]>
Commit | Line | Data |
---|---|---|
4aac110f | 1 | { lib, pkgs, config, ... }: |
4ff90563 | 2 | let |
182ae57f | 3 | cfg = config.myServices.databases.mariadb; |
4ff90563 | 4 | in { |
182ae57f | 5 | options.myServices.databases = { |
4ff90563 IB |
6 | mariadb = { |
7 | enable = lib.mkOption { | |
8415083e | 8 | default = false; |
4ff90563 IB |
9 | example = true; |
10 | description = "Whether to enable mariadb database"; | |
11 | type = lib.types.bool; | |
12 | }; | |
4aac110f IB |
13 | package = lib.mkOption { |
14 | type = lib.types.package; | |
15 | default = pkgs.mariadb; | |
16 | description = '' | |
17 | Mariadb package to use. | |
18 | ''; | |
19 | }; | |
20 | credentials = lib.mkOption { | |
21 | default = {}; | |
22 | description = "Credentials"; | |
23 | type = lib.types.attrsOf lib.types.str; | |
24 | }; | |
25 | ldapConfig = lib.mkOption { | |
26 | description = "LDAP configuration to allow PAM identification via LDAP"; | |
27 | type = lib.types.submodule { | |
28 | options = { | |
29 | host = lib.mkOption { type = lib.types.str; }; | |
30 | base = lib.mkOption { type = lib.types.str; }; | |
31 | dn = lib.mkOption { type = lib.types.str; }; | |
32 | password = lib.mkOption { type = lib.types.str; }; | |
33 | filter = lib.mkOption { type = lib.types.str; }; | |
34 | }; | |
35 | }; | |
36 | }; | |
9f6a7862 IB |
37 | replicationLdapConfig = lib.mkOption { |
38 | description = "LDAP configuration to allow replication"; | |
39 | type = lib.types.submodule { | |
40 | options = { | |
41 | host = lib.mkOption { type = lib.types.str; }; | |
42 | base = lib.mkOption { type = lib.types.str; }; | |
43 | dn = lib.mkOption { type = lib.types.str; }; | |
44 | password = lib.mkOption { type = lib.types.str; }; | |
45 | }; | |
46 | }; | |
47 | }; | |
182ae57f IB |
48 | dataDir = lib.mkOption { |
49 | type = lib.types.path; | |
50 | default = "/var/lib/mysql"; | |
51 | description = '' | |
52 | The directory where Mariadb stores its data. | |
53 | ''; | |
54 | }; | |
55 | # Output variables | |
56 | socketsDir = lib.mkOption { | |
57 | type = lib.types.path; | |
58 | default = "/run/mysqld"; | |
59 | description = '' | |
60 | The directory where Mariadb puts sockets. | |
61 | ''; | |
62 | }; | |
63 | sockets = lib.mkOption { | |
64 | type = lib.types.attrsOf lib.types.path; | |
65 | default = { | |
66 | mysqld = "${cfg.socketsDir}/mysqld.sock"; | |
67 | }; | |
68 | readOnly = true; | |
69 | description = '' | |
70 | Mariadb sockets | |
71 | ''; | |
72 | }; | |
4ff90563 IB |
73 | }; |
74 | }; | |
75 | ||
76 | config = lib.mkIf cfg.enable { | |
4ff90563 IB |
77 | networking.firewall.allowedTCPPorts = [ 3306 ]; |
78 | ||
79 | # for adminer, ssl is implemented with mysqli only, which is | |
80 | # currently disabled because it’s not compatible with pam. | |
81 | # Thus we need to generate two users for each 'remote': one remote | |
82 | # with SSL, and one localhost without SSL. | |
83 | # User identified by LDAP: | |
84 | # CREATE USER foo@% IDENTIFIED VIA pam USING 'mysql' REQUIRE SSL; | |
85 | # CREATE USER foo@localhost IDENTIFIED VIA pam USING 'mysql'; | |
9f6a7862 IB |
86 | |
87 | # To create a user (host) for replication: | |
88 | # CREATE USER 'host'@'%' IDENTIFIED VIA pam USING 'mysql_replication' REQUIRE SSL; | |
89 | # GRANT REPLICATION SLAVE, REPLICATION CLIENT, RELOAD, LOCK TABLES, SELECT, SHOW VIEW ON *.* TO 'host'@'%'; | |
