Conversation
88deee8 to
cdcb775
Compare
24apricots
left a comment
24apricots
left a comment
There was a problem hiding this comment.
this is a painful migration. thank you for ur hard work..
| ocf.kerberosKdc.enable = true; | ||
| ocf.ldapServer.enable = true; | ||
|
|
||
| ocf.acme.extraCerts = [ |
There was a problem hiding this comment.
the extraCerts urls should be passed into a url module options in the respective modules. this would enforce correct behavior as the modules would be able to require that certs are added for ldaps://* to work properly. make sure that the module throws an error when it is enabled without adding a tls cert
There was a problem hiding this comment.
this can be done natively with kerberos, and all clients can enforce passwords by writing to kerberos and handling the error + maybe parsing the policy to get the password requirements.
There was a problem hiding this comment.
this does not need to be fixed now and is not a regression. will create an issue
| }: | ||
|
|
||
| let | ||
| cfg = config.ocf.kerberosKdc; |
There was a problem hiding this comment.
Kdc should be KDC but whatever lol
| acl = [ | ||
| # Staff /admin principals have full KDC access | ||
| { | ||
| principal = "*/admin"; |
There was a problem hiding this comment.
can we check if a wildcard like this is ok? ocf/puppet explicitly specifies each user's admin and root principal
There was a problem hiding this comment.
it turns out it's not ok and we have to be explicit lol lib/kadm5/acl.c
| services.kerberos_server = { | ||
| enable = true; | ||
| settings = { | ||
| kdc.extra-addresses = "127.0.0.2"; |
| # chatbot) repos anyway, no real reason for it to exist. may | ||
| # delete soon anyway. | ||
|
|
||
| olcAccess = [ |
There was a problem hiding this comment.
this config makes me nervous since it is a lot of unnecessary fiddling around from what we know works perfectly. the comments were reworded from puppet, but that aside i think it would be better to just drop https://github.com/ocf/puppet/blob/master/modules/ocf_ldap/templates/slapd.conf.erb in services.openldap.settings.includes, but change anything that needs to be changed (for example tls certs).
| }; | ||
|
|
||
| # The KDC database lives in /var/lib/heimdal/ and must be initialized manually: | ||
| # kadmin -l init OCF.BERKELEY.EDU |
There was a problem hiding this comment.
i was going to say do this automatically, but i am leaning on letting it fail so that the person deploying knows that they have to either init an empty kdc or migrate. so i think this is ok 👍
|
final sanity checks to do at the final moment after no more changes will be made:
lets start with migrating nix hosts, then debian hosts. we should do this cautiously |
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
please fix the history so it doesn't have 53 commits, and re-write Claude Co-Authored-By trailers to Assisted-By additionally, please write an ai disclosure in your pr body including the following:
|
3 participants
meant to replace our debian host, firestorm.