[perso/Immae/Config/Nix.git] / nixops / modules / databases / default.nix

{ lib, pkgs, config, myconfig, mylibs, ... }:
let
    cfg = config.services.myDatabases;
in {
  options.services.myDatabases = {
    enable = lib.mkEnableOption "my databases service";
    postgresql = {
      enable = lib.mkOption {
        default = cfg.enable;
        example = true;
        description = "Whether to enable postgresql database";
        type = lib.types.bool;
      };
    };

    mariadb = {
      enable = lib.mkOption {
        default = cfg.enable;
        example = true;
        description = "Whether to enable mariadb database";
        type = lib.types.bool;
      };
    };

    redis = {
      enable = lib.mkOption {
        default = cfg.enable;
        example = true;
        description = "Whether to enable redis database";
        type = lib.types.bool;
      };
    };

    ldap = {
      enable = lib.mkOption {
        default = cfg.enable;
        example = true;
        description = "Whether to enable ldap";
        type = lib.types.bool;
      };
    };
  };

  config = lib.mkIf cfg.enable {
    nixpkgs.config.packageOverrides = oldpkgs: rec {
      postgresql = postgresql111;
      postgresql111 = oldpkgs.postgresql100.overrideAttrs(old: rec {
        passthru = old.passthru // { psqlSchema = "11.0"; };
        name = "postgresql-11.1";
        src = pkgs.fetchurl {
          url = "mirror://postgresql/source/v11.1/${name}.tar.bz2";
          sha256 = "026v0sicsh7avzi45waf8shcbhivyxmi7qgn9fd1x0vl520mx0ch";
        };
        configureFlags = old.configureFlags ++ [ "--with-pam" ];
        buildInputs = (old.buildInputs or []) ++ [ pkgs.pam ];
        patches = old.patches ++ [
          ./postgresql_run_socket_path.patch
        ];
      });
      mariadb = mariadbPAM;
      mariadbPAM = oldpkgs.mariadb.overrideAttrs(old: rec {
        cmakeFlags = old.cmakeFlags ++ [ "-DWITH_AUTHENTICATION_PAM=ON" ];
        buildInputs = old.buildInputs ++ [ pkgs.pam ];
      });
    };

    networking.firewall.allowedTCPPorts = [ 3306 5432 636 389 ];

    # for adminer, ssl is implemented with mysqli only, which is
    # currently disabled because it’s not compatible with pam.
    # Thus we need to generate two users for each 'remote': one remote
    # with SSL, and one localhost without SSL.
    # User identified by LDAP:
    # CREATE USER foo@% IDENTIFIED VIA pam USING 'mysql' REQUIRE SSL;
    # CREATE USER foo@localhost IDENTIFIED VIA pam USING 'mysql';
    services.mysql = rec {
      enable = cfg.mariadb.enable;
      package = pkgs.mariadb;
      extraOptions = ''
        ssl_ca = ${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt
        ssl_key = /var/lib/acme/mysql/key.pem
        ssl_cert = /var/lib/acme/mysql/fullchain.pem
        '';
    };

    security.acme.certs."postgresql" = config.services.myCertificates.certConfig // {
      user = "postgres";
      group = "postgres";
      plugins = [ "fullchain.pem" "key.pem" "account_key.json" ];
      domain = "db-1.immae.eu";
      postRun = ''
        systemctl reload postgresql.service
      '';
    };

    security.acme.certs."mysql" = config.services.myCertificates.certConfig // {
      user = "mysql";
      group = "mysql";
      plugins = [ "fullchain.pem" "key.pem" "account_key.json" ];
      domain = "db-1.immae.eu";
      postRun = ''
        systemctl restart mysql.service
      '';
    };

    security.acme.certs."ldap" = config.services.myCertificates.certConfig // {
      user = "openldap";
      group = "openldap";
      plugins = [ "fullchain.pem" "key.pem" "cert.pem" "account_key.json" ];
      domain = "ldap.immae.eu";
      postRun = ''
        systemctl restart openldap.service
      '';
    };

