nixos/kanidm: fix unixd config v2 support

[samos667]

#391080

I think is the most convenient way to support v2 and legacy config without breaking existing deployments. But I'm really open to any improvements !

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 25.05 Release Notes (or backporting 24.11 and 25.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[samos667]

FYI @Flakebi @oddlama

[oddlama]

Are there any downsides if we force users to upgrade to v2? Then we might be able to use mkRenamedOptionModule to make users aware without breaking anything. But I am not sure what else v2 would entail.

[samos667]

This is a great idea ! I don't think there is any downside to swap to from v1 to v2, from my view v2 bring new features but the config schema is break between versions (notably 'pam_allowed_login_groups' location)
I'm not really familliar with mkRenamedOptionModule, following example I've seen on nixpkgs I should imports this:

(lib.mkRenamedOptionModule [ "services" "kanidm" "unixSettings" "pam_allowed_login_groups" ] [ "services" "kanidm" "unixSettings" "kanidm" "pam_allowed_login_groups" ])

but my current try complain about 'cannot find attribute 'services.kanidm.unixSettings.pam_allowed_login_groups''

I'm doing something wrong ?

[samos667]

btw do you think it's a good idea to declare most of config as option ? samos667@89a4bae#diff-cfbafac7f69ef08195582e6ca44f31554e7fb962c3f7cfa5460a2f8fe6913f9aR379-R468

[samos667]

Also idk if it's the way to add/enforce a value(version = 2) in the freeform config