nixos/authentik: init module, authentik: 2024.6.4 -> 2024.8.3 - #345940
nixos/authentik: init module, authentik: 2024.6.4 -> 2024.8.3#345940jvanbruegge wants to merge 11 commits into
Conversation
github-actions
Bot
added
6.topic: python
95d79aa to
abdb734
Compare
ofborg
Bot
added
10.rebuild-darwin: 11-100
There was a problem hiding this comment.
Should this be like the DB, with a specific option for local provisioning?
There was a problem hiding this comment.
What do you mean?
There was a problem hiding this comment.
I'm not sure I understand the comment. Looking at the repo, it looks like it should use an in-memory SQLite DB by default?
There was a problem hiding this comment.
You are right, but the tests require pynose and I tried for two hours to get them to work with pytest and had to give up now
h7x4
added
8.has: module (new)
There was a problem hiding this comment.
Any benefit to adding support for running outposts as well?
There was a problem hiding this comment.
Long term yes, but I want to do this in a later PR
|
On another note, I'm not sure if the license should be left as MIT, since authentik is using a custom license, especially for source-available enterprise code: https://github.com/goauthentik/authentik/blob/main/LICENSE |
|
Did you take a look at the module from https://github.com/nix-community/authentik-nix/? |
abdb734 to
ae4593f
Compare
3d7beed to
2c94185
Compare
As far as I know we do not use the enterprise code, the normal build does not include it |
No, I did not know that exists. I more or less upstreamed the module I've been using in the past year |
SuperSandro2000
left a comment
SuperSandro2000
left a comment
There was a problem hiding this comment.
We could merge the package updates and new packages with another PR to speed things up and make this PR a little smaller.
There was a problem hiding this comment.
Please use fetchpypi or download the source from github
There was a problem hiding this comment.
There is no tag or release (or even commit) for this version on github and fetchpypi can also not download it
There was a problem hiding this comment.
No, I did not know that exists. I more or less upstreamed the module I've been using in the past year
I must say, I'm not too happy about a different module being added to nixpkgs now.
The stuff in authentik-nix got testing by quite a bunch of people and has more (already tested) features already such as
- support for LDAP & RADIUS outpost
- units configured to work with media uploads
- a wrapper for the
akscript (useful for a few maintenance tasks) - A more extensive VM test verifying the entire setup process.
I fail to understand why we're trying to get an implementation in with less features when there's a community-tested version ready with more features integrated. I think it would be way better to add the entire module from there into nixpkgs or re-use the parts from it here (with credit to the original authors ideally).
Co-authored-by: jopejoe1 <johannes@joens.email>
Co-authored-by: jopejoe1 <johannes@joens.email>
Co-authored-by: jopejoe1 <johannes@joens.email>
Co-authored-by: jopejoe1 <johannes@joens.email>
Co-authored-by: jopejoe1 <johannes@joens.email>
2c94185 to
482a30b
Compare
ofborg
Bot
added
the
2.status: merge conflict
The bump to 2024.10.x is currently stalled in NixOS#345940. The fix for CVE-2024-52289 involves a backward incompatible API and DB change so it is also not great for a backport even if we cherry-picks the security fixes. Given no NixOS module is available in nixpkgs marking the package with `knownVulnerabilities` should have a limited impact.
The bump to 2024.10.x is currently stalled in #345940. The fix for CVE-2024-52289 involves a backward incompatible API and DB change so it is also not great for a backport even if we cherry-picks the security fixes. Given no NixOS module is available in nixpkgs marking the package with `knownVulnerabilities` should have a limited impact. (cherry picked from commit 384f6f5)
The bump to 2024.10.x is currently stalled in NixOS#345940. The fix for CVE-2024-52289 involves a backward incompatible API and DB change so it is also not great for a backport even if we cherry-picks the security fixes. Given no NixOS module is available in nixpkgs marking the package with `knownVulnerabilities` should have a limited impact. (cherry picked from commit 384f6f5)
|
I agree with @Ma27 we should try to at least include the features of the out of tree flake. Ideally with the same (or close enough) implementation to have something "battle" tested. Despite the work on this module, I would appreciate splitting the update of the packages into a separate PR. |
|
Ok, let's split this. I've opened a new PR for the version update alone here: #363930 |
8 participants
Things done
nix.conf? (See Nix manual)sandbox = relaxedsandbox = truenix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage./result/bin/)Add a 👍 reaction to pull requests you find important.