X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;f=nixops%2Fmodules%2Fdatabases%2Fmysql.nix;h=23b8b909b66ead7be53895b5a01765bc4f9b5903;hb=1a7188052f235fb632700478fad0108e4306107d;hp=635f212c2d49a48ccb62d06d1376ca0281162a62;hpb=2368a4b7e827b985c3758ad0bfe13e4a08d27c36;p=perso%2FImmae%2FConfig%2FNix.git

diff --git a/nixops/modules/databases/mysql.nix b/nixops/modules/databases/mysql.nix
index 635f212..23b8b90 100644
--- a/nixops/modules/databases/mysql.nix
+++ b/nixops/modules/databases/mysql.nix
@@ -14,14 +14,6 @@ in {
   };
 
   config = lib.mkIf cfg.enable {
-    nixpkgs.overlays = [ (self: super: rec {
-      mariadb = mariadbPAM;
-      mariadbPAM = super.mariadb.overrideAttrs(old: rec {
-        cmakeFlags = old.cmakeFlags ++ [ "-DWITH_AUTHENTICATION_PAM=ON" ];
-        buildInputs = old.buildInputs ++ [ self.pam ];
-      });
-    }) ];
-
     networking.firewall.allowedTCPPorts = [ 3306 ];
 
     # for adminer, ssl is implemented with mysqli only, which is
@@ -41,6 +33,7 @@ in {
         '';
     };
 
+    users.users.mysql.extraGroups = [ "keys" ];
     security.acme.certs."mysql" = config.services.myCertificates.certConfig // {
       user = "mysql";
       group = "mysql";
@@ -51,39 +44,52 @@ in {
       '';
     };
 
-    services.cron = {
-      enable = true;
-      systemCronJobs = let
-        mycnf = pkgs.writeText "my.cnf" ''
+    secrets.keys = [
+      {
+        dest = "mysql/mysqldump";
+        permissions = "0400";
+        user = "root";
+        group = "root";
+        text = ''
           [mysqldump]
           user = root
           password = ${myconfig.env.databases.mysql.systemUsers.root}
+        '';
+      }
+      {
+        dest = "mysql/pam";
+        permissions = "0400";
+        user = "mysql";
+        group = "mysql";
+        text = with myconfig.env.databases.mysql.pam; ''
+          host ${myconfig.env.ldap.host}
+          base ${myconfig.env.ldap.base}
+          binddn ${dn}
+          bindpw ${password}
+          pam_filter ${filter}
+          ssl start_tls
           '';
-      in [
+      }
+    ];
+
+    services.cron = {
+      enable = true;
+      systemCronJobs = [
         ''
-          30 1,13 * * * root ${pkgs.mariadb}/bin/mysqldump --defaults-file=${mycnf} --all-databases > /var/lib/mysql/backup.sql
+          30 1,13 * * * root ${pkgs.mariadb}/bin/mysqldump --defaults-file=/var/secrets/mysql/mysqldump --all-databases > /var/lib/mysql/backup.sql
         ''
       ];
     };
 
     security.pam.services = let
       pam_ldap = "${pkgs.pam_ldap}/lib/security/pam_ldap.so";
-      pam_ldap_mysql = with myconfig.env.databases.mysql.pam;
-        pkgs.writeText "mysql.conf" ''
-        host ${myconfig.env.ldap.host}
-        base ${myconfig.env.ldap.base}
-        binddn ${dn}
-        bindpw ${password}
-        pam_filter ${filter}
-        ssl start_tls
-        '';
     in [
       {
         name = "mysql";
         text = ''
           # https://mariadb.com/kb/en/mariadb/pam-authentication-plugin/
-          auth    required ${pam_ldap} config=${pam_ldap_mysql}
-          account required ${pam_ldap} config=${pam_ldap_mysql}
+          auth    required ${pam_ldap} config=/var/secrets/mysql/pam
+          account required ${pam_ldap} config=/var/secrets/mysql/pam
           '';
       }
     ];