1 { lib, pkgs, config, ... }:
3 cfg = config.myServices.databases.openldap;
6 options.myServices.databases = {
8 enable = lib.mkOption {
11 description = "Whether to enable ldap";
12 type = lib.types.bool;
14 baseDn = lib.mkOption {
20 rootDn = lib.mkOption {
26 rootPw = lib.mkOption {
29 Root (Hashed) password
32 accessFile = lib.mkOption {
33 type = lib.types.path;
35 The file path that defines the access
38 dataDir = lib.mkOption {
39 type = lib.types.path;
40 default = "/var/lib/openldap";
42 The directory where Openldap stores its data.
45 socketsDir = lib.mkOption {
46 type = lib.types.path;
47 default = "/run/slapd";
49 The directory where Openldap puts sockets and pid files.
54 type = lib.types.attrsOf lib.types.path;
56 pid = "${cfg.socketsDir}/slapd.pid";
57 args = "${cfg.socketsDir}/slapd.args";
67 config = lib.mkIf cfg.enable {
73 text = "${cfg.rootPw}";
79 text = builtins.readFile cfg.accessFile;
88 users.users.openldap.extraGroups = [ "keys" ];
89 networking.firewall.allowedTCPPorts = [ 636 389 ];
91 security.acme.certs."ldap" = config.myServices.databasesCerts // {
93 domain = "ldap.immae.eu";
95 systemctl restart openldap.service
99 services.filesWatcher.openldap = {
101 paths = [ config.secrets.fullPaths."ldap" ];
104 services.openldap = {
106 urlList = [ "ldap://" "ldaps://" ];
109 olcPidFile = cfg.pids.pid;
110 olcArgsFile = cfg.pids.args;
111 olcLogLevel = "none";
112 olcTLSCertificateFile = "${config.security.acme.certs.ldap.directory}/cert.pem";
113 olcTLSCertificateKeyFile = "${config.security.acme.certs.ldap.directory}/key.pem";
114 olcTLSCACertificateFile = "${config.security.acme.certs.ldap.directory}/fullchain.pem";
115 olcTLSCACertificatePath = "${pkgs.cacert.unbundled}/etc/ssl/certs/";
116 # This makes openldap crash
117 # olcTLSCipherSuite = "DEFAULT";
118 olcSaslHost = "kerberos.immae.eu";
119 # Map sasl "dn" to ldap dn
120 olcAuthzRegexp = ''{0}"uid=([^,]*)(,cn=IMMAE.EU)?,cn=(gssapi|gss-spnego),cn=auth" "uid=$1,ou=users,dc=immae,dc=eu"'';
126 objectClass = [ "olcModuleList" ];
127 olcModuleLoad = [ "{0}back_hdb" "{1}memberof" "{2}syncprov" ];
130 "cn=schema".includes = map (schema:
131 "${config.services.openldap.package}/etc/schema/${schema}.ldif"
132 ) [ "core" "cosine" "inetorgperson" "nis" ] ++ [
135 "olcDatabase={0}config" = {
137 objectClass = "olcDatabaseConfig";
138 olcDatabase = "{0}config";
139 olcAccess = ["{0}to * by * none"];
142 "olcDatabase={1}hdb" = {
144 objectClass = [ "olcDatabaseConfig" "olcHdbConfig" ];
145 olcDatabase = "{1}hdb";
157 join = builtins.replaceStrings ["\n"] [" "];
159 # First matching "to" + "by" wins
160 #### Replication needs full access
162 by dn.base="uid=ldap_replication,cn=ldap,ou=services,dc=immae,dc=eu" read
165 #### Kerberos needs access to users password
166 (join ''{1}to attrs=userPassword,shadowLastChange
172 (join ''{2}to attrs=immaeSshKey
177 #### Anyone can auth, and I can see myself
184 #### Specific access for phpldapadmin
185 (join ''{4}to filter="(uid=*)" attrs=entry,uid
186 by dn.base="cn=phpldapadmin,ou=services,dc=immae,dc=eu" read
191 # The attributes are available to every host
192 (join ''{5}to dn.one="ou=hosts,dc=immae,dc=eu"
193 by dn.subtree="ou=hosts,dc=immae,dc=eu" read
194 by dn.base="dc=immae,dc=eu" search
200 # this/-* & user : all your ancestors have access to you
201 # this/memberOf/-* & user : all those whom you belong to (in a group),
202 # and their ancestors, have access to you
203 # user/immaeAccessWriteDn*/member & this : you have write access to the
204 # members of your immaeAccessDn
206 # user/immaeAccessDn*/member & this : you have access to the members
207 # of your immaeAccessDn attributes
208 # user/immaeAccessReadSubtree* & this/-* : you have access to the
209 # childrens of your immaeAccessReadSubtree
211 # this/memberOf/-* & user/immaeAccessReadSubtree*: you have access to
212 # the members of the childrens of your
213 # immaeAccessReadSubtree attributes
214 # http://www.openldap.org/faq/data/cache/1133.html
215 (join ''{6}to dn.subtree="dc=immae,dc=eu"
216 by dn.subtree="ou=external_services,dc=immae,dc=eu" break
217 by set.exact="this/-* & user" read
218 by set.exact="this/memberOf/-* & user" read
219 by set.exact="user/immaeAccessWriteDn*/member & this" write
220 by set.exact="user/immaeAccessDn*/member & this" read
221 by set.exact="user/immaeAccessReadSubtree* & this/-*" read
222 by set.exact="this/memberOf/-* & user/immaeAccessReadSubtree*" read
228 #### External services
229 # http://www.openldap.org/faq/data/cache/429.html
230 # FIXME: Find a way to whitelist?
231 (join ''{7}to attrs=immaeSshKey
232 by dn.subtree="ou=external_services,dc=immae,dc=eu" none
234 (join ''{8}to dn.subtree="dc=immae,dc=eu"
235 by set.exact="this/-* & user" read
236 by set.exact="this/memberOf/-* & user" read
237 by set.exact="user/immaeAccessDn*/member & this/-*" read
241 #### /External services
243 olcDbDirectory = cfg.dataDir;
244 olcRootDN = cfg.rootDn;
245 olcRootPW.path = config.secrets.fullPaths."ldap/password";
246 olcSuffix = cfg.baseDn;
249 "olcOverlay={0}memberof" = {
251 objectClass = [ "olcOverlayConfig" "olcMemberOf" ];
252 olcOverlay = "{0}memberof";
255 "olcOverlay={1}syncprov" = {
257 objectClass = [ "olcOverlayConfig" "olcSyncProvConfig" ];
258 olcOverlay = "{1}syncprov";
259 olcSpCheckpoint = "100 10";