1 { lib, pkgs, config, myconfig, ... }:
3 cfg = config.services.myDatabases;
5 kerberosSchema = pkgs.fetchurl {
6 url = "https://raw.githubusercontent.com/krb5/krb5/master/src/plugins/kdb/ldap/libkdb_ldap/kerberos.schema";
7 sha256 = "17fnkkf6s3lznsl7wp6914pqsc78d038rh38l638big8z608ksww";
9 puppetSchema = pkgs.fetchurl {
10 url = "https://raw.githubusercontent.com/puppetlabs/puppet/master/ext/ldap/puppet.schema";
11 sha256 = "11bjf5zfvqlim7p9vddcafs0wiq3v8ys77x8h6fbp9c6bdfh0awh";
14 include ${pkgs.openldap}/etc/schema/core.schema
15 include ${pkgs.openldap}/etc/schema/cosine.schema
16 include ${pkgs.openldap}/etc/schema/inetorgperson.schema
17 include ${pkgs.openldap}/etc/schema/nis.schema
18 include ${puppetSchema}
19 include ${kerberosSchema}
20 include ${./immae.schema}
22 pidfile /run/slapd/slapd.pid
23 argsfile /run/slapd/slapd.args
30 suffix "${myconfig.env.ldap.base}"
31 rootdn "${myconfig.env.ldap.root_dn}"
32 include /var/secrets/ldap/password
33 directory /var/lib/openldap
36 TLSCertificateFile /var/lib/acme/ldap/cert.pem
37 TLSCertificateKeyFile /var/lib/acme/ldap/key.pem
38 TLSCACertificateFile /var/lib/acme/ldap/fullchain.pem
39 TLSCACertificatePath ${pkgs.cacert.unbundled}/etc/ssl/certs/
40 #This makes openldap crash
41 #TLSCipherSuite DEFAULT
43 sasl-host kerberos.immae.eu
44 include /var/secrets/ldap/access
47 options.services.myDatabases = {
49 enable = lib.mkOption {
52 description = "Whether to enable ldap";
53 type = lib.types.bool;
58 config = lib.mkIf cfg.enable {
61 dest = "ldap/password";
65 text = "rootpw ${myconfig.env.ldap.root_pw}";
68 dest = "ldap/access ";
72 text = builtins.readFile "${myconfig.privateFiles}/ldap.conf";
75 users.users.openldap.extraGroups = [ "keys" ];
76 networking.firewall.allowedTCPPorts = [ 636 389 ];
81 35 1,13 * * * root ${pkgs.openldap}/bin/slapcat -v -b "dc=immae,dc=eu" -f ${pkgs.writeText "slapd.conf" ldapConfig} -l /var/lib/openldap/backup.ldif | ${pkgs.gnugrep}/bin/grep -v "^# id=[0-9a-f]*$"
86 security.acme.certs."ldap" = config.services.myCertificates.certConfig // {
89 plugins = [ "fullchain.pem" "key.pem" "cert.pem" "account_key.json" ];
90 domain = "ldap.immae.eu";
92 systemctl restart openldap.service
97 enable = config.services.myDatabases.ldap.enable;
98 dataDir = "/var/lib/openldap";
99 urlList = [ "ldap://" "ldaps://" ];
100 extraConfig = ldapConfig;