security.krb5.settings`. - Gitea 1.21 upgrade has several breaking changes, including: - Custom themes and other assets that were previously stored in `custom/public/*` now belong in `custom/public/assets/*` diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index 52c6fe5028f1..b9dce250087b 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -10,7 +10,6 @@ ./config/gtk/gtk-icon-cache.nix ./config/i18n.nix ./config/iproute2.nix - ./config/krb5/default.nix ./config/ldap.nix ./config/ldso.nix ./config/locale.nix @@ -308,6 +307,7 @@ ./security/duosec.nix ./security/google_oslogin.nix ./security/ipa.nix + ./security/krb5 ./security/lock-kernel-modules.nix ./security/misc.nix ./security/oath.nix diff --git a/nixos/modules/security/ipa.nix b/nixos/modules/security/ipa.nix index 69a670cd5e4a..df59d1e75414 100644 --- a/nixos/modules/security/ipa.nix +++ b/nixos/modules/security/ipa.nix @@ -117,8 +117,8 @@ in { config = mkIf cfg.enable { assertions = [ { - assertion = !config.krb5.enable; - message = "krb5 must be disabled through `krb5.enable` for FreeIPA integration to work."; + assertion = !config.security.krb5.enable; + message = "krb5 must be disabled through `security.krb5.enable` for FreeIPA integration to work."; } { assertion = !config.users.ldap.enable; diff --git a/nixos/modules/config/krb5/default.nix b/nixos/modules/security/krb5/default.nix similarity index 89% rename from nixos/modules/config/krb5/default.nix rename to nixos/modules/security/krb5/default.nix index 7e00b5b340a7..5f0cfe3e23b0 100644 --- a/nixos/modules/config/krb5/default.nix +++ b/nixos/modules/security/krb5/default.nix @@ -5,11 +5,11 @@ let mkRemovedOptionModule' = name: reason: mkRemovedOptionModule ["krb5" name] reason; mkRemovedOptionModuleCfg = name: mkRemovedOptionModule' name '' - The option `krb5.${name}' has been removed. Use `krb5.settings.${name}' for - structured configuration. + The option `krb5.${name}' has been removed. Use + `security.krb5.settings.${name}' for structured configuration. ''; - cfg = config.krb5; + cfg = config.security.krb5; format = import ./krb5-conf-format.nix { inherit pkgs lib; } { }; in { imports = [ @@ -22,12 +22,12 @@ in { (mkRemovedOptionModuleCfg "config") (mkRemovedOptionModuleCfg "extraConfig") (mkRemovedOptionModule' "kerberos" '' - The option `krb5.kerberos' has been moved to `krb5.package'. + The option `krb5.kerberos' has been moved to `security.krb5.package'. '') ]; options = { - krb5 = { + security.krb5 = { enable = mkOption { default = false; description = mdDoc "Enable and configure Kerberos utilities"; diff --git a/nixos/modules/config/krb5/krb5-conf-format.nix b/nixos/modules/security/krb5/krb5-conf-format.nix similarity index 100% rename from nixos/modules/config/krb5/krb5-conf-format.nix rename to nixos/modules/security/krb5/krb5-conf-format.nix diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix index c99615d5a636..b5e5dcb24426 100644 --- a/nixos/modules/security/pam.nix +++ b/nixos/modules/security/pam.nix @@ -1067,8 +1067,8 @@ in security.pam.krb5 = { enable = mkOption { - default = config.krb5.enable; - defaultText = literalExpression "config.krb5.enable"; + default = config.security.krb5.enable; + defaultText = literalExpression "config.security.krb5.enable"; type = types.bool; description = lib.mdDoc '' Enables Kerberos PAM modules (`pam-krb5`, @@ -1076,7 +1076,7 @@ in If set, users can authenticate with their Kerberos password. This requires a valid Kerberos configuration - (`config.krb5.enable` should be set to + (`config.security.krb5.enable` should be set to `true`). Note that the Kerberos PAM modules are not necessary when using SSS diff --git a/nixos/modules/services/system/kerberos/default.nix b/nixos/modules/services/system/kerberos/default.nix index e3185eb6409c..486d4b49c195 100644 --- a/nixos/modules/services/system/kerberos/default.nix +++ b/nixos/modules/services/system/kerberos/default.nix @@ -3,7 +3,7 @@ let inherit (lib) mkOption mkIf types length attrNames; cfg = config.services.kerberos_server; - kerberos = config.krb5.package; + kerberos = config.security.krb5.package; aclEntry = { options = { diff --git a/nixos/modules/services/system/kerberos/heimdal.nix b/nixos/modules/services/system/kerberos/heimdal.nix index c9a951caa1ae..4789e4790b4b 100644 --- a/nixos/modules/services/system/kerberos/heimdal.nix +++ b/nixos/modules/services/system/kerberos/heimdal.nix @@ -4,7 +4,7 @@ let inherit (lib) mkIf concatStringsSep concatMapStrings toList mapAttrs mapAttrsToList; cfg = config.services.kerberos_server; - kerberos = config.krb5.package; + kerberos = config.security.krb5.package; stateDir = "/var/heimdal"; aclFiles = mapAttrs (name: {acl, ...}: pkgs.writeText "${name}.acl" (concatMapStrings (( diff --git a/nixos/modules/services/system/kerberos/mit.nix b/nixos/modules/services/system/kerberos/mit.nix index 5f8ac6b7fa34..a654bd1fe7e1 100644 --- a/nixos/modules/services/system/kerberos/mit.nix +++ b/nixos/modules/services/system/kerberos/mit.nix @@ -4,7 +4,7 @@ let inherit (lib) mkIf concatStrings concatStringsSep concatMapStrings toList mapAttrs mapAttrsToList; cfg = config.services.kerberos_server; - kerberos = config.krb5.package; + kerberos = config.security.krb5.package; stateDir = "/var/lib/krb5kdc"; PIDFile = "/run/kdc.pid"; aclMap = { diff --git a/nixos/tests/kerberos/heimdal.nix b/nixos/tests/kerberos/heimdal.nix index fbe2ad745baf..cc817ed351f7 100644 --- a/nixos/tests/kerberos/heimdal.nix +++ b/nixos/tests/kerberos/heimdal.nix @@ -7,7 +7,7 @@ import ../make-test-python.nix ({pkgs, ...}: { "FOO.BAR".acl = [{principal = "admin"; access = ["add" "cpw"];}]; }; }; - krb5 = { + security.krb5 = { enable = true; package = pkgs.heimdal; settings = { diff --git a/nixos/tests/kerberos/mit.nix b/nixos/tests/kerberos/mit.nix index b16fc89990e3..f5a856c53a7b 100644 --- a/nixos/tests/kerberos/mit.nix +++ b/nixos/tests/kerberos/mit.nix @@ -7,7 +7,7 @@ import ../make-test-python.nix ({pkgs, ...}: { "FOO.BAR".acl = [{principal = "admin"; access = ["add" "cpw"];}]; }; }; - krb5 = { + security.krb5 = { enable = true; package = pkgs.krb5; settings = { diff --git a/nixos/tests/krb5/example-config.nix b/nixos/tests/krb5/example-config.nix index f07e579ed5f5..aaf3df09738b 100644 --- a/nixos/tests/krb5/example-config.nix +++ b/nixos/tests/krb5/example-config.nix @@ -9,7 +9,7 @@ import ../make-test-python.nix ({ pkgs, ...} : { nodes.machine = { pkgs, ... }: { - krb5 = { + security.krb5 = { enable = true; package = pkgs.krb5; settings = { diff --git a/nixos/tests/nfs/kerberos.nix b/nixos/tests/nfs/kerberos.nix index 6d95da25bcbe..60c3f2f1e80d 100644 --- a/nixos/tests/nfs/kerberos.nix +++ b/nixos/tests/nfs/kerberos.nix @@ -1,7 +1,7 @@ import ../make-test-python.nix ({ pkgs, lib, ... }: let - krb5 = { + security.krb5 = { enable = true; settings = { domain_realm."nfs.test" = "NFS.TEST"; @@ -34,7 +34,7 @@ in nodes = { client = { lib, ... }: - { inherit krb5 users; + { inherit security users; networking.extraHosts = hosts; networking.domain = "nfs.test"; @@ -50,7 +50,7 @@ in }; server = { lib, ...}: - { inherit krb5 users; + { inherit security users; networking.extraHosts = hosts; networking.domain = "nfs.test"; diff --git a/nixos/tests/pam/pam-file-contents.nix b/nixos/tests/pam/pam-file-contents.nix index 2bafd90618e9..accaa4cc70a9 100644 --- a/nixos/tests/pam/pam-file-contents.nix +++ b/nixos/tests/pam/pam-file-contents.nix @@ -7,7 +7,7 @@ import ../make-test-python.nix ({ pkgs, ... }: { nodes.machine = { ... }: { imports = [ ../../modules/profiles/minimal.nix ]; - krb5.enable = true; + security.krb5.enable = true; users = { mutableUsers = false;