Move the user account and its password secret out of the core #27

New issue

Open

opened 2026-06-18 12:37:07 +00:00 by bram.buijs · 0 comments

bram.buijs commented

2026-06-18 12:37:07 +00:00

Collaborator

Per ADR-0003 user accounts belong in the consuming org/host layer, not in the
upstream core. Today users-dawo is imported by profiles-dawo-generic and ships
a concrete dawo user with a fixed initialHashedPassword baked into the repo and
mutableUsers = true.

Two problems: a password hash in the shared core is a credential in a public repo
(every consumer inherits the same one), and a hardcoded end-user account is exactly
the org-specific thing ADR-0003 says should live in the consumer.

Proposal:

Remove the concrete dawo user (and its hash) from the core baseline.
The core may keep a minimal admin/break-glass contract as a block, but any real
account and its secret live in the org/host layer, with the secret managed by
agenix (already an input), not inlined.
Consider mutableUsers = false for the managed posture, set per workplace.

Question: should the core expose an opt-in dawo.users.adminBreakGlass block (a
documented local admin for recovery), or stay entirely user-agnostic and leave all
accounts to the org repo?

Per ADR-0003 user accounts belong in the consuming org/host layer, not in the upstream core. Today `users-dawo` is imported by `profiles-dawo-generic` and ships a concrete `dawo` user with a fixed `initialHashedPassword` baked into the repo and `mutableUsers = true`. Two problems: a password hash in the shared core is a credential in a public repo (every consumer inherits the same one), and a hardcoded end-user account is exactly the org-specific thing ADR-0003 says should live in the consumer. Proposal: - Remove the concrete `dawo` user (and its hash) from the core baseline. - The core may keep a minimal admin/break-glass contract as a block, but any real account and its secret live in the org/host layer, with the secret managed by agenix (already an input), not inlined. - Consider `mutableUsers = false` for the managed posture, set per workplace. Question: should the core expose an opt-in `dawo.users.adminBreakGlass` block (a documented local admin for recovery), or stay entirely user-agnostic and leave all accounts to the org repo?

bram.buijs added the

Status

Need More Info

label

2026-06-18 12:38:33 +00:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

MinBZK/DAWO-NixOS#27

No description provided.

Rows
Columns