    system.activationScripts.postgresql = ''
      install -m 0755 -o postgres -g postgres -d ${myconfig.env.databases.postgresql.socket}
      '';

    services.postgresql = rec {
      enable = cfg.postgresql.enable;
      package = pkgs.postgresql;
      enableTCPIP = true;
      extraConfig = ''
        max_connections = 100
        wal_level = logical
        shared_buffers = 512MB
        work_mem = 10MB
        max_wal_size = 1GB
        min_wal_size = 80MB
        log_timezone = 'Europe/Paris'
        datestyle = 'iso, mdy'
        timezone = 'Europe/Paris'
        lc_messages = 'en_US.UTF-8'
        lc_monetary = 'en_US.UTF-8'
        lc_numeric = 'en_US.UTF-8'
        lc_time = 'en_US.UTF-8'
        default_text_search_config = 'pg_catalog.english'
        ssl = on
        ssl_cert_file = '/var/lib/acme/postgresql/fullchain.pem'
        ssl_key_file = '/var/lib/acme/postgresql/key.pem'
        '';
      authentication = ''
        local	all	postgres				ident
        local	all	all					md5
        hostssl	all	all	188.165.209.148/32		md5
        hostssl	all	all	178.33.252.96/32		md5
        hostssl	all	all	all				pam
        hostssl	replication	backup-1	2001:41d0:302:1100::9:e5a9/128	pam pamservice=postgresql_replication
        hostssl	replication	backup-1	54.37.151.137/32		pam pamservice=postgresql_replication
      '';
    };

    security.pam.services = let
      pam_ldap = "${pkgs.pam_ldap}/lib/security/pam_ldap.so";
      pam_ldap_mysql = with myconfig.env.databases.mysql.pam;
        pkgs.writeText "mysql.conf" ''
        host ${myconfig.env.ldap.host}
        base ${myconfig.env.ldap.base}
        binddn ${dn}
        bindpw ${password}
        pam_filter ${filter}
        ssl start_tls
        '';
      pam_ldap_postgresql = with myconfig.env.databases.postgresql.pam;
        pkgs.writeText "postgresql.conf" ''
        host ${myconfig.env.ldap.host}
        base ${myconfig.env.ldap.base}
        binddn ${dn}
        bindpw ${password}
        pam_filter ${filter}
        ssl start_tls
        '';
      pam_ldap_postgresql_replication = pkgs.writeText "postgresql.conf" ''
        host ${myconfig.env.ldap.host}
        base ${myconfig.env.ldap.base}
        binddn ${myconfig.env.ldap.host_dn}
        bindpw ${myconfig.env.ldap.password}
        pam_login_attribute cn
        ssl start_tls
        '';
    in [
      {
        name = "mysql";
        text = ''
          # https://mariadb.com/kb/en/mariadb/pam-authentication-plugin/
          auth    required ${pam_ldap} config=${pam_ldap_mysql}
          account required ${pam_ldap} config=${pam_ldap_mysql}
          '';
      }
      {
        name = "postgresql";
        text = ''
          auth    required ${pam_ldap} config=${pam_ldap_postgresql}
          account required ${pam_ldap} config=${pam_ldap_postgresql}
          '';
      }
      {
        name = "postgresql_replication";
        text = ''
          auth    required ${pam_ldap} config=${pam_ldap_postgresql_replication}
          account required ${pam_ldap} config=${pam_ldap_postgresql_replication}
          '';
      }
    ];

    ids.uids.redis = myconfig.env.users.redis.uid;
    ids.gids.redis = myconfig.env.users.redis.gid;
    users.users.redis.uid = config.ids.uids.redis;
    users.groups.redis.gid = config.ids.gids.redis;
    services.redis = rec {
      enable = config.services.myDatabases.redis.enable;
      bind = "127.0.0.1";
      unixSocket = myconfig.env.databases.redis.socket;
      extraConfig = ''
        unixsocketperm 777
        maxclients 1024
        '';
    };
    system.activationScripts.redis = ''
      mkdir -p $(dirname ${myconfig.env.databases.redis.socket})
      chown redis $(dirname ${myconfig.env.databases.redis.socket})
    '';

