Christophe Carpentier site de Fans de HK

[perso/Immae/Config/Nix.git] / modules / private / databases / postgresql.nix

diff --git a/modules/private/databases/postgresql.nix b/modules/private/databases/postgresql.nix
index d0b1a7569b8276d7aa8d3ba5b1c225905d2d03a9..fdab2f0bd6427c99b4a6e02d93630ba2b5c7b586 100644 (file)
--- a/modules/private/databases/postgresql.nix
+++ b/modules/private/databases/postgresql.nix
@@ -100,7 +100,6 @@ in {
     security.acme.certs."postgresql" = config.myServices.databasesCerts // {
       user = "postgres";
       group = "postgres";
-      plugins = [ "fullchain.pem" "key.pem" "account_key.json" "account_reg.json" ];
       domain = "db-1.immae.eu";
       postRun = ''
         systemctl reload postgresql.service
@@ -160,7 +159,7 @@ in {
       authentication = let
         hosts = builtins.concatStringsSep "\n" (
           lib.lists.flatten (lib.mapAttrsToList (k: vs: map (v:
-            map (ip6: "hostssl ${v.database}   ${v.username}   ${ip6}/128      ${v.method}") v.ip6
+            map (ip6: "hostssl ${v.database}   ${v.username}   ${ip6}  ${v.method}") v.ip6
             ++ map (ip4: "hostssl      ${v.database}   ${v.username}   ${ip4}/32               ${v.method}") v.ip4
           ) vs) cfg.authorizedHosts
         ));
@@ -179,9 +178,8 @@ in {
       '';
     };
 
-    secrets.keys = [
-      {
-        dest = "postgresql/pam";
+    secrets.keys = {
+      "postgresql/pam" = {
         permissions = "0400";
         group = "postgres";
         user = "postgres";
@@ -193,9 +191,8 @@ in {
           pam_filter ${filter}
           ssl start_tls
         '';
-      }
-      {
-        dest = "postgresql/pam_replication";
+      };
+      "postgresql/pam_replication" = {
         permissions = "0400";
         group = "postgres";
         user = "postgres";
@@ -207,27 +204,25 @@ in {
           pam_login_attribute cn
           ssl start_tls
         '';
-      }
-    ];
+      };
+    };
 
     security.pam.services = let
       pam_ldap = "${pkgs.pam_ldap}/lib/security/pam_ldap.so";
-    in [
-      {
-        name = "postgresql";
+    in {
+      postgresql = {
         text = ''
-          auth    required ${pam_ldap} config=${config.secrets.location}/postgresql/pam
-          account required ${pam_ldap} config=${config.secrets.location}/postgresql/pam
+          auth    required ${pam_ldap} config=${config.secrets.fullPaths."postgresql/pam"}
+          account required ${pam_ldap} config=${config.secrets.fullPaths."postgresql/pam"}
           '';
-      }
-      {
-        name = "postgresql_replication";
+      };
+      postgresql_replication = {
         text = ''
-          auth    required ${pam_ldap} config=${config.secrets.location}/postgresql/pam_replication
-          account required ${pam_ldap} config=${config.secrets.location}/postgresql/pam_replication
+          auth    required ${pam_ldap} config=${config.secrets.fullPaths."postgresql/pam_replication"}
+          account required ${pam_ldap} config=${config.secrets.fullPaths."postgresql/pam_replication"}
           '';
-      }
-    ];
+      };
+    };
   };
 }