Replace LDAP user management with extrausers file-based system#16
Draft
maltejk wants to merge 7 commits into
Draft
Replace LDAP user management with extrausers file-based system#16maltejk wants to merge 7 commits into
maltejk wants to merge 7 commits into
Conversation
Django now writes POSIX user entries atomically to a shared volume at /var/lib/extrausers/passwd on every RepositoryUser save/delete. The borg SSH container resolves those users via libnss-extrausers instead of querying an OpenLDAP server over the network. Removes: OpenLDAP container, NSLCD daemon, pam_ldap, mprov-django-ldapdb, python-ldap, RepositoryLdapUser model, ldapdb DB backend and router. Adds: extrausers-data shared volume, migration 0006 to drop any residual LDAP table, BORGHIVE_EXTRAUSERS_PATH setting (default /var/lib/extrausers). https://claude.ai/code/session_01KEFp9XaE1Rreo5drdE8w73
Migrations 0002-0005 still imported ldapdb.models.fields at the top level, causing ModuleNotFoundError during test collection after python-ldap was removed from requirements. The ldapdb import in 0005 was also used in an AlterField operation for the now-removed RepositoryLdapUser model; that operation is dropped. Also add a TEST_MODE guard to sync_extrausers() itself so no code path tries to write to /var/lib/extrausers during CI runs, and drop the now-unused libsasl2-dev / libldap2-dev from the CI system deps. https://claude.ai/code/session_01KEFp9XaE1Rreo5drdE8w73
extrausers.py (new file) and four pre-existing files failed the black --check step in CI. Auto-formatted with black. https://claude.ai/code/session_01KEFp9XaE1Rreo5drdE8w73
pylint 4.x removed the suggestion-mode option; comment it out in .pylintrc. Add missing docstring to sync_to_extrausers to satisfy C0116. https://claude.ai/code/session_01KEFp9XaE1Rreo5drdE8w73
setuptools>=81 removed pkg_resources, which pylama 8.4.1 still imports at startup. Without the pin, pylama crashes with ModuleNotFoundError on a clean install, which is exactly what CI does. https://claude.ai/code/session_01KEFp9XaE1Rreo5drdE8w73
|
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #16 +/- ##
==========================================
+ Coverage 84.28% 85.21% +0.92%
==========================================
Files 60 61 +1
Lines 1222 1224 +2
Branches 77 79 +2
==========================================
+ Hits 1030 1043 +13
+ Misses 165 154 -11
Partials 27 27
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Add 8 new tests covering _atomic_write (happy path, dir creation, permissions, error cleanup, unlink failure swallowing) and sync_extrausers (passwd content, empty list, TEST_MODE guard). extrausers.py goes from 20% to 100% coverage. Remove src/borghive/models/ldap.py — it was a 3-line re-export shim with 0% coverage that nothing imported. https://claude.ai/code/session_01KEFp9XaE1Rreo5drdE8w73
Add RepositoryUserSignalTest with a delete test that exercises the post_delete signal handler (signals.py:40-41). All new lines introduced in this PR are now covered. https://claude.ai/code/session_01KEFp9XaE1Rreo5drdE8w73
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR removes the LDAP-based user management system and replaces it with a file-based approach using the
libnss-extrauserslibrary. User information is now synced to/var/lib/extrausers/passwdand/var/lib/extrausers/groupfiles instead of being stored in an LDAP directory.Key Changes
mprov-django-ldapdb,python-ldap, and related LDAP packages from requirementssrc/borghive/lib/extrausers.pywithsync_extrausers()function that atomically writes user data to extrausers passwd/group filessync_to_ldap()method withsync_to_extrausers()that regenerates extrausers files from the database0006_remove_repository_ldap_user.pyto clean up the databaserepository_user_createdandrepository_user_deletedsignals to call the new extrausers sync functionextrausers-datavolume to app, watcher, and borg serviceslibnss-extrausersinstead of LDAP librariesnsswitch.confto use extrausers instead of LDAPpam-sshd.confto usepam_permitinstead ofpam_ldapborg/init.shEXTRAUSERS_PATHsettingImplementation Details
The new system uses atomic file writes (write to temp file, then rename) to ensure consistency when updating user files. The
sync_extrausers()function is called whenever a RepositoryUser is created, updated, or deleted, ensuring the extrausers files stay in sync with the database. This approach is simpler than LDAP and doesn't require a separate directory service.https://claude.ai/code/session_01KEFp9XaE1Rreo5drdE8w73