]>
Commit | Line | Data |
---|---|---|
18fdf470 IB |
1 | { lib, pkgs, config, myconfig, mylibs, ... }: |
2 | let | |
3 | cfg = config.services.myDatabases; | |
4 | ldapConfig = let | |
5 | kerberosSchema = pkgs.fetchurl { | |
6 | url = "https://raw.githubusercontent.com/krb5/krb5/master/src/plugins/kdb/ldap/libkdb_ldap/kerberos.schema"; | |
7 | sha256 = "17fnkkf6s3lznsl7wp6914pqsc78d038rh38l638big8z608ksww"; | |
8 | }; | |
9 | puppetSchema = pkgs.fetchurl { | |
10 | url = "https://raw.githubusercontent.com/puppetlabs/puppet/master/ext/ldap/puppet.schema"; | |
11 | sha256 = "11bjf5zfvqlim7p9vddcafs0wiq3v8ys77x8h6fbp9c6bdfh0awh"; | |
12 | }; | |
13 | in '' | |
14 | include ${pkgs.openldap}/etc/schema/core.schema | |
15 | include ${pkgs.openldap}/etc/schema/cosine.schema | |
16 | include ${pkgs.openldap}/etc/schema/inetorgperson.schema | |
17 | include ${pkgs.openldap}/etc/schema/nis.schema | |
18 | include ${puppetSchema} | |
19 | include ${kerberosSchema} | |
20 | include ${./immae.schema} | |
21 | ||
22 | pidfile /run/slapd/slapd.pid | |
23 | argsfile /run/slapd/slapd.args | |
24 | ||
25 | moduleload back_hdb | |
26 | backend hdb | |
27 | ||
28 | moduleload memberof | |
29 | database hdb | |
30 | suffix "${myconfig.env.ldap.base}" | |
31 | rootdn "${myconfig.env.ldap.root_dn}" | |
32 | rootpw ${myconfig.env.ldap.root_pw} | |
33 | directory /var/lib/openldap | |
34 | overlay memberof | |
35 | ||
36 | TLSCertificateFile /var/lib/acme/ldap/cert.pem | |
37 | TLSCertificateKeyFile /var/lib/acme/ldap/key.pem | |
38 | TLSCACertificateFile /var/lib/acme/ldap/fullchain.pem | |
39 | TLSCACertificatePath ${pkgs.cacert.unbundled}/etc/ssl/certs/ | |
40 | #This makes openldap crash | |
41 | #TLSCipherSuite DEFAULT | |
42 | ||
43 | sasl-host kerberos.immae.eu | |
44 | ${builtins.readFile "${myconfig.privateFiles}/ldap.conf"} | |
45 | ''; | |
46 | in { | |
47 | options.services.myDatabases = { | |
48 | ldap = { | |
49 | enable = lib.mkOption { | |
50 | default = cfg.enable; | |
51 | example = true; | |
52 | description = "Whether to enable ldap"; | |
53 | type = lib.types.bool; | |
54 | }; | |
55 | }; | |
56 | }; | |
57 | ||
58 | config = lib.mkIf cfg.enable { | |
59 | networking.firewall.allowedTCPPorts = [ 636 389 ]; | |
60 | ||
61 | services.cron = { | |
62 | systemCronJobs = [ | |
63 | '' | |
24dbd8d2 | 64 | 35 1,13 * * * root ${pkgs.openldap}/bin/slapcat -v -b "dc=immae,dc=eu" -f ${pkgs.writeText "slapd.conf" ldapConfig} -l /var/lib/openldap/backup.ldif | ${pkgs.gnugrep}/bin/grep -v "^# id=[0-9a-f]*$" |
18fdf470 IB |
65 | '' |
66 | ]; | |
67 | }; | |
68 | ||
69 | security.acme.certs."ldap" = config.services.myCertificates.certConfig // { | |
70 | user = "openldap"; | |
71 | group = "openldap"; | |
72 | plugins = [ "fullchain.pem" "key.pem" "cert.pem" "account_key.json" ]; | |
73 | domain = "ldap.immae.eu"; | |
74 | postRun = '' | |
75 | systemctl restart openldap.service | |
76 | ''; | |
77 | }; | |
78 | ||
79 | services.openldap = { | |
80 | enable = config.services.myDatabases.ldap.enable; | |
81 | dataDir = "/var/lib/openldap"; | |
82 | urlList = [ "ldap://" "ldaps://" ]; | |
83 | extraConfig = ldapConfig; | |
84 | }; | |
85 | }; | |
86 | } | |
87 |