90 | # (the lock/select grant permits to let the replication host handle | |
91 | # the initial fetch of the database) | |
92 | # % should be valid for both localhost (for cron dumps) and the origin host. | |
182ae57f IB |
93 | services.mysql = { |
94 | enable = true; | |
4aac110f | 95 | package = cfg.package; |
182ae57f | 96 | dataDir = cfg.dataDir; |
258dd18b IB |
97 | settings = { |
98 | mysqld = { | |
99 | ssl_ca = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"; | |
100 | ssl_key = "${config.security.acme.certs.mysql.directory}/key.pem"; | |
101 | ssl_cert = "${config.security.acme.certs.mysql.directory}/fullchain.pem"; | |
9f6a7862 | 102 | |
258dd18b IB |
103 | # for replication |
104 | log-bin = "mariadb-bin"; | |
105 | server-id = "1"; | |
0907cf1b | 106 | |
258dd18b IB |
107 | # this introduces a small delay before storing on disk, but |
108 | # makes it order of magnitudes quicker | |
109 | innodb_flush_log_at_trx_commit = "0"; | |
110 | }; | |
111 | }; | |
4ff90563 IB |
112 | }; |
113 | ||
e1da84b0 | 114 | users.users.mysql.extraGroups = [ "keys" ]; |
5400b9b6 | 115 | security.acme.certs."mysql" = config.myServices.databasesCerts // { |
4ff90563 IB |
116 | user = "mysql"; |
117 | group = "mysql"; | |
4ff90563 IB |
118 | domain = "db-1.immae.eu"; |
119 | postRun = '' | |
120 | systemctl restart mysql.service | |
121 | ''; | |
122 | }; | |
123 | ||
4c4652aa IB |
124 | secrets.keys = { |
125 | "mysql/mysqldump" = { | |
e1da84b0 IB |
126 | permissions = "0400"; |
127 | user = "root"; | |
128 | group = "root"; | |
129 | text = '' | |
85fe2b41 IB |
130 | [mysqldump] |
131 | user = root | |
4aac110f | 132 | password = ${cfg.credentials.root} |
e1da84b0 | 133 | ''; |
4c4652aa IB |
134 | }; |
135 | "mysql/pam" = { | |
e1da84b0 IB |
136 | permissions = "0400"; |
137 | user = "mysql"; | |
138 | group = "mysql"; | |
4aac110f IB |
139 | text = with cfg.ldapConfig; '' |
140 | host ${host} | |
141 | base ${base} | |
e1da84b0 IB |
142 | binddn ${dn} |
143 | bindpw ${password} | |
144 | pam_filter ${filter} | |
145 | ssl start_tls | |
4aac110f | 146 | ''; |
4c4652aa IB |
147 | }; |
148 | "mysql/pam_replication" = { | |
9f6a7862 IB |
149 | permissions = "0400"; |
150 | user = "mysql"; | |
151 | group = "mysql"; | |
152 | text = with cfg.replicationLdapConfig; '' | |
153 | host ${host} | |
154 | base ${base} | |
155 | binddn ${dn} | |
156 | bindpw ${password} | |
157 | pam_login_attribute cn | |
158 | ssl start_tls | |
159 | ''; | |
4c4652aa IB |
160 | }; |
161 | }; | |
e1da84b0 | 162 | |
4ff90563 IB |
163 | security.pam.services = let |
164 | pam_ldap = "${pkgs.pam_ldap}/lib/security/pam_ldap.so"; | |
258dd18b IB |
165 | in { |
166 | mysql = { | |
4ff90563 IB |
167 | text = '' |
168 | # https://mariadb.com/kb/en/mariadb/pam-authentication-plugin/ | |
da30ae4f IB |
169 | auth required ${pam_ldap} config=${config.secrets.fullPaths."mysql/pam"} |
170 | account required ${pam_ldap} config=${config.secrets.fullPaths."mysql/pam"} | |
4ff90563 | 171 | ''; |
258dd18b IB |
172 | }; |
173 | mysql_replication = { | |
9f6a7862 | 174 | text = '' |
da30ae4f IB |
175 | auth required ${pam_ldap} config=${config.secrets.fullPaths."mysql/pam_replication"} |
176 | account required ${pam_ldap} config=${config.secrets.fullPaths."mysql/pam_replication"} | |
9f6a7862 | 177 | ''; |
258dd18b IB |
178 | }; |
179 | }; | |
4ff90563 IB |
180 | |
181 | }; | |
182 | } |