]>
Commit | Line | Data |
---|---|---|
587b9e34 | 1 | { lib, pkgs, config, myconfig, mylibs, ... }: |
4ff90563 IB |
2 | let |
3 | cfg = config.services.myDatabases; | |
4 | in { | |
5 | options.services.myDatabases = { | |
6 | mariadb = { | |
7 | enable = lib.mkOption { | |
8 | default = cfg.enable; | |
9 | example = true; | |
10 | description = "Whether to enable mariadb database"; | |
11 | type = lib.types.bool; | |
12 | }; | |
13 | }; | |
14 | }; | |
15 | ||
16 | config = lib.mkIf cfg.enable { | |
4ff90563 IB |
17 | networking.firewall.allowedTCPPorts = [ 3306 ]; |
18 | ||
19 | # for adminer, ssl is implemented with mysqli only, which is | |
20 | # currently disabled because it’s not compatible with pam. | |
21 | # Thus we need to generate two users for each 'remote': one remote | |
22 | # with SSL, and one localhost without SSL. | |
23 | # User identified by LDAP: | |
24 | # CREATE USER foo@% IDENTIFIED VIA pam USING 'mysql' REQUIRE SSL; | |
25 | # CREATE USER foo@localhost IDENTIFIED VIA pam USING 'mysql'; | |
26 | services.mysql = rec { | |
27 | enable = cfg.mariadb.enable; | |
28 | package = pkgs.mariadb; | |
29 | extraOptions = '' | |
30 | ssl_ca = ${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt | |
31 | ssl_key = /var/lib/acme/mysql/key.pem | |
32 | ssl_cert = /var/lib/acme/mysql/fullchain.pem | |
33 | ''; | |
34 | }; | |
35 | ||
e1da84b0 | 36 | users.users.mysql.extraGroups = [ "keys" ]; |
4ff90563 IB |
37 | security.acme.certs."mysql" = config.services.myCertificates.certConfig // { |
38 | user = "mysql"; | |
39 | group = "mysql"; | |
40 | plugins = [ "fullchain.pem" "key.pem" "account_key.json" ]; | |
41 | domain = "db-1.immae.eu"; | |
42 | postRun = '' | |
43 | systemctl restart mysql.service | |
44 | ''; | |
45 | }; | |
46 | ||
7178c2b1 IB |
47 | mySecrets.keys = [ |
48 | { | |
49 | dest = "mysql/mysqldump"; | |
e1da84b0 IB |
50 | permissions = "0400"; |
51 | user = "root"; | |
52 | group = "root"; | |
53 | text = '' | |
85fe2b41 IB |
54 | [mysqldump] |
55 | user = root | |
56 | password = ${myconfig.env.databases.mysql.systemUsers.root} | |
e1da84b0 | 57 | ''; |
7178c2b1 IB |
58 | } |
59 | { | |
60 | dest = "mysql/pam"; | |
e1da84b0 IB |
61 | permissions = "0400"; |
62 | user = "mysql"; | |
63 | group = "mysql"; | |
64 | text = with myconfig.env.databases.mysql.pam; '' | |
65 | host ${myconfig.env.ldap.host} | |
66 | base ${myconfig.env.ldap.base} | |
67 | binddn ${dn} | |
68 | bindpw ${password} | |
69 | pam_filter ${filter} | |
70 | ssl start_tls | |
85fe2b41 | 71 | ''; |
7178c2b1 IB |
72 | } |
73 | ]; | |
e1da84b0 IB |
74 | |
75 | services.cron = { | |
76 | enable = true; | |
77 | systemCronJobs = [ | |
85fe2b41 | 78 | '' |
7178c2b1 | 79 | 30 1,13 * * * root ${pkgs.mariadb}/bin/mysqldump --defaults-file=/var/secrets/mysql/mysqldump --all-databases > /var/lib/mysql/backup.sql |
85fe2b41 IB |
80 | '' |
81 | ]; | |
82 | }; | |
83 | ||
4ff90563 IB |
84 | security.pam.services = let |
85 | pam_ldap = "${pkgs.pam_ldap}/lib/security/pam_ldap.so"; | |
4ff90563 IB |
86 | in [ |
87 | { | |
88 | name = "mysql"; | |
89 | text = '' | |
90 | # https://mariadb.com/kb/en/mariadb/pam-authentication-plugin/ | |
7178c2b1 IB |
91 | auth required ${pam_ldap} config=/var/secrets/mysql/pam |
92 | account required ${pam_ldap} config=/var/secrets/mysql/pam | |
4ff90563 IB |
93 | ''; |
94 | } | |
95 | ]; | |
96 | ||
97 | }; | |
98 | } | |
99 |