1 { pkgs, config, lib, ... }:
3 cfg = config.myServices.databasesReplication.openldap;
4 eldiron_schemas = pkgs.callPackage ./openldap/eldiron_schemas.nix {};
5 ldapConfig = hcfg: name: pkgs.writeText "slapd.conf" ''
6 include ${pkgs.openldap}/etc/schema/core.schema
7 include ${pkgs.openldap}/etc/schema/cosine.schema
8 include ${pkgs.openldap}/etc/schema/inetorgperson.schema
9 include ${pkgs.openldap}/etc/schema/nis.schema
11 pidfile /run/slapd_${name}/slapd.pid
12 argsfile /run/slapd_${name}/slapd.args
19 rootdn "cn=root,${hcfg.base}"
20 directory ${cfg.base}/${name}/openldap
26 include ${config.secrets.fullPaths."openldap_replication/${name}/replication_config"}
30 options.myServices.databasesReplication.openldap = {
31 enable = lib.mkEnableOption "Enable openldap replication";
33 type = lib.types.path;
35 Base path to put the replications
38 hosts = lib.mkOption {
43 type = lib.types.attrsOf (lib.types.submodule {
45 package = lib.mkOption {
46 type = lib.types.package;
47 default = pkgs.openldap;
49 Openldap package for this host
70 password = lib.mkOption {
81 config = lib.mkIf cfg.enable {
82 users.users.openldap = {
83 description = "Openldap database user";
85 uid = config.ids.uids.openldap;
86 extraGroups = [ "keys" ];
88 users.groups.openldap.gid = config.ids.gids.openldap;
90 secrets.keys = lib.listToAttrs (lib.flatten (lib.mapAttrsToList (name: hcfg: [
91 (lib.nameValuePair "openldap_replication/${name}/replication_config" {
98 type=refreshAndPersist
99 searchbase="${hcfg.base}"
105 credentials="${hcfg.password}"
108 (lib.nameValuePair "openldap_replication/${name}/replication_password" {
111 permissions = "0400";
112 text = hcfg.password;
118 systemCronJobs = lib.flatten (lib.mapAttrsToList (name: hcfg:
120 dataDir = "${cfg.base}/${name}/openldap";
121 backupDir = "${cfg.base}/${name}/openldap_backup";
122 backup_script = pkgs.writeScript "backup_openldap_${name}" ''
123 #!${pkgs.stdenv.shell}
125 ${hcfg.package}/bin/slapcat -b "${hcfg.base}" -f ${ldapConfig hcfg name} -l ${backupDir}/$(${pkgs.coreutils}/bin/date -Iminutes).ldif
127 u = pkgs.callPackage ./utils.nix {};
128 cleanup_script = pkgs.writeScript "cleanup_openldap_${name}" (u.exponentialDumps "ldif" backupDir);
130 "0 22,4,10,16 * * * root ${backup_script}"
131 "0 3 * * * root ${cleanup_script}"
135 system.activationScripts = lib.attrsets.mapAttrs' (name: hcfg:
136 lib.attrsets.nameValuePair "openldap_replication_${name}" {
137 deps = [ "users" "groups" ];
139 install -m 0700 -o openldap -g openldap -d ${cfg.base}/${name}/openldap
140 install -m 0700 -o openldap -g openldap -d ${cfg.base}/${name}/openldap_backup
144 systemd.services = lib.attrsets.mapAttrs' (name: hcfg:
146 dataDir = "${cfg.base}/${name}/openldap";
148 lib.attrsets.nameValuePair "openldap_backup_${name}" {
149 description = "Openldap replication for ${name}";
150 wantedBy = [ "multi-user.target" ];
151 after = [ "network.target" ];
152 unitConfig.RequiresMountsFor = dataDir;
155 mkdir -p /run/slapd_${name}
156 chown -R "openldap:openldap" /run/slapd_${name}
160 ExecStart = "${hcfg.package}/libexec/slapd -d 0 -u openldap -g openldap -f ${ldapConfig hcfg name}";