-{ lib, pkgs, config, myconfig, mylibs, ... }:
+{ lib, pkgs, config, myconfig, ... }:
let
cfg = config.services.myDatabases;
in {
};
config = lib.mkIf cfg.enable {
- nixpkgs.config.packageOverrides = oldpkgs: rec {
- postgresql = postgresql111;
- postgresql111 = oldpkgs.postgresql100.overrideAttrs(old: rec {
- passthru = old.passthru // { psqlSchema = "11.0"; };
- name = "postgresql-11.1";
- src = pkgs.fetchurl {
- url = "mirror://postgresql/source/v11.1/${name}.tar.bz2";
- sha256 = "026v0sicsh7avzi45waf8shcbhivyxmi7qgn9fd1x0vl520mx0ch";
- };
- configureFlags = old.configureFlags ++ [ "--with-pam" ];
- buildInputs = (old.buildInputs or []) ++ [ pkgs.pam ];
- patches = old.patches ++ [
- ./postgresql_run_socket_path.patch
- ];
- });
- };
+ nixpkgs.overlays = [ (self: super: rec {
+ postgresql = self.postgresql_11_custom;
+ }) ];
networking.firewall.allowedTCPPorts = [ 5432 ];
install -m 0755 -o postgres -g postgres -d ${myconfig.env.databases.postgresql.socket}
'';
+ systemd.services.postgresql.serviceConfig.SupplementaryGroups = "keys";
services.postgresql = rec {
enable = cfg.postgresql.enable;
package = pkgs.postgresql;
'';
};
- security.pam.services = let
- pam_ldap = "${pkgs.pam_ldap}/lib/security/pam_ldap.so";
- pam_ldap_postgresql = with myconfig.env.databases.postgresql.pam;
- pkgs.writeText "postgresql.conf" ''
- host ${myconfig.env.ldap.host}
- base ${myconfig.env.ldap.base}
- binddn ${dn}
- bindpw ${password}
- pam_filter ${filter}
- ssl start_tls
+ secrets.keys = [
+ {
+ dest = "postgresql/pam";
+ permissions = "0400";
+ group = "postgres";
+ user = "postgres";
+ text = with myconfig.env.databases.postgresql.pam; ''
+ host ${myconfig.env.ldap.host}
+ base ${myconfig.env.ldap.base}
+ binddn ${dn}
+ bindpw ${password}
+ pam_filter ${filter}
+ ssl start_tls
'';
- pam_ldap_postgresql_replication = pkgs.writeText "postgresql.conf" ''
- host ${myconfig.env.ldap.host}
- base ${myconfig.env.ldap.base}
- binddn ${myconfig.env.ldap.host_dn}
- bindpw ${myconfig.env.ldap.password}
- pam_login_attribute cn
- ssl start_tls
+ }
+ {
+ dest = "postgresql/pam_replication";
+ permissions = "0400";
+ group = "postgres";
+ user = "postgres";
+ text = ''
+ host ${myconfig.env.ldap.host}
+ base ${myconfig.env.ldap.base}
+ binddn ${myconfig.env.ldap.host_dn}
+ bindpw ${myconfig.env.ldap.password}
+ pam_login_attribute cn
+ ssl start_tls
'';
+ }
+ ];
+
+ security.pam.services = let
+ pam_ldap = "${pkgs.pam_ldap}/lib/security/pam_ldap.so";
in [
{
name = "postgresql";
text = ''
- auth required ${pam_ldap} config=${pam_ldap_postgresql}
- account required ${pam_ldap} config=${pam_ldap_postgresql}
+ auth required ${pam_ldap} config=/var/secrets/postgresql/pam
+ account required ${pam_ldap} config=/var/secrets/postgresql/pam
'';
}
{
name = "postgresql_replication";
text = ''
- auth required ${pam_ldap} config=${pam_ldap_postgresql_replication}
- account required ${pam_ldap} config=${pam_ldap_postgresql_replication}
+ auth required ${pam_ldap} config=/var/secrets/postgresql/pam_replication
+ account required ${pam_ldap} config=/var/secrets/postgresql/pam_replication
'';
}
];