- security.pam.services = let
- pam_ldap = "${pkgs.pam_ldap}/lib/security/pam_ldap.so";
- pam_ldap_postgresql = with myconfig.env.databases.postgresql.pam;
- pkgs.writeText "postgresql.conf" ''
- host ${myconfig.env.ldap.host}
- base ${myconfig.env.ldap.base}
- binddn ${dn}
- bindpw ${password}
- pam_filter ${filter}
- ssl start_tls
+ deployment.keys = {
+ postgresql-pam = {
+ destDir = "/run/keys/postgresql";
+ permissions = "0400";
+ group = "postgres";
+ user = "postgres";
+ text = with myconfig.env.databases.postgresql.pam; ''
+ host ${myconfig.env.ldap.host}
+ base ${myconfig.env.ldap.base}
+ binddn ${dn}
+ bindpw ${password}
+ pam_filter ${filter}
+ ssl start_tls