mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

run authelia's digest under a real shell, not the service user's nologin

Browse source
This commit is contained in:
atlas 2026-11-09 15:34:10 +01:00 • committed by mara
commit 2a0ebe35ba
1 changed files with 25 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

14
nix/host-modules/lib/oidc-client-secrets.nix
View file

@ -16,11 +16,12 @@
# its digest but the store could not be read, so the caller finishes its work
# from the digests and then retries.
#
# Pure function — NOT a NixOS module. Call it after `./store-seeded-secret.nix`
# and `./atomic-write-secret.nix`, with `store_init` and `store_login` run and
# `$clients` set to the digest directory. Needs `authelia`, `bao`, `script`
# Pure function of `shell`, the path of a real shell; NOT a NixOS module. Call
# it after `./store-seeded-secret.nix` and `./atomic-write-secret.nix`, with
# `store_init` and `store_login` run and `$clients` set to the digest directory.
# Needs `authelia`, `bao`, `script`
# (util-linux), `coreutils`, `grep` and `sed` on the caller's `path`.
{ }:
{ shell }:
''
# <leaf>. Sets CLIENT_SECRET_VALUE. 0: the store holds a value. 1: it holds
# none. 2: it cannot tell (not logged in, down, or refusing the read).
@ -43,10 +44,11 @@
# written. The CLI takes a password only on a terminal prompt or in argv,
# and argv is world-readable in /proc, so the prompt is answered through a
# pty from stdin. The pty echoes the password into the pipe, and only the
# `Digest:` line leaves it.
# `Digest:` line leaves it. `script` runs the command as `$SHELL -c`, and the
# service user's login shell is nologin, so the call sets `SHELL` to `shell`.
client_secret_digest() {
printf '%s\n' "$1" \
| timeout 60 script -qec "authelia crypto hash generate pbkdf2 --variant sha512 --no-confirm" /dev/null \
| SHELL=${shell} timeout 60 script -qec "authelia crypto hash generate pbkdf2 --variant sha512 --no-confirm" /dev/null \
| tr -d '\r' | sed -n 's/^Digest: *//p'
}