]>
Commit | Line | Data |
---|---|---|
8a964143 | 1 | { lib, pkgs, config, myconfig, ... }: |
4ff90563 | 2 | let |
182ae57f | 3 | cfg = config.myServices.databases.mariadb; |
4ff90563 | 4 | in { |
182ae57f | 5 | options.myServices.databases = { |
4ff90563 IB |
6 | mariadb = { |
7 | enable = lib.mkOption { | |
8 | default = cfg.enable; | |
9 | example = true; | |
10 | description = "Whether to enable mariadb database"; | |
11 | type = lib.types.bool; | |
12 | }; | |
182ae57f IB |
13 | dataDir = lib.mkOption { |
14 | type = lib.types.path; | |
15 | default = "/var/lib/mysql"; | |
16 | description = '' | |
17 | The directory where Mariadb stores its data. | |
18 | ''; | |
19 | }; | |
20 | # Output variables | |
21 | socketsDir = lib.mkOption { | |
22 | type = lib.types.path; | |
23 | default = "/run/mysqld"; | |
24 | description = '' | |
25 | The directory where Mariadb puts sockets. | |
26 | ''; | |
27 | }; | |
28 | sockets = lib.mkOption { | |
29 | type = lib.types.attrsOf lib.types.path; | |
30 | default = { | |
31 | mysqld = "${cfg.socketsDir}/mysqld.sock"; | |
32 | }; | |
33 | readOnly = true; | |
34 | description = '' | |
35 | Mariadb sockets | |
36 | ''; | |
37 | }; | |
4ff90563 IB |
38 | }; |
39 | }; | |
40 | ||
41 | config = lib.mkIf cfg.enable { | |
4ff90563 IB |
42 | networking.firewall.allowedTCPPorts = [ 3306 ]; |
43 | ||
44 | # for adminer, ssl is implemented with mysqli only, which is | |
45 | # currently disabled because it’s not compatible with pam. | |
46 | # Thus we need to generate two users for each 'remote': one remote | |
47 | # with SSL, and one localhost without SSL. | |
48 | # User identified by LDAP: | |
49 | # CREATE USER foo@% IDENTIFIED VIA pam USING 'mysql' REQUIRE SSL; | |
50 | # CREATE USER foo@localhost IDENTIFIED VIA pam USING 'mysql'; | |
182ae57f IB |
51 | services.mysql = { |
52 | enable = true; | |
4ff90563 | 53 | package = pkgs.mariadb; |
182ae57f | 54 | dataDir = cfg.dataDir; |
4ff90563 IB |
55 | extraOptions = '' |
56 | ssl_ca = ${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt | |
57 | ssl_key = /var/lib/acme/mysql/key.pem | |
58 | ssl_cert = /var/lib/acme/mysql/fullchain.pem | |
59 | ''; | |
60 | }; | |
61 | ||
e1da84b0 | 62 | users.users.mysql.extraGroups = [ "keys" ]; |
182ae57f | 63 | security.acme.certs."mysql" = config.myServices.databasesCerts // { |
4ff90563 IB |
64 | user = "mysql"; |
65 | group = "mysql"; | |
66 | plugins = [ "fullchain.pem" "key.pem" "account_key.json" ]; | |
67 | domain = "db-1.immae.eu"; | |
68 | postRun = '' | |
69 | systemctl restart mysql.service | |
70 | ''; | |
71 | }; | |
72 | ||
1a718805 | 73 | secrets.keys = [ |
7178c2b1 IB |
74 | { |
75 | dest = "mysql/mysqldump"; | |
e1da84b0 IB |
76 | permissions = "0400"; |
77 | user = "root"; | |
78 | group = "root"; | |
79 | text = '' | |
85fe2b41 IB |
80 | [mysqldump] |
81 | user = root | |
82 | password = ${myconfig.env.databases.mysql.systemUsers.root} | |
e1da84b0 | 83 | ''; |
7178c2b1 IB |
84 | } |
85 | { | |
86 | dest = "mysql/pam"; | |
e1da84b0 IB |
87 | permissions = "0400"; |
88 | user = "mysql"; | |
89 | group = "mysql"; | |
90 | text = with myconfig.env.databases.mysql.pam; '' | |
91 | host ${myconfig.env.ldap.host} | |
92 | base ${myconfig.env.ldap.base} | |
93 | binddn ${dn} | |
94 | bindpw ${password} | |
95 | pam_filter ${filter} | |
96 | ssl start_tls | |
85fe2b41 | 97 | ''; |
7178c2b1 IB |
98 | } |
99 | ]; | |
e1da84b0 IB |
100 | |
101 | services.cron = { | |
102 | enable = true; | |
103 | systemCronJobs = [ | |
85fe2b41 | 104 | '' |
182ae57f | 105 | 30 1,13 * * * root ${pkgs.mariadb}/bin/mysqldump --defaults-file=${config.secrets.location}/mysql/mysqldump --all-databases > ${cfg.dataDir}/backup.sql |
85fe2b41 IB |
106 | '' |
107 | ]; | |
108 | }; | |
109 | ||
4ff90563 IB |
110 | security.pam.services = let |
111 | pam_ldap = "${pkgs.pam_ldap}/lib/security/pam_ldap.so"; | |
4ff90563 IB |
112 | in [ |
113 | { | |
114 | name = "mysql"; | |
115 | text = '' | |
116 | # https://mariadb.com/kb/en/mariadb/pam-authentication-plugin/ | |
182ae57f IB |
117 | auth required ${pam_ldap} config=${config.secrets.location}/mysql/pam |
118 | account required ${pam_ldap} config=${config.secrets.location}/mysql/pam | |
4ff90563 IB |
119 | ''; |
120 | } | |
121 | ]; | |
122 | ||
123 | }; | |
124 | } | |
125 |