    services.openldap = let
      kerberosSchema = pkgs.fetchurl {
        url = "https://raw.githubusercontent.com/krb5/krb5/master/src/plugins/kdb/ldap/libkdb_ldap/kerberos.schema";
        sha256 = "17fnkkf6s3lznsl7wp6914pqsc78d038rh38l638big8z608ksww";
      };
      puppetSchema = pkgs.fetchurl {
        url = "https://raw.githubusercontent.com/puppetlabs/puppet/master/ext/ldap/puppet.schema";
        sha256 = "11bjf5zfvqlim7p9vddcafs0wiq3v8ys77x8h6fbp9c6bdfh0awh";
      };
    in {
      enable = config.services.myDatabases.ldap.enable;
      dataDir = "/var/lib/openldap";
      urlList = [ "ldap://" "ldaps://" ];
      extraConfig = ''
        include         ${pkgs.openldap}/etc/schema/core.schema
        include         ${pkgs.openldap}/etc/schema/cosine.schema
        include         ${pkgs.openldap}/etc/schema/inetorgperson.schema
        include         ${pkgs.openldap}/etc/schema/nis.schema
        include         ${puppetSchema}
        include         ${kerberosSchema}
        include         ${./immae.schema}

        pidfile         /run/slapd/slapd.pid
        argsfile        /run/slapd/slapd.args

        moduleload      back_hdb
        backend         hdb

        moduleload      memberof
        database        hdb
        suffix          "${myconfig.env.ldap.base}"
        rootdn          "${myconfig.env.ldap.root_dn}"
        rootpw          ${myconfig.env.ldap.root_pw}
        directory       /var/lib/openldap
        overlay         memberof

        TLSCertificateFile    /var/lib/acme/ldap/cert.pem
        TLSCertificateKeyFile /var/lib/acme/ldap/key.pem
        TLSCACertificateFile  /var/lib/acme/ldap/fullchain.pem
        TLSCACertificatePath  ${pkgs.cacert.unbundled}/etc/ssl/certs/
        #This makes openldap crash
        #TLSCipherSuite        DEFAULT

