+ # FIXME: environment variables ?
+ security.pam.services = let
+ pam_ldap = pkgs.pam_ldap;
+ pam_ldap_mysql = pkgs.writeText "mysql.conf" ''
+ host ldap.immae.eu
+ base dc=immae,dc=eu
+ binddn cn=mysql,cn=pam,ou=services,dc=immae,dc=eu
+ bindpw ${builtins.getEnv "NIXOPS_MYSQL_PAM_PASSWORD"}
+ pam_filter memberOf=cn=users,cn=mysql,cn=pam,ou=services,dc=immae,dc=eu
+ '';
+ in [
+ {
+ name = "mysql";
+ text = ''
+ # https://mariadb.com/kb/en/mariadb/pam-authentication-plugin/
+ auth required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_mysql}
+ account required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_mysql}
+ '';
+ }
+ ];
+
+ # FIXME: initial sync
+ # FIXME: backup
+ # FIXME: restart after pam
+ # FIXME: pam access doesn’t work (because of php module)
+ services.mysql = rec {
+ enable = true;
+ package = pkgs.mariadb.overrideAttrs(old: rec {
+ cmakeFlags = old.cmakeFlags ++ [ "-DWITH_AUTHENTICATION_PAM=ON" ];
+ buildInputs = old.buildInputs ++ [ pkgs.pam ];
+ });
+ };
+