]>
Commit | Line | Data |
---|---|---|
1 | { lib, pkgs, config, ... }: | |
2 | let | |
3 | cfg = config.myServices.databases.mariadb; | |
4 | in { | |
5 | options.myServices.databases = { | |
6 | mariadb = { | |
7 | enable = lib.mkOption { | |
8 | default = cfg.enable; | |
9 | example = true; | |
10 | description = "Whether to enable mariadb database"; | |
11 | type = lib.types.bool; | |
12 | }; | |
13 | package = lib.mkOption { | |
14 | type = lib.types.package; | |
15 | default = pkgs.mariadb; | |
16 | description = '' | |
17 | Mariadb package to use. | |
18 | ''; | |
19 | }; | |
20 | credentials = lib.mkOption { | |
21 | default = {}; | |
22 | description = "Credentials"; | |
23 | type = lib.types.attrsOf lib.types.str; | |
24 | }; | |
25 | ldapConfig = lib.mkOption { | |
26 | description = "LDAP configuration to allow PAM identification via LDAP"; | |
27 | type = lib.types.submodule { | |
28 | options = { | |
29 | host = lib.mkOption { type = lib.types.str; }; | |
30 | base = lib.mkOption { type = lib.types.str; }; | |
31 | dn = lib.mkOption { type = lib.types.str; }; | |
32 | password = lib.mkOption { type = lib.types.str; }; | |
33 | filter = lib.mkOption { type = lib.types.str; }; | |
34 | }; | |
35 | }; | |
36 | }; | |
37 | dataDir = lib.mkOption { | |
38 | type = lib.types.path; | |
39 | default = "/var/lib/mysql"; | |
40 | description = '' | |
41 | The directory where Mariadb stores its data. | |
42 | ''; | |
43 | }; | |
44 | # Output variables | |
45 | socketsDir = lib.mkOption { | |
46 | type = lib.types.path; | |
47 | default = "/run/mysqld"; | |
48 | description = '' | |
49 | The directory where Mariadb puts sockets. | |
50 | ''; | |
51 | }; | |
52 | sockets = lib.mkOption { | |
53 | type = lib.types.attrsOf lib.types.path; | |
54 | default = { | |
55 | mysqld = "${cfg.socketsDir}/mysqld.sock"; | |
56 | }; | |
57 | readOnly = true; | |
58 | description = '' | |
59 | Mariadb sockets | |
60 | ''; | |
61 | }; | |
62 | }; | |
63 | }; | |
64 | ||
65 | config = lib.mkIf cfg.enable { | |
66 | networking.firewall.allowedTCPPorts = [ 3306 ]; | |
67 | ||
68 | # for adminer, ssl is implemented with mysqli only, which is | |
69 | # currently disabled because it’s not compatible with pam. | |
70 | # Thus we need to generate two users for each 'remote': one remote | |
71 | # with SSL, and one localhost without SSL. | |
72 | # User identified by LDAP: | |
73 | # CREATE USER foo@% IDENTIFIED VIA pam USING 'mysql' REQUIRE SSL; | |
74 | # CREATE USER foo@localhost IDENTIFIED VIA pam USING 'mysql'; | |
75 | services.mysql = { | |
76 | enable = true; | |
77 | package = cfg.package; | |
78 | dataDir = cfg.dataDir; | |
79 | extraOptions = '' | |
80 | ssl_ca = ${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt | |
81 | ssl_key = ${config.security.acme.directory}/mysql/key.pem | |
82 | ssl_cert = ${config.security.acme.directory}/mysql/fullchain.pem | |
83 | ''; | |
84 | }; | |
85 | ||
86 | users.users.mysql.extraGroups = [ "keys" ]; | |
87 | security.acme.certs."mysql" = config.myServices.databasesCerts // { | |
88 | user = "mysql"; | |
89 | group = "mysql"; | |
90 | plugins = [ "fullchain.pem" "key.pem" "account_key.json" ]; | |
91 | domain = "db-1.immae.eu"; | |
92 | postRun = '' | |
93 | systemctl restart mysql.service | |
94 | ''; | |
95 | }; | |
96 | ||
97 | secrets.keys = [ | |
98 | { | |
99 | dest = "mysql/mysqldump"; | |
100 | permissions = "0400"; | |
101 | user = "root"; | |
102 | group = "root"; | |
103 | text = '' | |
104 | [mysqldump] | |
105 | user = root | |
106 | password = ${cfg.credentials.root} | |
107 | ''; | |
108 | } | |
109 | { | |
110 | dest = "mysql/pam"; | |
111 | permissions = "0400"; | |
112 | user = "mysql"; | |
113 | group = "mysql"; | |
114 | text = with cfg.ldapConfig; '' | |
115 | host ${host} | |
116 | base ${base} | |
117 | binddn ${dn} | |
118 | bindpw ${password} | |
119 | pam_filter ${filter} | |
120 | ssl start_tls | |
121 | ''; | |
122 | } | |
123 | ]; | |
124 | ||
125 | services.cron = { | |
126 | enable = true; | |
127 | systemCronJobs = [ | |
128 | '' | |
129 | 30 1,13 * * * root ${cfg.package}/bin/mysqldump --defaults-file=${config.secrets.location}/mysql/mysqldump --all-databases > ${cfg.dataDir}/backup.sql | |
130 | '' | |
131 | ]; | |
132 | }; | |
133 | ||
134 | security.pam.services = let | |
135 | pam_ldap = "${pkgs.pam_ldap}/lib/security/pam_ldap.so"; | |
136 | in [ | |
137 | { | |
138 | name = "mysql"; | |
139 | text = '' | |
140 | # https://mariadb.com/kb/en/mariadb/pam-authentication-plugin/ | |
141 | auth required ${pam_ldap} config=${config.secrets.location}/mysql/pam | |
142 | account required ${pam_ldap} config=${config.secrets.location}/mysql/pam | |
143 | ''; | |
144 | } | |
145 | ]; | |
146 | ||
147 | }; | |
148 | } | |
149 |