1 { lib, pkgs, config, myconfig, mylibs, ... }:
3 cfg = config.services.myDatabases;
5 options.services.myDatabases = {
7 enable = lib.mkOption {
10 description = "Whether to enable postgresql database";
11 type = lib.types.bool;
16 config = lib.mkIf cfg.enable {
17 nixpkgs.overlays = [ (self: super: rec {
18 postgresql = postgresql_11;
19 postgresql_11 = super.postgresql_11.overrideAttrs(old: rec {
20 passthru = old.passthru // { psqlSchema = "11.0"; };
21 configureFlags = old.configureFlags ++ [ "--with-pam" ];
22 buildInputs = (old.buildInputs or []) ++ [ self.pam ];
23 patches = old.patches ++ [
24 ./postgresql_run_socket_path.patch
29 networking.firewall.allowedTCPPorts = [ 5432 ];
31 security.acme.certs."postgresql" = config.services.myCertificates.certConfig // {
34 plugins = [ "fullchain.pem" "key.pem" "account_key.json" ];
35 domain = "db-1.immae.eu";
37 systemctl reload postgresql.service
41 system.activationScripts.postgresql = ''
42 install -m 0755 -o postgres -g postgres -d ${myconfig.env.databases.postgresql.socket}
45 systemd.services.postgresql.serviceConfig.SupplementaryGroups = "keys";
46 services.postgresql = rec {
47 enable = cfg.postgresql.enable;
48 package = pkgs.postgresql;
53 shared_buffers = 512MB
57 log_timezone = 'Europe/Paris'
58 datestyle = 'iso, mdy'
59 timezone = 'Europe/Paris'
60 lc_messages = 'en_US.UTF-8'
61 lc_monetary = 'en_US.UTF-8'
62 lc_numeric = 'en_US.UTF-8'
63 lc_time = 'en_US.UTF-8'
64 default_text_search_config = 'pg_catalog.english'
66 ssl_cert_file = '/var/lib/acme/postgresql/fullchain.pem'
67 ssl_key_file = '/var/lib/acme/postgresql/key.pem'
70 local all postgres ident
72 hostssl all all 188.165.209.148/32 md5
73 hostssl all all 178.33.252.96/32 md5
74 hostssl all all all pam
75 hostssl replication backup-1 2001:41d0:302:1100::9:e5a9/128 pam pamservice=postgresql_replication
76 hostssl replication backup-1 54.37.151.137/32 pam pamservice=postgresql_replication
82 dest = "postgresql/pam";
86 text = with myconfig.env.databases.postgresql.pam; ''
87 host ${myconfig.env.ldap.host}
88 base ${myconfig.env.ldap.base}
96 dest = "postgresql/pam_replication";
101 host ${myconfig.env.ldap.host}
102 base ${myconfig.env.ldap.base}
103 binddn ${myconfig.env.ldap.host_dn}
104 bindpw ${myconfig.env.ldap.password}
105 pam_login_attribute cn
111 security.pam.services = let
112 pam_ldap = "${pkgs.pam_ldap}/lib/security/pam_ldap.so";
117 auth required ${pam_ldap} config=/var/secrets/postgresql/pam
118 account required ${pam_ldap} config=/var/secrets/postgresql/pam
122 name = "postgresql_replication";
124 auth required ${pam_ldap} config=/var/secrets/postgresql/pam_replication
125 account required ${pam_ldap} config=/var/secrets/postgresql/pam_replication