jory
62c70dab19
The diff shows comprehensive code cleanup and formatting improvements across 18 files, including cleaner argument structures, additional package configurations, and improved formatting in the `home/terminal/software/git.nix` hook script.
58 lines
1.5 KiB
Nix
58 lines
1.5 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
inputs,
|
|
...
|
|
}:
|
|
# Himmelblau: Microsoft Entra ID authentication for Linux
|
|
#
|
|
# Authenticates Linux users against the digistate.nl Entra ID tenant.
|
|
# Users log in with their Entra ID credentials via OIDC Device Authorization
|
|
# Grant flow (browser-based) or the native PAM orchestrator.
|
|
#
|
|
# Requires:
|
|
# - A working Entra ID tenant with digistate.nl as a verified domain
|
|
# - An OIDC app registration (Himmelblau client) in the tenant
|
|
# - Network connectivity to login.microsoftonline.com
|
|
#
|
|
# References:
|
|
# - https://himmelblau-idm.org/docs/
|
|
# - https://github.com/himmelblau-idm/himmelblau
|
|
let
|
|
cfg = config.work.himmelblau;
|
|
in {
|
|
imports = [
|
|
inputs.himmelblau.nixosModules.himmelblau
|
|
];
|
|
|
|
options.work.himmelblau = {
|
|
enable =
|
|
lib.mkEnableOption "Himmelblau Entra ID authentication"
|
|
// {
|
|
default = false;
|
|
};
|
|
};
|
|
|
|
config = lib.mkIf cfg.enable {
|
|
services.himmelblau = {
|
|
enable = true;
|
|
settings = {
|
|
domain = ["digistate.nl"];
|
|
# Uncomment and set to Entra ID group Object IDs or names to
|
|
# restrict which users can authenticate:
|
|
# pam_allow_groups = [ "ENTRA-GROUP-GUID-HERE" ];
|
|
};
|
|
};
|
|
|
|
# Himmelblau registers an NSS module (system.nssModules) for user/group lookups,
|
|
# which requires nscd to be enabled. Keep it on.
|
|
# services.nscd.enable = lib.mkForce false;
|
|
|
|
# Expose the aad-tool CLI for diagnostics and enrollment
|
|
environment.systemPackages = [
|
|
inputs.himmelblau.packages.${pkgs.system}.aad-tool
|
|
];
|
|
};
|
|
}
|