infra.auth
8 options
infra.auth.sssd
infra.auth.sssd.allowedGroups
Authentik group names allowed to SSH into this machine. Empty list allows any authenticated LDAP user. Example: [ “developers” “platform-admins” ]
Type: list of string
Default:
[ ]
Example:
[
"developers"
"platform-admins"
]
Declared by: nix/modules/infra/auth/sssd
infra.auth.sssd.baseDn
LDAP base DN for user/group searches. Must be non-null when infra.auth.sssd is enabled (asserted).
Type: null or string
Default:
config.fleet.network.ldap.base_dn
Example:
"dc=ldap,dc=example,dc=com"
Declared by: nix/modules/infra/auth/sssd
infra.auth.sssd.enable
Whether to enable SSSD LDAP authentication via Authentik.
Type: boolean
Default:
false
Example:
true
Declared by: nix/modules/infra/auth/sssd
infra.auth.sssd.ldapUri
URI of the Authentik LDAP outpost. Must be non-null when infra.auth.sssd is enabled (asserted).
Type: null or string
Default:
config.fleet.network.ldap.uri
Example:
"ldap://auth.example.internal:389"
Declared by: nix/modules/infra/auth/sssd
infra.auth.sssd.probe.enable
Whether to enable scheduled fleet directory-auth probe (INFRA-200).
Type: boolean
Default:
false
Example:
true
Declared by: nix/modules/infra/auth/sssd/probe.nix
infra.auth.sssd.probe.interval
Probe cadence (systemd OnUnitActiveSec).
Type: string
Default:
"15min"
Declared by: nix/modules/infra/auth/sssd/probe.nix
infra.auth.sssd.probe.targets
Hosts to probe: metric target name → IP. Only add hosts that carry the INFRA-190 sssd config (ldap-bind + wrapper integration) — a not-yet-converged host fails by design, which is signal during a rollout but noise as a steady state.
Type: attribute set of string
Default:
{ }
Example:
{
dash = "192.0.2.20";
}
Declared by: nix/modules/infra/auth/sssd/probe.nix
infra.auth.sssd.sudoGroups
Authentik group names whose members get password-required sudo
on this machine (rendered as security.sudo.extraRules matching
%
Type: list of string
Default:
[ ]
Example:
[
"developers"
]
Declared by: nix/modules/infra/auth/sssd