moduleload back_hdb
backend hdb
- moduleload memberof
- database hdb
- suffix "${cfg.baseDn}"
- rootdn "${cfg.rootDn}"
- include ${config.secrets.location}/ldap/password
- directory ${cfg.dataDir}
- overlay memberof
-
- moduleload syncprov
- overlay syncprov
- syncprov-checkpoint 100 10
-
- TLSCertificateFile ${config.security.acme.directory}/ldap/cert.pem
- TLSCertificateKeyFile ${config.security.acme.directory}/ldap/key.pem
- TLSCACertificateFile ${config.security.acme.directory}/ldap/fullchain.pem
+ TLSCertificateFile ${config.security.acme.certs.ldap.directory}/cert.pem
+ TLSCertificateKeyFile ${config.security.acme.certs.ldap.directory}/key.pem
+ TLSCACertificateFile ${config.security.acme.certs.ldap.directory}/fullchain.pem
TLSCACertificatePath ${pkgs.cacert.unbundled}/etc/ssl/certs/
#This makes openldap crash
#TLSCipherSuite DEFAULT
sasl-host kerberos.immae.eu
- include ${config.secrets.location}/ldap/access
'';
in
{
security.acme.certs."ldap" = config.myServices.databasesCerts // {
user = "openldap";
group = "openldap";
- plugins = [ "fullchain.pem" "key.pem" "cert.pem" "account_key.json" ];
domain = "ldap.immae.eu";
postRun = ''
systemctl restart openldap.service
enable = true;
dataDir = cfg.dataDir;
urlList = [ "ldap://" "ldaps://" ];
+ logLevel = "none";
extraConfig = ldapConfig;
+ extraDatabaseConfig = ''
+ moduleload memberof
+ overlay memberof
+
+ moduleload syncprov
+ overlay syncprov
+ syncprov-checkpoint 100 10
+
+ include ${config.secrets.location}/ldap/access
+ '';
+ rootpwFile = "${config.secrets.location}/ldap/password";
+ suffix = cfg.baseDn;
+ rootdn = cfg.rootDn;
+ database = "hdb";
};
};
}