        sasl-host kerberos.immae.eu
        ${builtins.readFile "${myconfig.privateFiles}/ldap.conf"}
        '';
    };
  };
}
Commit	Line	Data
9d90e7e2	1	{ lib, pkgs, config, myconfig, mylibs, ... }:
4d4f13f4 IB	2	let
	3	cfg = config.services.myDatabases;
	4	in {
	5	options.services.myDatabases = {
	6	enable = lib.mkEnableOption "my databases service";
	7	postgresql = {
	8	enable = lib.mkOption {
	9	default = cfg.enable;
	10	example = true;
	11	description = "Whether to enable postgresql database";
	12	type = lib.types.bool;
	13	};
	14	};
	15
	16	mariadb = {
	17	enable = lib.mkOption {
	18	default = cfg.enable;
	19	example = true;
	20	description = "Whether to enable mariadb database";
	21	type = lib.types.bool;
	22	};
	23	};
	24
	25	redis = {
	26	enable = lib.mkOption {
	27	default = cfg.enable;
	28	example = true;
	29	description = "Whether to enable redis database";
	30	type = lib.types.bool;
	31	};
	32	};
1bb44883 IB	33
	34	ldap = {
	35	enable = lib.mkOption {
	36	default = cfg.enable;
	37	example = true;
	38	description = "Whether to enable ldap";
	39	type = lib.types.bool;
	40	};
	41	};
4d4f13f4 IB	42	};
	43
	44	config = lib.mkIf cfg.enable {
	45	nixpkgs.config.packageOverrides = oldpkgs: rec {
	46	postgresql = postgresql111;
	47	postgresql111 = oldpkgs.postgresql100.overrideAttrs(old: rec {
	48	passthru = old.passthru // { psqlSchema = "11.0"; };
	49	name = "postgresql-11.1";
	50	src = pkgs.fetchurl {
	51	url = "mirror://postgresql/source/v11.1/${name}.tar.bz2";
	52	sha256 = "026v0sicsh7avzi45waf8shcbhivyxmi7qgn9fd1x0vl520mx0ch";
	53	};
f3d9c61e IB	54	configureFlags = old.configureFlags ++ [ "--with-pam" ];
	55	buildInputs = (old.buildInputs or []) ++ [ pkgs.pam ];
	56	patches = old.patches ++ [
	57	./postgresql_run_socket_path.patch
	58	];
4d4f13f4 IB	59	});
	60	mariadb = mariadbPAM;
	61	mariadbPAM = oldpkgs.mariadb.overrideAttrs(old: rec {
	62	cmakeFlags = old.cmakeFlags ++ [ "-DWITH_AUTHENTICATION_PAM=ON" ];
	63	buildInputs = old.buildInputs ++ [ pkgs.pam ];
	64	});
	65	};
	66
1bb44883	67	networking.firewall.allowedTCPPorts = [ 3306 5432 636 389 ];
4d4f13f4	68
7ebcaad5 IB	69	# for adminer, ssl is implemented with mysqli only, which is
	70	# currently disabled because it’s not compatible with pam.
	71	# Thus we need to generate two users for each 'remote': one remote
	72	# with SSL, and one localhost without SSL.
	73	# User identified by LDAP:
	74	# CREATE USER foo@% IDENTIFIED VIA pam USING 'mysql' REQUIRE SSL;
	75	# CREATE USER foo@localhost IDENTIFIED VIA pam USING 'mysql';
4d4f13f4 IB	76	services.mysql = rec {
	77	enable = cfg.mariadb.enable;
	78	package = pkgs.mariadb;
7ebcaad5 IB	79	extraOptions = ''
	80	ssl_ca = ${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt
	81	ssl_key = /var/lib/acme/mysql/key.pem
	82	ssl_cert = /var/lib/acme/mysql/fullchain.pem
	83	'';
4d4f13f4 IB	84	};
4d4f13f4 IB	85
f3d9c61e IB	86	security.acme.certs."postgresql" = config.services.myCertificates.certConfig // {
	87	user = "postgres";
	88	group = "postgres";
	89	plugins = [ "fullchain.pem" "key.pem" "account_key.json" ];
	90	domain = "db-1.immae.eu";
	91	postRun = ''
	92	systemctl reload postgresql.service
	93	'';
	94	};
	95
