1 { lib, pkgs, config, ... }:
3 cfg = config.myServices.databases.openldap;
5 kerberosSchema = pkgs.fetchurl {
6 url = "https://raw.githubusercontent.com/krb5/krb5/master/src/plugins/kdb/ldap/libkdb_ldap/kerberos.schema";
7 sha256 = "17fnkkf6s3lznsl7wp6914pqsc78d038rh38l638big8z608ksww";
9 puppetSchema = pkgs.fetchurl {
10 url = "https://raw.githubusercontent.com/puppetlabs/puppet/master/ext/ldap/puppet.schema";
11 sha256 = "11bjf5zfvqlim7p9vddcafs0wiq3v8ys77x8h6fbp9c6bdfh0awh";
14 include ${pkgs.openldap}/etc/schema/core.schema
15 include ${pkgs.openldap}/etc/schema/cosine.schema
16 include ${pkgs.openldap}/etc/schema/inetorgperson.schema
17 include ${pkgs.openldap}/etc/schema/nis.schema
18 include ${puppetSchema}
19 include ${kerberosSchema}
20 include ${./immae.schema}
22 pidfile ${cfg.pids.pid}
23 argsfile ${cfg.pids.args}
30 suffix "${cfg.baseDn}"
31 rootdn "${cfg.rootDn}"
32 include ${config.secrets.location}/ldap/password
33 directory ${cfg.dataDir}
36 TLSCertificateFile ${config.security.acme.directory}/ldap/cert.pem
37 TLSCertificateKeyFile ${config.security.acme.directory}/ldap/key.pem
38 TLSCACertificateFile ${config.security.acme.directory}/ldap/fullchain.pem
39 TLSCACertificatePath ${pkgs.cacert.unbundled}/etc/ssl/certs/
40 #This makes openldap crash
41 #TLSCipherSuite DEFAULT
43 sasl-host kerberos.immae.eu
44 include ${config.secrets.location}/ldap/access
48 options.myServices.databases = {
50 enable = lib.mkOption {
53 description = "Whether to enable ldap";
54 type = lib.types.bool;
56 baseDn = lib.mkOption {
62 rootDn = lib.mkOption {
68 rootPw = lib.mkOption {
71 Root (Hashed) password
74 accessFile = lib.mkOption {
75 type = lib.types.path;
77 The file path that defines the access
80 dataDir = lib.mkOption {
81 type = lib.types.path;
82 default = "/var/lib/openldap";
84 The directory where Openldap stores its data.
87 socketsDir = lib.mkOption {
88 type = lib.types.path;
89 default = "/run/slapd";
91 The directory where Openldap puts sockets and pid files.
96 type = lib.types.attrsOf lib.types.path;
98 pid = "${cfg.socketsDir}/slapd.pid";
99 args = "${cfg.socketsDir}/slapd.args";
109 config = lib.mkIf cfg.enable {
112 dest = "ldap/password";
113 permissions = "0400";
116 text = "rootpw ${cfg.rootPw}";
119 dest = "ldap/access";
120 permissions = "0400";
123 text = builtins.readFile "${cfg.accessFile}";
126 users.users.openldap.extraGroups = [ "keys" ];
127 networking.firewall.allowedTCPPorts = [ 636 389 ];
132 35 1,13 * * * root ${pkgs.openldap}/bin/slapcat -v -b "dc=immae,dc=eu" -f ${pkgs.writeText "slapd.conf" ldapConfig} -l ${cfg.dataDir}/backup.ldif | ${pkgs.gnugrep}/bin/grep -v "^# id=[0-9a-f]*$"
137 security.acme.certs."ldap" = config.myServices.databasesCerts // {
140 plugins = [ "fullchain.pem" "key.pem" "cert.pem" "account_key.json" ];
141 domain = "ldap.immae.eu";
143 systemctl restart openldap.service
147 services.filesWatcher.openldap = {
149 paths = [ "${config.secrets.location}/ldap/" ];
152 services.openldap = {
154 dataDir = cfg.dataDir;
155 urlList = [ "ldap://" "ldaps://" ];
156 extraConfig = ldapConfig;