kanidm: allow imperative group membership management

2026-02-09 19:36:26 +01:00
parent 9dec754eed
commit c091852d9e
1 changed files with 4 additions and 3 deletions
--- a/services/kanidm/default.nix
+++ b/services/kanidm/default.nix
@@ -24,9 +24,10 @@
      idmAdminPasswordFile = config.vault.secrets.kanidm-idm-admin.outputDir;

      groups = {
-        admins = { };
-        users = { };
-        ssh-users = { };
+        # overwriteMembers = false allows imperative member management via CLI
+        admins = { overwriteMembers = false; };
+        users = { overwriteMembers = false; };
+        ssh-users = { overwriteMembers = false; };
      };

      # Regular users (persons) are managed imperatively via kanidm CLI