7ebcaad5 IB	96	security.acme.certs."mysql" = config.services.myCertificates.certConfig // {
	97	user = "mysql";
	98	group = "mysql";
	99	plugins = [ "fullchain.pem" "key.pem" "account_key.json" ];
	100	domain = "db-1.immae.eu";
	101	postRun = ''
	102	systemctl restart mysql.service
	103	'';
	104	};
	105
1bb44883 IB	106	security.acme.certs."ldap" = config.services.myCertificates.certConfig // {
	107	user = "openldap";
	108	group = "openldap";
	109	plugins = [ "fullchain.pem" "key.pem" "cert.pem" "account_key.json" ];
	110	domain = "ldap.immae.eu";
	111	postRun = ''
	112	systemctl restart openldap.service
	113	'';
	114	};
	115
f3d9c61e	116	system.activationScripts.postgresql = ''
6f4574e7	117	install -m 0755 -o postgres -g postgres -d ${myconfig.env.databases.postgresql.socket}
f3d9c61e IB	118	'';
f3d9c61e IB	119
4d4f13f4 IB	120	services.postgresql = rec {
	121	enable = cfg.postgresql.enable;
	122	package = pkgs.postgresql;
	123	enableTCPIP = true;
	124	extraConfig = ''
	125	max_connections = 100
	126	wal_level = logical
609c2961 IB	127	shared_buffers = 512MB
609c2961 IB	128	work_mem = 10MB
4d4f13f4 IB	129	max_wal_size = 1GB
	130	min_wal_size = 80MB
	131	log_timezone = 'Europe/Paris'
	132	datestyle = 'iso, mdy'
	133	timezone = 'Europe/Paris'
	134	lc_messages = 'en_US.UTF-8'
	135	lc_monetary = 'en_US.UTF-8'
	136	lc_numeric = 'en_US.UTF-8'
	137	lc_time = 'en_US.UTF-8'
	138	default_text_search_config = 'pg_catalog.english'
f3d9c61e IB	139	ssl = on
	140	ssl_cert_file = '/var/lib/acme/postgresql/fullchain.pem'
	141	ssl_key_file = '/var/lib/acme/postgresql/key.pem'
4d4f13f4 IB	142	'';
	143	authentication = ''
	144	local all postgres ident
	145	local all all md5
b9f79e95 IB	146	hostssl all all 188.165.209.148/32 md5
	147	hostssl all all 178.33.252.96/32 md5
	148	hostssl all all all pam
f3d9c61e IB	149	hostssl replication backup-1 2001:41d0:302:1100::9:e5a9/128 pam pamservice=postgresql_replication
f3d9c61e IB	150	hostssl replication backup-1 54.37.151.137/32 pam pamservice=postgresql_replication
4d4f13f4 IB	151	'';
	152	};
	153
	154	security.pam.services = let
bbba84f5	155	pam_ldap = "${pkgs.pam_ldap}/lib/security/pam_ldap.so";
7ebcaad5 IB	156	pam_ldap_mysql = with myconfig.env.databases.mysql.pam;
7ebcaad5 IB	157	pkgs.writeText "mysql.conf" ''
bbba84f5 IB	158	host ${myconfig.env.ldap.host}
bbba84f5 IB	159	base ${myconfig.env.ldap.base}
7ebcaad5 IB	160	binddn ${dn}
	161	bindpw ${password}
	162	pam_filter ${filter}
	163	ssl start_tls
	164	'';
	165	pam_ldap_postgresql = with myconfig.env.databases.postgresql.pam;
	166	pkgs.writeText "postgresql.conf" ''
	167	host ${myconfig.env.ldap.host}
	168	base ${myconfig.env.ldap.base}
	169	binddn ${dn}
	170	bindpw ${password}
	171	pam_filter ${filter}
bbba84f5	172	ssl start_tls
4d4f13f4	173	'';
9d90e7e2	174	pam_ldap_postgresql_replication = pkgs.writeText "postgresql.conf" ''
bbba84f5 IB	175	host ${myconfig.env.ldap.host}
	176	base ${myconfig.env.ldap.base}
	177	binddn ${myconfig.env.ldap.host_dn}
9d90e7e2	178	bindpw ${myconfig.env.ldap.password}
f3d9c61e	179	pam_login_attribute cn
7ebcaad5	180	ssl start_tls
f3d9c61e	181	'';
4d4f13f4 IB	182	in [
	183	{
	184	name = "mysql";
	185	text = ''
	186	# https://mariadb.com/kb/en/mariadb/pam-authentication-plugin/
