1 { lib, pkgs, config, myconfig, mylibs, ... }:
3 cfg = config.services.myDatabases;
5 options.services.myDatabases = {
7 enable = lib.mkOption {
10 description = "Whether to enable mariadb database";
11 type = lib.types.bool;
16 config = lib.mkIf cfg.enable {
17 networking.firewall.allowedTCPPorts = [ 3306 ];
19 # for adminer, ssl is implemented with mysqli only, which is
20 # currently disabled because it’s not compatible with pam.
21 # Thus we need to generate two users for each 'remote': one remote
22 # with SSL, and one localhost without SSL.
23 # User identified by LDAP:
24 # CREATE USER foo@% IDENTIFIED VIA pam USING 'mysql' REQUIRE SSL;
25 # CREATE USER foo@localhost IDENTIFIED VIA pam USING 'mysql';
26 services.mysql = rec {
27 enable = cfg.mariadb.enable;
28 package = pkgs.mariadb;
30 ssl_ca = ${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt
31 ssl_key = /var/lib/acme/mysql/key.pem
32 ssl_cert = /var/lib/acme/mysql/fullchain.pem
36 users.users.mysql.extraGroups = [ "keys" ];
37 security.acme.certs."mysql" = config.services.myCertificates.certConfig // {
40 plugins = [ "fullchain.pem" "key.pem" "account_key.json" ];
41 domain = "db-1.immae.eu";
43 systemctl restart mysql.service
49 dest = "mysql/mysqldump";
56 password = ${myconfig.env.databases.mysql.systemUsers.root}
64 text = with myconfig.env.databases.mysql.pam; ''
65 host ${myconfig.env.ldap.host}
66 base ${myconfig.env.ldap.base}
79 30 1,13 * * * root ${pkgs.mariadb}/bin/mysqldump --defaults-file=/var/secrets/mysql/mysqldump --all-databases > /var/lib/mysql/backup.sql
84 security.pam.services = let
85 pam_ldap = "${pkgs.pam_ldap}/lib/security/pam_ldap.so";
90 # https://mariadb.com/kb/en/mariadb/pam-authentication-plugin/
91 auth required ${pam_ldap} config=/var/secrets/mysql/pam
92 account required ${pam_ldap} config=/var/secrets/mysql/pam