bbba84f5 IB	187	auth required ${pam_ldap} config=${pam_ldap_mysql}
bbba84f5 IB	188	account required ${pam_ldap} config=${pam_ldap_mysql}
4d4f13f4 IB	189	'';
4d4f13f4 IB	190	}
f3d9c61e IB	191	{
	192	name = "postgresql";
	193	text = ''
7ebcaad5 IB	194	auth required ${pam_ldap} config=${pam_ldap_postgresql}
7ebcaad5 IB	195	account required ${pam_ldap} config=${pam_ldap_postgresql}
f3d9c61e IB	196	'';
	197	}
	198	{
	199	name = "postgresql_replication";
	200	text = ''
bbba84f5 IB	201	auth required ${pam_ldap} config=${pam_ldap_postgresql_replication}
bbba84f5 IB	202	account required ${pam_ldap} config=${pam_ldap_postgresql_replication}
f3d9c61e IB	203	'';
f3d9c61e IB	204	}
4d4f13f4 IB	205	];
4d4f13f4 IB	206
52c3e9e7 IB	207	ids.uids.redis = myconfig.env.users.redis.uid;
	208	ids.gids.redis = myconfig.env.users.redis.gid;
	209	users.users.redis.uid = config.ids.uids.redis;
	210	users.groups.redis.gid = config.ids.gids.redis;
4d4f13f4 IB	211	services.redis = rec {
	212	enable = config.services.myDatabases.redis.enable;
	213	bind = "127.0.0.1";
b0781dbc	214	unixSocket = myconfig.env.databases.redis.socket;
4d4f13f4 IB	215	extraConfig = ''
	216	unixsocketperm 777
	217	maxclients 1024
	218	'';
	219	};
42429ef0	220	system.activationScripts.redis = ''
b0781dbc IB	221	mkdir -p $(dirname ${myconfig.env.databases.redis.socket})
b0781dbc IB	222	chown redis $(dirname ${myconfig.env.databases.redis.socket})
42429ef0	223	'';
1bb44883 IB	224
	225	services.openldap = let
	226	kerberosSchema = pkgs.fetchurl {
	227	url = "https://raw.githubusercontent.com/krb5/krb5/master/src/plugins/kdb/ldap/libkdb_ldap/kerberos.schema";
	228	sha256 = "17fnkkf6s3lznsl7wp6914pqsc78d038rh38l638big8z608ksww";
	229	};
	230	puppetSchema = pkgs.fetchurl {
	231	url = "https://raw.githubusercontent.com/puppetlabs/puppet/master/ext/ldap/puppet.schema";
	232	sha256 = "11bjf5zfvqlim7p9vddcafs0wiq3v8ys77x8h6fbp9c6bdfh0awh";
	233	};
	234	in {
	235	enable = config.services.myDatabases.ldap.enable;
	236	dataDir = "/var/lib/openldap";
	237	urlList = [ "ldap://" "ldaps://" ];
	238	extraConfig = ''
	239	include ${pkgs.openldap}/etc/schema/core.schema
	240	include ${pkgs.openldap}/etc/schema/cosine.schema
	241	include ${pkgs.openldap}/etc/schema/inetorgperson.schema
	242	include ${pkgs.openldap}/etc/schema/nis.schema
	243	include ${puppetSchema}
	244	include ${kerberosSchema}
	245	include ${./immae.schema}
	246
	247	pidfile /run/slapd/slapd.pid
	248	argsfile /run/slapd/slapd.args
	249
	250	moduleload back_hdb
	251	backend hdb
	252
	253	moduleload memberof
	254	database hdb
	255	suffix "${myconfig.env.ldap.base}"
	256	rootdn "${myconfig.env.ldap.root_dn}"
	257	rootpw ${myconfig.env.ldap.root_pw}
	258	directory /var/lib/openldap
	259	overlay memberof
	260
	261	TLSCertificateFile /var/lib/acme/ldap/cert.pem
	262	TLSCertificateKeyFile /var/lib/acme/ldap/key.pem
	263	TLSCACertificateFile /var/lib/acme/ldap/fullchain.pem
	264	TLSCACertificatePath ${pkgs.cacert.unbundled}/etc/ssl/certs/
	265	#This makes openldap crash
	266	#TLSCipherSuite DEFAULT
	267
	268	sasl-host kerberos.immae.eu
	269	${builtins.readFile "${myconfig.privateFiles}/ldap.conf"}
	270	'';
	271	};
4d4f13f4 IB	272	};
4d4f13f4 IB	273	}